Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
GlassWireSetup.exe

Overview

General Information

Sample name:GlassWireSetup.exe
Analysis ID:1528306
MD5:f1f2568ebb13c2cbe8c481bffa4922bb
SHA1:c1a512a08eebea2d8d88e8ac53ca5628c566ef13
SHA256:5bd765c18cbe76eddf97ff39aa20c36e6bbf801ee876fc3c07c4651577e711a3
Infos:

Detection

Score:34
Range:0 - 100
Whitelisted:false
Confidence:0%

Compliance

Score:51
Range:0 - 100

Signatures

Creates an autostart registry key pointing to binary in C:\Windows
Creates multiple autostart registry keys
Hides threads from debuggers
PE file contains section with special chars
Query firmware table information (likely to detect VMs)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to open files direct via NTFS file id
Checks for available system drives (often done to infect USB drives)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates driver files
Creates files inside the driver directory
Creates files inside the system directory
Creates or modifies windows services
Deletes files inside the Windows folder
Detected potential crypto function
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops PE files to the windows directory (C:\Windows)
Drops certificate files (DER)
Enables security privileges
Entry point lies outside standard sections
Found dropped PE file which has not been started or loaded
Found evaded block containing many API calls
Found evasive API chain (date check)
Found evasive API chain checking for process token information
Found potential string decryption / allocating functions
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Modifies existing windows services
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
PE file contains more sections than normal
PE file contains sections with non-standard names
PE file does not import any functions
Queries disk information (often used to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Queries time zone information
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: CurrentVersion Autorun Keys Modification
Sigma detected: Explorer Process Tree Break
Sigma detected: Potentially Suspicious Rundll32 Activity
Sigma detected: Suspicious Rundll32 Setupapi.dll Activity
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Uses the system / local time for branch decision (may execute only at specific dates)
Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

  • System is w10x64
  • GlassWireSetup.exe (PID: 7112 cmdline: "C:\Users\user\Desktop\GlassWireSetup.exe" MD5: F1F2568EBB13C2CBE8C481BFFA4922BB)
    • vc_redist.x86.exe (PID: 6484 cmdline: "C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exe" /install /quiet /norestart MD5: DD0232EE751164EAAD2FE0DE7158D77D)
      • vc_redist.x86.exe (PID: 1148 cmdline: "C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exe" -burn.filehandle.attached=524 -burn.filehandle.self=640 /install /quiet /norestart MD5: 29C7A21BAE42889B08137C25AAE8E55C)
        • VC_redist.x86.exe (PID: 3584 cmdline: "C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{4C6967F0-7861-4E5E-A266-A79F91D53451} {8D47B6A8-8425-45E8-BA0B-10ED43630BCC} 1148 MD5: 29C7A21BAE42889B08137C25AAE8E55C)
    • GWInstSt.exe (PID: 7728 cmdline: "C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exe" "https://www.glasswire.com/stat/install.php?v=3.4.694&build_type=full&os=Ten&platform=x64&update=0&install_id=8AC7009D4B52E62F54AD1F4176FBF27962F3EAF3F7DDE916A08729FD64A8AEEE&referrer=https%3A%2F%2Fwww.google.com%2F&user_agent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F129.0.0.0+Safari%2F537.36+Edg%2F129.0.0.0&ga_client_id=1231827075.1728319357" "nsis$$.tmp" MD5: 63DC9E4A693261F14924D8692D2EB442)
    • rundll32.exe (PID: 7828 cmdline: "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Windows\system32\drivers\gwdrv.inf MD5: EF3179D498793BF4234F708D3BE28633)
      • runonce.exe (PID: 7960 cmdline: "C:\Windows\system32\runonce.exe" -r MD5: 9ADEF025B168447C1E8514D919CB5DC0)
        • grpconv.exe (PID: 7996 cmdline: "C:\Windows\System32\grpconv.exe" -o MD5: 8531882ACC33CB4BDC11B305A01581CE)
    • net.exe (PID: 8136 cmdline: "C:\Windows\system32\net.exe" start gwdrv MD5: 0BD94A338EEA5A4E1F2830AE326E6D19)
      • conhost.exe (PID: 8148 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • net1.exe (PID: 7196 cmdline: C:\Windows\system32\net1 start gwdrv MD5: 55693DF2BB3CBE2899DFDDF18B4EB8C9)
    • wevtutil.exe (PID: 5180 cmdline: "C:\Windows\system32\wevtutil.exe" im "C:\Users\user\AppData\Local\Temp\nsx9694.tmp\eventlog.man" /rf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll" /mf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll" MD5: 3C0E48DA02447863279B0FE3CE7FE5E8)
      • conhost.exe (PID: 7264 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • wevtutil.exe (PID: 5328 cmdline: "C:\Windows\system32\wevtutil.exe" im "C:\Users\user\AppData\Local\Temp\nsx9694.tmp\eventlog.man" /rf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll" /mf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll" /fromwow64 MD5: 1AAE26BD68B911D0420626A27070EB8D)
    • GWCtlSrv.exe (PID: 7328 cmdline: "C:\Program Files (x86)\GlassWire\GWCtlSrv.exe" "-i" MD5: 56D6DB5EA2E8EF737A0CF9C808B8D533)
      • conhost.exe (PID: 7300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • GWCtlSrv.exe (PID: 4248 cmdline: "C:\Program Files (x86)\GlassWire\GWCtlSrv.exe" "-s" MD5: 56D6DB5EA2E8EF737A0CF9C808B8D533)
      • conhost.exe (PID: 7436 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
    • explorer.exe (PID: 5868 cmdline: "C:\Windows\explorer.exe" "C:\Program Files (x86)\GlassWire\glasswire.exe" MD5: 662F4F92FDE3557E86D110526BB578D5)
  • VSSVC.exe (PID: 3368 cmdline: C:\Windows\system32\vssvc.exe MD5: 875046AD4755396636A68F4A9EDB22A4)
  • svchost.exe (PID: 3736 cmdline: C:\Windows\System32\svchost.exe -k swprv MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • SrTasks.exe (PID: 4268 cmdline: C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:1 MD5: 2694D2D28C368B921686FE567BD319EB)
    • conhost.exe (PID: 3448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
  • msiexec.exe (PID: 7180 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)
  • svchost.exe (PID: 7856 cmdline: C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
    • drvinst.exe (PID: 7892 cmdline: DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{1b9ae675-a69a-784f-a0a3-d898132a09ba}\gwdrv.inf" "9" "4e7eab47b" "0000000000000144" "WinSta0\Default" "0000000000000170" "208" "C:\Windows\system32\drivers" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)
    • drvinst.exe (PID: 7944 cmdline: DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gwdrv.inf_amd64_54933c59b5293195\gwdrv.inf" "0" "4e7eab47b" "0000000000000170" "WinSta0\Default" MD5: 294990C88B9D1FE0A54A1FA8BF4324D9)
  • GWCtlSrv.exe (PID: 7380 cmdline: "C:\Program Files (x86)\GlassWire\GWCtlSrv.exe" MD5: 56D6DB5EA2E8EF737A0CF9C808B8D533)
  • explorer.exe (PID: 1816 cmdline: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding MD5: 662F4F92FDE3557E86D110526BB578D5)
    • GlassWire.exe (PID: 1060 cmdline: "C:\Program Files (x86)\GlassWire\GlassWire.exe" MD5: E4ADF42227B3BADFCD239669363B4BDF)
  • svchost.exe (PID: 6764 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)
  • GlassWire.exe (PID: 7120 cmdline: "C:\Program Files (x86)\GlassWire\glasswire.exe" -hide MD5: E4ADF42227B3BADFCD239669363B4BDF)
  • GlassWire.exe (PID: 2836 cmdline: "C:\Program Files (x86)\GlassWire\glasswire.exe" -hide MD5: E4ADF42227B3BADFCD239669363B4BDF)
  • cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

System Summary

barindex
Sigma detected: CurrentVersion Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Program Files (x86)\GlassWire\glasswire.exe" -hide, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\GlassWireSetup.exe, ProcessId: 7112, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GlassWire
Sigma detected: Explorer Process Tree Break
Source: Process startedAuthor: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @gott_cyber: Data: Command: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding, CommandLine: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding, CommandLine|base64offset|contains: Iyb, Image: C:\Windows\explorer.exe, NewProcessName: C:\Windows\explorer.exe, OriginalFileName: C:\Windows\explorer.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 752, ProcessCommandLine: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding, ProcessId: 1816, ProcessName: explorer.exe
Sigma detected: Potentially Suspicious Rundll32 Activity
Source: Process startedAuthor: juju4, Jonhnathan Ribeiro, oscd.community, Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Windows\system32\drivers\gwdrv.inf, CommandLine: "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Windows\system32\drivers\gwdrv.inf, CommandLine|base64offset|contains: [HZ, Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: "C:\Users\user\Desktop\GlassWireSetup.exe", ParentImage: C:\Users\user\Desktop\GlassWireSetup.exe, ParentProcessId: 7112, ParentProcessName: GlassWireSetup.exe, ProcessCommandLine: "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Windows\system32\drivers\gwdrv.inf, ProcessId: 7828, ProcessName: rundll32.exe
Sigma detected: Suspicious Rundll32 Setupapi.dll Activity
Source: Process startedAuthor: Konstantin Grishchenko, oscd.community: Data: Command: "C:\Windows\system32\runonce.exe" -r, CommandLine: "C:\Windows\system32\runonce.exe" -r, CommandLine|base64offset|contains: , Image: C:\Windows\System32\runonce.exe, NewProcessName: C:\Windows\System32\runonce.exe, OriginalFileName: C:\Windows\System32\runonce.exe, ParentCommandLine: "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Windows\system32\drivers\gwdrv.inf, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 7828, ParentProcessName: rundll32.exe, ProcessCommandLine: "C:\Windows\system32\runonce.exe" -r, ProcessId: 7960, ProcessName: runonce.exe
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\ProgramData\Package Cache\{8d5fdf81-7022-423f-bd8b-b513a1050ae1}\VC_redist.x86.exe" /burn.runonce, EventID: 13, EventType: SetValue, Image: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exe, ProcessId: 3584, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{8d5fdf81-7022-423f-bd8b-b513a1050ae1}
Sigma detected: Net.exe Execution
Source: Process startedAuthor: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements): Data: Command: "C:\Windows\system32\net.exe" start gwdrv, CommandLine: "C:\Windows\system32\net.exe" start gwdrv, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "C:\Users\user\Desktop\GlassWireSetup.exe", ParentImage: C:\Users\user\Desktop\GlassWireSetup.exe, ParentProcessId: 7112, ParentProcessName: GlassWireSetup.exe, ProcessCommandLine: "C:\Windows\system32\net.exe" start gwdrv, ProcessId: 8136, ProcessName: net.exe
Sigma detected: Start Windows Service Via Net.EXE
Source: Process startedAuthor: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community: Data: Command: "C:\Windows\system32\net.exe" start gwdrv, CommandLine: "C:\Windows\system32\net.exe" start gwdrv, CommandLine|base64offset|contains: , Image: C:\Windows\System32\net.exe, NewProcessName: C:\Windows\System32\net.exe, OriginalFileName: C:\Windows\System32\net.exe, ParentCommandLine: "C:\Users\user\Desktop\GlassWireSetup.exe", ParentImage: C:\Users\user\Desktop\GlassWireSetup.exe, ParentProcessId: 7112, ParentProcessName: GlassWireSetup.exe, ProcessCommandLine: "C:\Windows\system32\net.exe" start gwdrv, ProcessId: 8136, ProcessName: net.exe
Sigma detected: Windows Processes Suspicious Parent Directory
Source: Process startedAuthor: vburov: Data: Command: C:\Windows\System32\svchost.exe -k swprv, CommandLine: C:\Windows\System32\svchost.exe -k swprv, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 620, ProcessCommandLine: C:\Windows\System32\svchost.exe -k swprv, ProcessId: 3736, ProcessName: svchost.exe

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005C9EB7 DecryptFileW,1_2_005C9EB7
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005EF961 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,1_2_005EF961
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005C9C99 DecryptFileW,DecryptFileW,1_2_005C9C99
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_00879EB7 DecryptFileW,2_2_00879EB7
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_0089F961 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,2_2_0089F961
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_00879C99 DecryptFileW,DecryptFileW,2_2_00879C99
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E2F961 CryptAcquireContextW,GetLastError,CryptCreateHash,GetLastError,CryptHashData,ReadFile,GetLastError,CryptDestroyHash,CryptReleaseContext,GetLastError,CryptGetHashParam,GetLastError,SetFilePointerEx,GetLastError,3_2_00E2F961
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E09C99 DecryptFileW,DecryptFileW,3_2_00E09C99
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E09EB7 DecryptFileW,3_2_00E09EB7
Source: GlassWireSetup.exe, 00000000.00000003.1938926313.0000000003298000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: -----BEGIN RSA PUBLIC KEY-----memstr_5a6c2a26-8

Compliance

barindex
Uses 32bit PE files
Source: GlassWireSetup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Found installer window with terms and condition text
Source: C:\Users\user\Desktop\GlassWireSetup.exeWindow detected: < &Back&Next >Cancel License AgreementPlease review the license terms before installing GlassWire.Press Page Down to see the rest of the agreement.GLASSWIRE SERVICES SUBSCRIPTION AGREEMENTTERMS AND CONDITIONSThese are the terms on which GlassWire a brand owned by Domotz Inc ("we" or "Domotz" or GlassWire) enable you the Subscriber ("you" or "Subscriber") to access our integrated technology platform as outlined in further detail in this Agreement our website and the Documentation which is available to Subscribers via the internet.These Terms of Service (the "Terms") including any extension annex and update together with the GlassWire Privacy Policy govern the way you will use our platform and all related services.Please read these terms carefully before you download any GlassWire Software use any GlassWire Services or Service Licenses. These terms explain who we are how we will provide the Services to you what to do if there is a problem and other important information.Please refer to our Privacy Policy for information on how we collect use and disclose information from our users. You acknowledge and agree that your use of the Services is subject to our Privacy Policy.ACCEPTANCEYou are deemed to have accepted the terms of this Agreement and will have created a binding contract with GlassWire upon any of the following events: (a) download or installation of any GlassWire Services or related Software; (b) access to or use of any GlassWire Services or related Software; (c) payment for GlassWire Services or related Software Subscription or Service Licenses; (d) entering into an order form for GlassWire Services or related Software Subscription or Service Licenses; or (e) clicking an "accept" button or other similar acknowledgment indicating your acceptance of this Agreement. If you do not agree to be bound by this Agreement you may not access or use the Services or any related. Please read through the entirety of this Agreement to review important provisions regarding intellectual property disclaimers limitations of liability indemnification waivers exclusive law and jurisdiction for resolution of disputes and other legal restrictions.By using our Services you agree to be bound by these Terms. If you don't agree to be bound by these Terms do not use the Services. If you are accessing and using the Services on behalf of a company (such as your employer) or other legal entity you represent and warrant that you have the authority to bind that company or other legal entity and each of its affiliates to these Terms. In that case "you" and "your" will refer to that company or other legal entity and its affiliates.INFORMATION ABOUT US AND CONTACT DETAILSThe subscription services provided by GlassWire to you under this Agreement including the GlassWire website cloud services desktop web and mobile applications and other services and functionality ("Services") are provided by Domotz Inc a company incorporated in the State of Delaware USA. Our office are a
Creates a software restore point
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\SystemRestore SRInitDoneJump to behavior
Creates license or readme file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\ASIO-LICENSE_1_0.txtJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\GEOIP-LICENSE.txtJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\GEOLITE2-LICENSE.txtJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\LZ4-LICENSE.txtJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\OPENSSL-LICENSE.txtJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\PROTOBYUF-LICENSE.txtJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\QT-LICENSE.GPL3-EXCEPT.txtJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\QT-LICENSE.txtJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\RAPIDJSON-LICENSE.txtJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\RAPIDXML-LICENSE.txtJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\ZLIB-LICENSE.txtJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1028\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1029\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1031\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1036\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1040\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1041\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1042\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1045\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1046\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1049\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1055\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\2052\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\3082\license.rtfJump to behavior
PE / OLE file has a valid certificate
Source: GlassWireSetup.exeStatic PE information: certificate valid
Uses secure TLS version for HTTPS connections
Source: unknownHTTPS traffic detected: 18.244.164.20:443 -> 192.168.2.4:57884 version: TLS 1.2
Contains modern PE file flags such as dynamic base (ASLR) or NX
Source: GlassWireSetup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Binary contains paths to debug symbols
Source: Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: vc_redist.x86.exe, 00000001.00000000.1730721661.00000000005FB000.00000002.00000001.01000000.00000005.sdmp, vc_redist.x86.exe, 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmp, vc_redist.x86.exe, 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmp, vc_redist.x86.exe, 00000002.00000000.1731634886.00000000008AB000.00000002.00000001.01000000.00000007.sdmp, VC_redist.x86.exe, 00000003.00000000.1736115821.0000000000E3B000.00000002.00000001.01000000.0000000C.sdmp, VC_redist.x86.exe, 00000003.00000002.1918918991.0000000000E3B000.00000002.00000001.01000000.0000000C.sdmp, VC_redist.x86.exe, 00000003.00000003.1866100025.00000000012D5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: GlassWireSetup.exe, 00000000.00000003.2253359318.0000000002756000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Jenkins\workspace\Glasswire-Consumer-rc\.build\build\msvc-win-x86-release-full-production\bin\GWInstSt.pdb source: GWInstSt.exe
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdb source: GlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\users\tvo\dev\securemix\glasswire-windows-driver\.build\bins\Production-x64\generic-driver\gwdrv.pdb source: GlassWireSetup.exe, 00000000.00000003.2316678417.00000000055AC000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2252884220.000000000275E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: revocationDateX509_REVOKEDlastUpdateX509_CRL_INFOcrlX509_CRLcrypto\x509\x_crl.cX509_CRL_add0_revokedX509_CRL_METHOD_newcompiler: cl /Zi /Fdossl_static.pdb /MD /Zl /Gs0 /GF /Gy -MD -O2 -Ob2 -MD -O2 -Ob2 -DL_ENDIAN -DOPENSSL_PIC -DNDEBUG;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Users\jenkins\.conan\data\openssl\3.1.0\_\_\package\85c19aeb1a95eed600c2a699e15fa9ae0bd53a34\res\lib\ossl-modules.dll@@@@@@@@@hHHHH@@@@@@@@@@@@@@@@@@( source: GlassWireSetup.exe, 00000000.00000003.1938926313.0000000003252000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MD /Zl /Gs0 /GF /Gy -MD -O2 -Ob2 -MD -O2 -Ob2 -DL_ENDIAN -DOPENSSL_PIC -DNDEBUG source: GlassWireSetup.exe, 00000000.00000003.1938926313.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B067000.00000002.00000001.01000000.0000000F.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B0E9000.00000002.00000001.01000000.0000000F.sdmp, GlassWireSetup.exe, 00000000.00000003.1938926313.0000000003252000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Jenkins\workspace\Glasswire-Consumer-rc\.build\build\msvc-win-x86-release-full-production\bin\nsihelper.pdb source: GlassWireSetup.exe, 00000000.00000003.1938926313.0000000003305000.00000004.00001000.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2568711641.000000006B252000.00000002.00000001.01000000.0000000F.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B19C000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\lib\Qt5Svg.pdb source: GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: krevocationDateX509_REVOKEDlastUpdateX509_CRL_INFOcrlX509_CRLcrypto\x509\x_crl.cX509_CRL_add0_revokedX509_CRL_METHOD_newcompiler: cl /Zi /Fdossl_static.pdb /MD /Zl /Gs0 /GF /Gy -MD -O2 -Ob2 -MD -O2 -Ob2 -DL_ENDIAN -DOPENSSL_PIC -DNDEBUG;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Users\jenkins\.conan\data\openssl\3.1.0\_\_\package\85c19aeb1a95eed600c2a699e15fa9ae0bd53a34\res\lib\ossl-modules.dll@@@@@@@@@hHHHH@@@@@@@@@@@@@@@@@@( source: GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B0E9000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\dev\src\hg\manycam\glasswire\core\build\bin\win7-release\x86\driver\gwdrv.pdb source: GlassWireSetup.exe, 00000000.00000003.2251540397.0000000002758000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\dev\src\hg\manycam\glasswire\core\build\bin\vc110-release\x64\driver\gwdrv.pdb source: GlassWireSetup.exe, 00000000.00000003.2247096759.000000000275D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb"" source: GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ?crypto\stack\stack.cOPENSSL_sk_dupOPENSSL_sk_deep_copysk_reserveOPENSSL_sk_new_reserveOPENSSL_sk_reserveOPENSSL_sk_insertOPENSSL_sk_seti=%dcompiler: cl /Zi /Fdossl_static.pdb /MD /Zl /Gs0 /GF /Gy -MD -O2 -Ob2 -MD -O2 -Ob2 -DL_ENDIAN -DOPENSSL_PIC -DNDEBUGOpenSSL 3.1.0 14 Mar 20233.1.0built on: Thu Aug 24 07:39:01 2023 UTCplatform: VC-conan-Release-Windows-x86-Visual Studio-16OPENSSLDIR: "C:\Users\jenkins\.conan\data\openssl\3.1.0\_\_\package\85c19aeb1a95eed600c2a699e15fa9ae0bd53a34\res"ENGINESDIR: "\lib\engines-3"MODULESDIR: "\lib\ossl-modules"CPUINFO: N/Anot available source: GlassWireSetup.exe, 00000000.00000003.1938926313.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B067000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\dev\src\hg\manycam\glasswire\core\build\bin\win7-release\x64\driver\gwdrv.pdb source: GlassWireSetup.exe, 00000000.00000003.2249868436.0000000002755000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\dev\src\hg\manycam\glasswire\core\build\bin\vc110-release\x86\driver\gwdrv.pdb source: GlassWireSetup.exe, 00000000.00000003.2248500311.000000000275C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtwinextras\lib\Qt5WinExtras.pdb.. source: GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdbU source: GlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtwinextras\lib\Qt5WinExtras.pdb source: GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Gui.pdb source: GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\lib\Qt5Svg.pdb,, source: GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5OpenGL.pdb source: GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: GlassWireSetup.exe, 00000000.00000003.2222713240.000000000275D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qwindows.pdb source: GlassWireSetup.exe, 00000000.00000003.2263010670.0000000002750000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5OpenGL.pdb55 source: GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmp
Source: C:\Windows\System32\msiexec.exeFile opened: z:
Source: C:\Windows\System32\msiexec.exeFile opened: x:
Source: C:\Windows\System32\msiexec.exeFile opened: v:
Source: C:\Windows\System32\msiexec.exeFile opened: t:
Source: C:\Windows\System32\msiexec.exeFile opened: r:
Source: C:\Windows\System32\msiexec.exeFile opened: p:
Source: C:\Windows\System32\msiexec.exeFile opened: n:
Source: C:\Windows\System32\msiexec.exeFile opened: l:
Source: C:\Windows\System32\msiexec.exeFile opened: j:
Source: C:\Windows\System32\msiexec.exeFile opened: h:
Source: C:\Windows\System32\msiexec.exeFile opened: f:
Source: C:\Windows\System32\msiexec.exeFile opened: b:
Source: C:\Windows\System32\msiexec.exeFile opened: y:
Source: C:\Windows\System32\msiexec.exeFile opened: w:
Source: C:\Windows\System32\msiexec.exeFile opened: u:
Source: C:\Windows\System32\msiexec.exeFile opened: s:
Source: C:\Windows\System32\msiexec.exeFile opened: q:
Source: C:\Windows\System32\msiexec.exeFile opened: o:
Source: C:\Windows\System32\msiexec.exeFile opened: m:
Source: C:\Windows\System32\msiexec.exeFile opened: k:
Source: C:\Windows\System32\msiexec.exeFile opened: i:
Source: C:\Windows\System32\msiexec.exeFile opened: g:
Source: C:\Windows\System32\msiexec.exeFile opened: e:
Source: C:\Windows\System32\svchost.exeFile opened: c:
Source: C:\Windows\System32\msiexec.exeFile opened: a:
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_2_00405C4D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_00405C4D
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_2_0040689E FindFirstFileW,FindClose,0_2_0040689E
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_2_00402930 FindFirstFileW,0_2_00402930
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005B3BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,1_2_005B3BC3
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005F4315 FindFirstFileW,FindClose,1_2_005F4315
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005C993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose,1_2_005C993E
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_008A4315 FindFirstFileW,FindClose,2_2_008A4315
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_0087993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose,2_2_0087993E
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_00863BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,2_2_00863BC3
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E34315 FindFirstFileW,FindClose,3_2_00E34315
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E0993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose,3_2_00E0993E
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00DF3BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,3_2_00DF3BC3
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
Source: Joe Sandbox ViewJA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Source: global trafficHTTP traffic detected: GET /stat/install.php?v=3.4.694&build_type=full&os=Ten&platform=x64&update=0&install_id=8AC7009D4B52E62F54AD1F4176FBF27962F3EAF3F7DDE916A08729FD64A8AEEE&referrer=https%3A%2F%2Fwww.google.com%2F&user_agent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F129.0.0.0+Safari%2F537.36+Edg%2F129.0.0.0&ga_client_id=1231827075.1728319357 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.glasswire.comConnection: Keep-Alive
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global trafficHTTP traffic detected: GET /api/v1/cell?locale=ch HTTP/1.1Host: pivot.protect.glasswire.comUser-Agent: GW/3.4.694.0 (Desktop Windows 10; x64)Accept: */*
Source: global trafficHTTP traffic detected: GET /stat/install.php?v=3.4.694&build_type=full&os=Ten&platform=x64&update=0&install_id=8AC7009D4B52E62F54AD1F4176FBF27962F3EAF3F7DDE916A08729FD64A8AEEE&referrer=https%3A%2F%2Fwww.google.com%2F&user_agent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F129.0.0.0+Safari%2F537.36+Edg%2F129.0.0.0&ga_client_id=1231827075.1728319357 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: www.glasswire.comConnection: Keep-Alive
Source: global trafficDNS traffic detected: DNS query: pivot.protect.glasswire.com
Source: global trafficDNS traffic detected: DNS query: api-eu-north-1.protect.glasswire.com
Source: global trafficDNS traffic detected: DNS query: www.glasswire.com
Source: unknownHTTP traffic detected: POST /api/v1.1/agent/device/register HTTP/1.1Host: api-eu-north-1.protect.glasswire.comUser-Agent: GW/3.4.694.0 (Desktop Windows 10; x64)Accept: */*Content-Type: application/jsonContent-Length: 41
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://acedicom.edicomgroup.com/doc
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://acedicom.edicomgroup.com/docB=
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://acedicom.edicomgroup.com/docF-
Source: vc_redist.x86.exe, VC_redist.x86.exeString found in binary or memory: http://appsyndication.org/2006/appsyn
Source: vc_redist.x86.exe, 00000001.00000000.1730721661.00000000005FB000.00000002.00000001.01000000.00000005.sdmp, vc_redist.x86.exe, 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmp, vc_redist.x86.exe, 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmp, vc_redist.x86.exe, 00000002.00000000.1731634886.00000000008AB000.00000002.00000001.01000000.00000007.sdmp, VC_redist.x86.exe, 00000003.00000000.1736115821.0000000000E3B000.00000002.00000001.01000000.0000000C.sdmp, VC_redist.x86.exe, 00000003.00000002.1918918991.0000000000E3B000.00000002.00000001.01000000.0000000C.sdmp, VC_redist.x86.exe, 00000003.00000003.1866100025.00000000012D5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://appsyndication.org/2006/appsynapplicationapuputil.cppupgradeexclusivetrueenclosuredigestalgor
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ca.disig.sk/ca/crl/ca_disig.crl0
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.html
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cps.chambersign.org/cps/chambersignroot.htmlcDw
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cps.chambersign.org/cps/chambersroot.htmlC
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://cps.chambersign.org/cps/chambersroot.htmlUDwm
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.chambersign.org/chambersignroot.crl
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.chambersign.org/chambersignroot.crl0
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.chambersign.org/chambersroot.crl
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl
Source: GlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253359318.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2263010670.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2222713240.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crlF
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crl4Dw
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/COMODOCertificationAuthority.crlz
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/SecureCertificateServices.crl09
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/TrustedCertificateServices.crl0:
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crl
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.oces.certifikat.dk/oces.crl
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.oces.certifikat.dk/oces.crl0
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.pki.wellsfargo.com/wsprca.crl
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.pki.wellsfargo.com/wsprca.crl0
Source: GlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253359318.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2263010670.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2222713240.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: GlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253359318.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2263010670.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2222713240.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: GlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253359318.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2263010670.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2222713240.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: GlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253359318.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2263010670.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2222713240.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/SGCA.crl0
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: GlassWireSetup.exe, 00000000.00000003.2249868436.0000000002755000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2246018078.000000000275E000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248500311.000000000275C000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247096759.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247599754.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248968233.0000000002752000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2250679639.0000000002752000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2251540397.0000000002758000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/ev2009a.crl0
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/ev2009a.crl
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/ev2009a.crl0
Source: GlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253359318.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2263010670.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2222713240.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: GlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253359318.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2263010670.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2222713240.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: GlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253359318.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2263010670.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2222713240.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: GlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253359318.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2263010670.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2222713240.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fedir.comsign.co.il/crl/ComSignCA.crl0
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl?
Source: GlassWireSetup.exe, 00000000.00000003.2243073905.0000000002759000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://fsf.org/
Source: GlassWireSetup.exe, 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmp, GlassWireSetup.exe, 00000000.00000000.1698449415.000000000040A000.00000008.00000001.01000000.00000003.sdmpString found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.CAcert.org/0(
Source: GlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253359318.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2263010670.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2222713240.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0K
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.pki.gva.es
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.pki.gva.es0
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.pki.gva.esT
Source: GlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253359318.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2263010670.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2222713240.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0
Source: GlassWireSetup.exe, 00000000.00000003.2249868436.0000000002755000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2246018078.000000000275E000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248500311.000000000275C000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247096759.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247599754.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248968233.0000000002752000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2250679639.0000000002752000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2251540397.0000000002758000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ocsp.thawte.com0
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://policy.camerfirma.com
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://policy.camerfirma.com:Dv
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://policy.camerfirma.comvDwN
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://repository.swisssign.com/I
Source: GlassWireSetup.exe, 00000000.00000003.2246018078.000000000275E000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248500311.000000000275C000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247096759.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247599754.0000000002756000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: GlassWireSetup.exe, 00000000.00000003.2246018078.000000000275E000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248500311.000000000275C000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247096759.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247599754.0000000002756000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://s2.symcb.com0
Source: GlassWire.exe, 00000024.00000003.2591470657.0000000006A1F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFL
Source: GlassWire.exe, 00000024.00000003.2591470657.0000000006A1F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLCopyright
Source: GlassWire.exe, 00000024.00000003.2591470657.0000000006A1F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLOswaldLight
Source: GlassWireSetup.exe, 00000000.00000003.2249868436.0000000002755000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248968233.0000000002752000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2250679639.0000000002752000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2251540397.0000000002758000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: GlassWireSetup.exe, 00000000.00000003.2249868436.0000000002755000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248968233.0000000002752000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2250679639.0000000002752000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2251540397.0000000002758000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sf.symcb.com/sf.crt0
Source: GlassWireSetup.exe, 00000000.00000003.2249868436.0000000002755000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248968233.0000000002752000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2250679639.0000000002752000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2251540397.0000000002758000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sf.symcd.com0&
Source: GlassWireSetup.exe, 00000000.00000003.2246018078.000000000275E000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248500311.000000000275C000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247096759.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247599754.0000000002756000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: GlassWireSetup.exe, 00000000.00000003.2246018078.000000000275E000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248500311.000000000275C000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247096759.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247599754.0000000002756000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sv.symcb.com/sv.crt0
Source: GlassWireSetup.exe, 00000000.00000003.2246018078.000000000275E000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248500311.000000000275C000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247096759.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247599754.0000000002756000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://sv.symcd.com0&
Source: GlassWireSetup.exe, 00000000.00000003.2249868436.0000000002755000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2246018078.000000000275E000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248500311.000000000275C000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247096759.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247599754.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248968233.0000000002752000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2250679639.0000000002752000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2251540397.0000000002758000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: GlassWireSetup.exe, 00000000.00000003.2249868436.0000000002755000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2246018078.000000000275E000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248500311.000000000275C000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247096759.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247599754.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248968233.0000000002752000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2250679639.0000000002752000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2251540397.0000000002758000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: GlassWireSetup.exe, 00000000.00000003.2249868436.0000000002755000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2246018078.000000000275E000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248500311.000000000275C000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247096759.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247599754.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248968233.0000000002752000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2250679639.0000000002752000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2251540397.0000000002758000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: vc_redist.x86.exe, 00000002.00000002.1927445488.0000000003570000.00000004.00000800.00020000.00000000.sdmp, vc_redist.x86.exe, 00000002.00000002.1926951441.0000000003040000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://wixtoolset.org/schemas/thmutil/2010
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.CAcert.org
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.CAcert.org/ca.crt
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.CAcert.org/ca.crt0J
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.CAcert.org/ca.crtI
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.CAcert.org/index.php?id=10
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.CAcert.org/index.php?id=1004
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.CAcert.org/index.php?id=100P
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.CAcert.org/index.php?id=10L
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.CAcert.org1
Source: GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: GlassWireSetup.exe, 00000000.00000003.2235943913.000000000275E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/
Source: GlassWire.exe, 00000024.00000003.2591470657.0000000006A1F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: GlassWire.exe, 00000024.00000003.2591470657.0000000006A1F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0Copyright
Source: GlassWire.exe, 00000024.00000003.2591470657.0000000006A1F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0Digitized
Source: GlassWire.exe, 00000024.00000003.2591470657.0000000006A1F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0Licensed
Source: GlassWire.exe, 00000024.00000003.2591470657.0000000006A1F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0RobotoMedium
Source: GlassWire.exe, 00000024.00000003.2591470657.0000000006A1F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.ascendercorp.com/http://www.ascendercorp.com/typedesigners.htmlLicensed
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cacert.org
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cacert.org/index.php?id=10
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cacert.org/index.php?id=100V
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cacert.org1
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.cacert.org?
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.certicamara.com/dpc/0Z
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.certifikat.dk/repository0
Source: GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.certplus.com/CRL/class2.crl
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.certplus.com/CRL/class2.crlsDwK
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.chambersign.org
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.chambersign.org1
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.chambersign.org287
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.chambersign.orgD
Source: GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.color.org)
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CACerts/DigiCertHighAssuranceEVCA-1.crt
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CACerts/DigiCertHighAssuranceEVCA-1.crt0
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.disig.sk/ca
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.disig.sk/ca/crl/ca_disig.crl0
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.disig.sk/ca0f
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.e-szigno.hu/RootCA.crl
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.e-szigno.hu/RootCA.crt
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.e-szigno.hu/RootCA.crt0
Source: GlassWireSetup.exeString found in binary or memory: http://www.e-szigno.hu/SZSZ
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.e-szigno.hu/SZSZ/
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.e-szigno.hu/SZSZ/0
Source: GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.entrust.net/CRL/net1.crl
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.entrust.net/CRL/net1.crl0
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2560293632.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2562623946.00000000006CE000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2554625404.00000000006C5000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com/cps0
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com0
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.firmaprofesional.com?
Source: GlassWireSetup.exe, 00000000.00000003.2243073905.0000000002759000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gnu.org/licenses/
Source: GlassWireSetup.exe, 00000000.00000003.2242587337.0000000002757000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2243073905.0000000002759000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.gnu.org/philosophy/why-not-lgpl.html
Source: GlassWireSetup.exe, 00000000.00000003.2238003241.0000000002751000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.opensource.org/licenses/bsd-license.php)
Source: GlassWireSetup.exe, 00000000.00000003.2241198688.0000000002756000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.openssl.org/)
Source: GlassWireSetup.exeString found in binary or memory: http://www.pki.gva.es/cp
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pki.gva.es/cps
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pki.gva.es/cps0
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pki.gva.es/cps0%
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pkioverheid.nl/policies/root-policy
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G2
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G20
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pkioverheid.nl/policies/root-policy-G2u
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.pkioverheid.nl/policies/root-policy0
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bm
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bm0
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadis.bmD
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cps0
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.quovadisglobal.com/cpsK/
Source: GlassWire.exe, 00000024.00000003.2591470657.0000000006A1F000.00000004.00001000.00020000.00000000.sdmpString found in binary or memory: http://www.sansoxygen.comhttp://www.sansoxygen.comThis
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sk.ee/cps/
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sk.ee/cps/0
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sk.ee/juur/crl/
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.sk.ee/juur/crl/0
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.startssl.com/intermediate.pdf0
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.startssl.com/policy.pdf
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.startssl.com/policy.pdf0
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.startssl.com/policy.pdf04
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.startssl.com/policy.pdfB
Source: GlassWireSetup.exe, 00000000.00000003.2246018078.000000000275E000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248500311.000000000275C000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247096759.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247599754.0000000002756000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/cps0(
Source: GlassWireSetup.exe, 00000000.00000003.2246018078.000000000275E000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248500311.000000000275C000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247096759.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247599754.0000000002756000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/rpa00
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_2_ca_II.crl
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crl
Source: GlassWireSetup.exe, 00000000.00000003.2560293632.00000000006CD000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2562623946.00000000006CE000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2554625404.00000000006C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.trustdst.com/certificates/policy/ACES-index.html
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.trustdst.com/certificates/policy/ACES-index.html0
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.valicert.com/
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2562039781.000000000069E000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2562039781.0000000000661000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.valicert.com/1
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.valicert.com/k
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.valicert.com/rk
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.wellsfargo.com/certpolicy
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api-eu-north-1.protect.glasswire.com/agent-api/v1/license/activate
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api-eu-north-1.protect.glasswire.com/agent-api/v1/license/activatek
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.00000000054C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api-eu-north-1.protect.glasswire.com/api/v1.1/agent/device/register
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.00000000054C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api-eu-north-1.protect.glasswire.com/api/v1.1/agent/device/register.
Source: GlassWireSetup.exe, 00000000.00000003.2554625404.00000000006C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api-eu-north-1.protect.glasswire.com/api/v1.1/agent/event
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.00000000054C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api-eu-north-1.protect.glasswire.com/api/v1.1/agent/event.
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.00000000054C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api-eu-north-1.protect.glasswire.com/api/v1.1/agent/event?
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.00000000054C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api-eu-north-1.protect.glasswire.com/api/v1.1/agent/eventd74z
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api-eu-north-1.protect.glasswire.com/endpoint-api/v1/endpoint/%s/geoip-db/download
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api-eu-north-1.protect.glasswire.com/endpoint-api/v1/endpoint/%s/geoip-db/downloadJZ
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api-eu-north-1.protect.glasswire.com/endpoint-api/v1/endpoint/%s/heartbeat/%s
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api-eu-north-1.protect.glasswire.com/endpoint-api/v1/endpoint/%s/heartbeat/%su
Source: GlassWireSetup.exe, 00000000.00000003.2554625404.00000000006C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://api-eu-north-1.protect.glasswire.com/v1/api
Source: GlassWireSetup.exe, 00000000.00000003.2237386093.0000000002759000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://creativecommons.org/licenses/by/4.0/.
Source: GlassWireSetup.exe, 00000000.00000003.1938926313.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B067000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: https://curl.se/docs/alt-svc.html
Source: GlassWireSetup.exe, 00000000.00000003.1938926313.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B067000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: https://curl.se/docs/hsts.html
Source: GlassWireSetup.exe, 00000000.00000003.1938926313.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B067000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: https://curl.se/docs/http-cookies.html
Source: GlassWireSetup.exe, 00000000.00000003.2249868436.0000000002755000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2246018078.000000000275E000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248500311.000000000275C000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247096759.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247599754.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248968233.0000000002752000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2250679639.0000000002752000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2251540397.0000000002758000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/cps0%
Source: GlassWireSetup.exe, 00000000.00000003.2249868436.0000000002755000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2246018078.000000000275E000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248500311.000000000275C000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247096759.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247599754.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248968233.0000000002752000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2250679639.0000000002752000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2251540397.0000000002758000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/rpa0
Source: GlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253359318.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2263010670.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2222713240.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://glasswire.com
Source: GlassWireSetup.exe, 00000000.00000003.1699586932.0000000002762000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2562039781.0000000000624000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://glasswire.com/contactDisplayVersion3.4.694HelpLinkhttps://glasswire.com/helpPublisherURLInfo
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.00000000054C8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login-eu-north-1.protect.glasswire.com/auth/realms/glasswire/protocol/openid-connect
Source: GlassWireSetup.exe, 00000000.00000003.2554625404.00000000006C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://login-eu-north-1.protect.glasswire.com/auth/realms/glasswire/protocol/openid-connect/auth?cl
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ocsp.quovadisoffshore.com
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: GlassWireSetup.exe, 00000000.00000003.1938926313.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B067000.00000002.00000001.01000000.0000000F.sdmp, GlassWireSetup.exe, 00000000.00000003.2250462089.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2562039781.0000000000661000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1950277165.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1945493985.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1943361465.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1949040704.000000000066B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pivot.protect.glasswire.com
Source: GlassWireSetup.exe, 00000000.00000003.1938926313.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B067000.00000002.00000001.01000000.0000000F.sdmp, GlassWireSetup.exe, 00000000.00000003.2250462089.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2562039781.0000000000661000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1950277165.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1945493985.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1943361465.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1949040704.000000000066B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pivot.protect.glasswire.com/api/v1/cell
Source: GlassWireSetup.exe, 00000000.00000003.2250462089.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2562039781.0000000000661000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1950277165.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1945493985.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1943361465.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1949040704.000000000066B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pivot.protect.glasswire.com/api/v1/celld6
Source: GlassWireSetup.exe, 00000000.00000003.2250462089.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2562039781.0000000000661000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1950277165.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1945493985.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1943361465.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1949040704.000000000066B000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://pivot.protect.glasswire.comj6
Source: GlassWireSetup.exe, 00000000.00000003.2554625404.00000000006C5000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://portal-eu-north-1.protect.glasswire.com
Source: GlassWireSetup.exe, 00000000.00000003.1938926313.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B067000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: https://portal/auth/realms/glasswire/protocol/openid-connecthttps://login/api/v1.1https://api/api/v1
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://rca.e-szigno.hu/ocsp0-
Source: GlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253359318.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2263010670.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2222713240.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sectigo.com/CPS0
Source: GlassWireSetup.exe, 00000000.00000002.2562039781.0000000000624000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.GlassWire.com/privacy-policy.php
Source: GlassWireSetup.exe, 00000000.00000002.2562039781.0000000000624000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.GlassWire.com/product-privacy-policy.php
Source: GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.cacert.org/revoke.crl
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.cacert.org/revoke.crl00
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.cacert.org/revoke.crl04
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.catcert.net/verarrel
Source: GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.catcert.net/verarrel05
Source: GlassWireSetup.exe, 00000000.00000003.2237386093.0000000002759000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.geonames.org
Source: GlassWireSetup.exe, 00000000.00000003.1699586932.0000000002762000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2562039781.0000000000624000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.glasswire.com/stat/install.php?v=3.4.694&build_type=full&os=
Source: GlassWireSetup.exe, 00000000.00000003.2237386093.0000000002759000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.maxmind.com/en/geolite2/eula.
Source: GlassWireSetup.exe, 00000000.00000003.2554513226.00000000055A1000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2316903879.00000000055A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.microsoft.ct
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.netlock.hu/docs/
Source: GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.netlock.net/docs
Source: GlassWireSetup.exe, 00000000.00000003.2243073905.0000000002759000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.qt.io/licensing
Source: GlassWireSetup.exe, 00000000.00000003.2314112487.000000000275E000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://www.vmware.com/support/developer/vima/)os.vendor:
Source: unknownNetwork traffic detected: HTTP traffic on port 57848 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 57829
Source: unknownNetwork traffic detected: HTTP traffic on port 57829 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 57848
Source: unknownNetwork traffic detected: HTTP traffic on port 57884 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 57840
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 57884
Source: unknownNetwork traffic detected: HTTP traffic on port 57840 -> 443
Source: unknownHTTPS traffic detected: 18.244.164.20:443 -> 192.168.2.4:57884 version: TLS 1.2
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_2_00405705 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,0_2_00405705
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{1b774c08-0e2d-f04a-affb-563599d0a20e}\gwdrv.cat (copy)Jump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\driver\win7-x86\gwdrv.catJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\driver\x64\gwdrv.catJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\driver\legacy-x64\gwdrv.catJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\driver\legacy-x86\gwdrv.catJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Windows\System32\drivers\gwdrv.catJump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{1b774c08-0e2d-f04a-affb-563599d0a20e}\SET8C1F.tmpJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\driver\win7-x64\gwdrv.catJump to dropped file

System Summary

barindex
PE file contains section with special chars
Source: GWInstSt.exe.0.drStatic PE information: section name:
Source: GWInstSt.exe.0.drStatic PE information: section name:
Source: GWInstSt.exe.0.drStatic PE information: section name:
Source: GWInstSt.exe.0.drStatic PE information: section name:
Source: GWInstSt.exe.0.drStatic PE information: section name:
Source: GWInstSt.exe.0.drStatic PE information: section name:
Source: GWInstSt.exe.0.drStatic PE information: section name:
Source: GWInstSt.exe.0.drStatic PE information: section name:
Source: GWCtlSrv.exe.0.drStatic PE information: section name:
Source: GWCtlSrv.exe.0.drStatic PE information: section name:
Source: GWCtlSrv.exe.0.drStatic PE information: section name:
Source: GWCtlSrv.exe.0.drStatic PE information: section name:
Source: GWCtlSrv.exe.0.drStatic PE information: section name:
Source: GWCtlSrv.exe.0.drStatic PE information: section name:
Source: GWCtlSrv.exe.0.drStatic PE information: section name:
Source: GWCtlSrv.exe.0.drStatic PE information: section name:
Source: GWCtlSrv.exe.0.drStatic PE information: section name:
Source: GWCtlSrv.exe.0.drStatic PE information: section name:
Source: GWEventLog.dll.0.drStatic PE information: section name:
Source: GWEventLog.dll.0.drStatic PE information: section name:
Source: GWEventLog.dll.0.drStatic PE information: section name:
Source: GWEventLog.dll.0.drStatic PE information: section name:
Source: GWEventLog.dll.0.drStatic PE information: section name:
Source: GWEventLog.dll.0.drStatic PE information: section name:
Source: GWEventLog.dll.0.drStatic PE information: section name:
Source: GWEventLog.dll.0.drStatic PE information: section name:
Source: nsihelper.dll.0.drStatic PE information: section name:
Source: nsihelper.dll.0.drStatic PE information: section name:
Source: nsihelper.dll.0.drStatic PE information: section name:
Source: nsihelper.dll.0.drStatic PE information: section name:
Source: nsihelper.dll.0.drStatic PE information: section name:
Source: nsihelper.dll.0.drStatic PE information: section name:
Source: nsihelper.dll.0.drStatic PE information: section name:
Source: nsihelper.dll.0.drStatic PE information: section name:
Source: nsihelper.dll.0.drStatic PE information: section name:
Source: GWIdlMon.exe.0.drStatic PE information: section name:
Source: GWIdlMon.exe.0.drStatic PE information: section name:
Source: GWIdlMon.exe.0.drStatic PE information: section name:
Source: GWIdlMon.exe.0.drStatic PE information: section name:
Source: GWIdlMon.exe.0.drStatic PE information: section name:
Source: GWIdlMon.exe.0.drStatic PE information: section name:
Source: GWIdlMon.exe.0.drStatic PE information: section name:
Source: GWIdlMon.exe.0.drStatic PE information: section name:
Source: GWIdlMon.exe.0.drStatic PE information: section name:
Source: GWUnlock.exe.0.drStatic PE information: section name:
Source: GWUnlock.exe.0.drStatic PE information: section name:
Source: GWUnlock.exe.0.drStatic PE information: section name:
Source: GWUnlock.exe.0.drStatic PE information: section name:
Source: GWUnlock.exe.0.drStatic PE information: section name:
Source: GWUnlock.exe.0.drStatic PE information: section name:
Source: GWUnlock.exe.0.drStatic PE information: section name:
Source: GWUnlock.exe.0.drStatic PE information: section name:
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name:
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name:
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name:
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name:
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name:
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name:
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name:
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name:
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name:
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name:
Source: GlassWire.exe.0.drStatic PE information: section name:
Source: GlassWire.exe.0.drStatic PE information: section name:
Source: GlassWire.exe.0.drStatic PE information: section name:
Source: GlassWire.exe.0.drStatic PE information: section name:
Source: GlassWire.exe.0.drStatic PE information: section name:
Source: GlassWire.exe.0.drStatic PE information: section name:
Source: GlassWire.exe.0.drStatic PE information: section name:
Source: GlassWire.exe.0.drStatic PE information: section name:
Source: GlassWire.exe.0.drStatic PE information: section name:
Source: GlassWire.exe.0.drStatic PE information: section name:
Source: windows.dll.0.drStatic PE information: section name:
Source: windows.dll.0.drStatic PE information: section name:
Source: windows.dll.0.drStatic PE information: section name:
Source: windows.dll.0.drStatic PE information: section name:
Source: windows.dll.0.drStatic PE information: section name:
Source: windows.dll.0.drStatic PE information: section name:
Source: windows.dll.0.drStatic PE information: section name:
Source: windows.dll.0.drStatic PE information: section name:
Source: windows.dll.0.drStatic PE information: section name:
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_2_0040351C EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_0040351C
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\driver\legacy-x64\gwdrv.sysJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Windows\System32\drivers\gwdrv.catJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Windows\System32\drivers\gwdrv.catJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Windows\System32\drivers\gwdrv.infJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Windows\System32\drivers\gwdrv.sysJump to behavior
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\3bd8bd.msi
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\SourceHash{1679EF65-55F3-4248-B91E-6B3BE1A69CDF}
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIDD41.tmp
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\vcamp140.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\vcomp140.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\concrt140.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_1.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_2.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_atomic_wait.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_codecvt_ids.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\vccorlib140.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\vcruntime140.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\3bd8c1.msi
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\3bd8c1.msi
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\3bd8c2.msi
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\inprogressinstallinfo.ipi
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\SourceHash{1AEA8854-7597-4CD3-948F-8DE364D94E07}
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSIE2B1.tmp
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140chs.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140cht.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140deu.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140enu.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140esn.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140fra.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140ita.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140jpn.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140kor.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140rus.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140u.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfcm140.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfcm140u.dll
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\3bd8c9.msi
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\3bd8c9.msi
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\FileRepository\gwdrv.inf_amd64_54933c59b5293195
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\drvstore.tmp
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\inf\oem4.inf
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeFile created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches
Source: C:\Windows\System32\svchost.exeFile created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeFile deleted: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F6E010_3_053F6E01
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F6F7F0_3_053F6F7F
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053E687D0_3_053E687D
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F6E010_3_053F6E01
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F6F7F0_3_053F6F7F
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_2_00406C5F0_2_00406C5F
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005DC0FA1_2_005DC0FA
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005B61841_2_005B6184
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005E022D1_2_005E022D
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005EA3B01_2_005EA3B0
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005E06621_2_005E0662
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005BA7EF1_2_005BA7EF
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005EA85E1_2_005EA85E
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005DF9191_2_005DF919
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005C69CC1_2_005C69CC
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005E0A971_2_005E0A97
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005E2B211_2_005E2B21
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005E2D501_2_005E2D50
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005EED4C1_2_005EED4C
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005DFE151_2_005DFE15
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_008769CC2_2_008769CC
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_0088C0FA2_2_0088C0FA
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_008661842_2_00866184
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_0089022D2_2_0089022D
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_0089A3B02_2_0089A3B0
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_008906622_2_00890662
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_0086A7EF2_2_0086A7EF
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_0089A85E2_2_0089A85E
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_0088F9192_2_0088F919
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_00890A972_2_00890A97
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_00892B212_2_00892B21
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_0089ED4C2_2_0089ED4C
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_00892D502_2_00892D50
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_0088FE152_2_0088FE15
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E1C0FA3_2_00E1C0FA
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00DF61843_2_00DF6184
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E2022D3_2_00E2022D
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E2A3B03_2_00E2A3B0
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E206623_2_00E20662
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00DFA7EF3_2_00DFA7EF
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E2A85E3_2_00E2A85E
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E069CC3_2_00E069CC
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E1F9193_2_00E1F919
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E20A973_2_00E20A97
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E22B213_2_00E22B21
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E2ED4C3_2_00E2ED4C
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E22D503_2_00E22D50
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E1FE153_2_00E1FE15
Source: C:\Windows\System32\svchost.exeProcess token adjusted: Security
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: String function: 00DF37D3 appears 496 times
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: String function: 00E3061A appears 34 times
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: String function: 00E331C7 appears 83 times
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: String function: 00E3012F appears 678 times
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: String function: 00DF1F20 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: String function: 005F31C7 appears 85 times
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: String function: 005B1F20 appears 54 times
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: String function: 005F061A appears 34 times
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: String function: 005F012F appears 678 times
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: String function: 005B37D3 appears 496 times
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: String function: 008A012F appears 678 times
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: String function: 008A31C7 appears 83 times
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: String function: 00861F20 appears 54 times
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: String function: 008A061A appears 34 times
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: String function: 008637D3 appears 496 times
Source: windows.dll.0.drStatic PE information: Number of sections : 17 > 10
Source: GWUnlock.exe.0.drStatic PE information: Number of sections : 13 > 10
Source: GWCtlSrv.exe.0.drStatic PE information: Number of sections : 18 > 10
Source: GWIdlMon.exe.0.drStatic PE information: Number of sections : 16 > 10
Source: GWUpgradeMonitor.exe.0.drStatic PE information: Number of sections : 18 > 10
Source: GWEventLog.dll.0.drStatic PE information: Number of sections : 16 > 10
Source: GWInstSt.exe.0.drStatic PE information: Number of sections : 13 > 10
Source: nsihelper.dll.0.drStatic PE information: Number of sections : 17 > 10
Source: GlassWire.exe.0.drStatic PE information: Number of sections : 18 > 10
Source: mfc140fra.dll.10.drStatic PE information: No import functions for PE file found
Source: mfc140kor.dll.10.drStatic PE information: No import functions for PE file found
Source: mfc140enu.dll.10.drStatic PE information: No import functions for PE file found
Source: mfc140chs.dll.10.drStatic PE information: No import functions for PE file found
Source: mfc140jpn.dll.10.drStatic PE information: No import functions for PE file found
Source: mfc140ita.dll.10.drStatic PE information: No import functions for PE file found
Source: mfc140esn.dll.10.drStatic PE information: No import functions for PE file found
Source: mfc140cht.dll.10.drStatic PE information: No import functions for PE file found
Source: mfc140rus.dll.10.drStatic PE information: No import functions for PE file found
Source: mfc140deu.dll.10.drStatic PE information: No import functions for PE file found
Source: GlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Core.dll( vs GlassWireSetup.exe
Source: GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqico.dll( vs GlassWireSetup.exe
Source: GlassWireSetup.exe, 00000000.00000003.2249868436.0000000002755000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegwdrv.sys4 vs GlassWireSetup.exe
Source: GlassWireSetup.exe, 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameglasswire-setup-3.4.694.0-full.exe4 vs GlassWireSetup.exe
Source: GlassWireSetup.exe, 00000000.00000003.2253359318.0000000002756000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqsvgicon.dll( vs GlassWireSetup.exe
Source: GlassWireSetup.exe, 00000000.00000003.2248500311.000000000275C000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegwdrv.sys4 vs GlassWireSetup.exe
Source: GlassWireSetup.exe, 00000000.00000003.2316678417.00000000055AC000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegwdrv.sys4 vs GlassWireSetup.exe
Source: GlassWireSetup.exe, 00000000.00000003.2247096759.000000000275D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegwdrv.sys4 vs GlassWireSetup.exe
Source: GlassWireSetup.exe, 00000000.00000002.2569059053.000000006B256000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: OriginalFilenamensihelper.dll4 vs GlassWireSetup.exe
Source: GlassWireSetup.exe, 00000000.00000003.2252884220.000000000275E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegwdrv.sys4 vs GlassWireSetup.exe
Source: GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5OpenGL.dll( vs GlassWireSetup.exe
Source: GlassWireSetup.exe, 00000000.00000003.2263010670.0000000002750000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameqwindows.dll( vs GlassWireSetup.exe
Source: GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Gui.dll( vs GlassWireSetup.exe
Source: GlassWireSetup.exe, 00000000.00000002.2568711641.000000006B20B000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: OriginalFilenamensihelper.dll4 vs GlassWireSetup.exe
Source: GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5WinExtras.dll( vs GlassWireSetup.exe
Source: GlassWireSetup.exe, 00000000.00000003.2251540397.0000000002758000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenamegwdrv.sys4 vs GlassWireSetup.exe
Source: GlassWireSetup.exe, 00000000.00000003.2222713240.000000000275D000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Widgets.dll( vs GlassWireSetup.exe
Source: GlassWireSetup.exe, 00000000.00000003.1939470825.00000000030C0000.00000004.00001000.00020000.00000000.sdmpBinary or memory string: OriginalFilenamensihelper.dll4 vs GlassWireSetup.exe
Source: GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameQt5Svg.dll( vs GlassWireSetup.exe
Source: GlassWireSetup.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: GWCtlSrv.exe.0.drStatic PE information: Section: ZLIB complexity 0.9997441924778762
Source: GWCtlSrv.exe.0.drStatic PE information: Section: .reloc ZLIB complexity 1.5
Source: GWEventLog.dll.0.drStatic PE information: Section: ZLIB complexity 0.9965653153153153
Source: GWEventLog.dll.0.drStatic PE information: Section: ZLIB complexity 1.0004127738402062
Source: GWEventLog.dll.0.drStatic PE information: Section: .reloc ZLIB complexity 1.5
Source: nsihelper.dll.0.drStatic PE information: Section: ZLIB complexity 0.9932611792127072
Source: nsihelper.dll.0.drStatic PE information: Section: ZLIB complexity 1.0000559812898089
Source: nsihelper.dll.0.drStatic PE information: Section: .reloc ZLIB complexity 1.5
Source: GWIdlMon.exe.0.drStatic PE information: Section: ZLIB complexity 0.9931654169556172
Source: GWIdlMon.exe.0.drStatic PE information: Section: ZLIB complexity 0.9985463382633588
Source: GWIdlMon.exe.0.drStatic PE information: Section: .reloc ZLIB complexity 1.5
Source: GWUnlock.exe.0.drStatic PE information: Section: ZLIB complexity 0.9940916856492027
Source: GWUnlock.exe.0.drStatic PE information: Section: ZLIB complexity 1.0107421875
Source: GWUnlock.exe.0.drStatic PE information: Section: ZLIB complexity 0.9909476902173913
Source: GWUnlock.exe.0.drStatic PE information: Section: ZLIB complexity 0.9970073084677419
Source: GWUpgradeMonitor.exe.0.drStatic PE information: Section: ZLIB complexity 0.997985665954416
Source: GWUpgradeMonitor.exe.0.drStatic PE information: Section: .reloc ZLIB complexity 1.5
Source: GlassWire.exe.0.drStatic PE information: Section: ZLIB complexity 0.9902023565573771
Source: GlassWire.exe.0.drStatic PE information: Section: ZLIB complexity 0.9998014680631868
Source: GlassWire.exe.0.drStatic PE information: Section: .reloc ZLIB complexity 1.5
Source: Qt5Core.dll.0.drStatic PE information: Section: .qtmimed ZLIB complexity 0.997458770800317
Source: windows.dll.0.drStatic PE information: Section: ZLIB complexity 0.9966714873568703
Source: windows.dll.0.drStatic PE information: Section: ZLIB complexity 0.9979254943502824
Source: windows.dll.0.drStatic PE information: Section: .reloc ZLIB complexity 1.5
Source: classification engineClassification label: sus34.evad.winEXE@50/230@3/4
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005EFD20 FormatMessageW,GetLastError,LocalFree,1_2_005EFD20
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_2_0040351C EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_0040351C
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005B44E9 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,1_2_005B44E9
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_008644E9 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,2_2_008644E9
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00DF44E9 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,GetLastError,AdjustTokenPrivileges,GetLastError,Sleep,InitiateSystemShutdownExW,GetLastError,CloseHandle,3_2_00DF44E9
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_2_004049B1 GetDlgItem,SetWindowTextW,SHAutoComplete,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceExW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,0_2_004049B1
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_2_004021CF CoCreateInstance,0_2_004021CF
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005D6945 ChangeServiceConfigW,GetLastError,1_2_005D6945
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWireJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\GlassWire 3.4.lnkJump to behavior
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7264:120:WilError_03
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeMutant created: NULL
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7300:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7436:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8148:120:WilError_03
Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3448:120:WilError_03
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Users\user\AppData\Local\Temp\nsn9655.tmpJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Windows\explorer.exe
Source: unknownProcess created: C:\Windows\explorer.exe
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Windows\explorer.exeJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCommand line argument: cabinet.dll1_2_005B1070
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCommand line argument: msi.dll1_2_005B1070
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCommand line argument: version.dll1_2_005B1070
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCommand line argument: wininet.dll1_2_005B1070
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCommand line argument: comres.dll1_2_005B1070
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCommand line argument: clbcatq.dll1_2_005B1070
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCommand line argument: msasn1.dll1_2_005B1070
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCommand line argument: crypt32.dll1_2_005B1070
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCommand line argument: feclient.dll1_2_005B1070
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCommand line argument: cabinet.dll2_2_00861070
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCommand line argument: msi.dll2_2_00861070
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCommand line argument: version.dll2_2_00861070
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCommand line argument: wininet.dll2_2_00861070
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCommand line argument: comres.dll2_2_00861070
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCommand line argument: clbcatq.dll2_2_00861070
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCommand line argument: msasn1.dll2_2_00861070
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCommand line argument: crypt32.dll2_2_00861070
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCommand line argument: feclient.dll2_2_00861070
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCommand line argument: cabinet.dll3_2_00DF1070
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCommand line argument: msi.dll3_2_00DF1070
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCommand line argument: version.dll3_2_00DF1070
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCommand line argument: wininet.dll3_2_00DF1070
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCommand line argument: comres.dll3_2_00DF1070
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCommand line argument: clbcatq.dll3_2_00DF1070
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCommand line argument: msasn1.dll3_2_00DF1070
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCommand line argument: crypt32.dll3_2_00DF1070
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCommand line argument: feclient.dll3_2_00DF1070
Source: GlassWireSetup.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile read: C:\Users\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Windows\system32\drivers\gwdrv.inf
Source: GlassWireSetup.exe, 00000000.00000003.1938926313.0000000003298000.00000004.00001000.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B12F000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: GlassWireSetup.exe, 00000000.00000003.1938926313.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B067000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: SELECT settings FROM firewall_data WHERE id = 1;
Source: GlassWireSetup.exe, 00000000.00000003.1938926313.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B067000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: SELECT filename FROM stats_databases;
Source: GlassWireSetup.exe, 00000000.00000003.1938926313.0000000003298000.00000004.00001000.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B12F000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: SELECT count(*) FROM sqlite_master WHERE type='table' AND name='%s';
Source: GlassWireSetup.exe, 00000000.00000003.1938926313.0000000003298000.00000004.00001000.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B12F000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: GlassWireSetup.exe, 00000000.00000003.1938926313.0000000003298000.00000004.00001000.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B12F000.00000002.00000001.01000000.0000000F.sdmpBinary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: GlassWireSetup.exeString found in binary or memory: Madrid (see current address at www.camerfirma.com/address)
Source: vc_redist.x86.exeString found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: vc_redist.x86.exeString found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: VC_redist.x86.exeString found in binary or memory: Failed to re-launch bundle process after RunOnce: %ls
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile read: C:\Users\user\Desktop\GlassWireSetup.exeJump to behavior
Source: unknownProcess created: C:\Users\user\Desktop\GlassWireSetup.exe "C:\Users\user\Desktop\GlassWireSetup.exe"
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exe "C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exe" /install /quiet /norestart
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeProcess created: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe "C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exe" -burn.filehandle.attached=524 -burn.filehandle.self=640 /install /quiet /norestart
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeProcess created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exe "C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{4C6967F0-7861-4E5E-A266-A79F91D53451} {8D47B6A8-8425-45E8-BA0B-10ED43630BCC} 1148
Source: unknownProcess created: C:\Windows\System32\VSSVC.exe C:\Windows\system32\vssvc.exe
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k swprv
Source: unknownProcess created: C:\Windows\System32\SrTasks.exe C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:1
Source: C:\Windows\System32\SrTasks.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exe "C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exe" "https://www.glasswire.com/stat/install.php?v=3.4.694&build_type=full&os=Ten&platform=x64&update=0&install_id=8AC7009D4B52E62F54AD1F4176FBF27962F3EAF3F7DDE916A08729FD64A8AEEE&referrer=https%3A%2F%2Fwww.google.com%2F&user_agent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F129.0.0.0+Safari%2F537.36+Edg%2F129.0.0.0&ga_client_id=1231827075.1728319357" "nsis$$.tmp"
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Windows\system32\drivers\gwdrv.inf
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{1b9ae675-a69a-784f-a0a3-d898132a09ba}\gwdrv.inf" "9" "4e7eab47b" "0000000000000144" "WinSta0\Default" "0000000000000170" "208" "C:\Windows\system32\drivers"
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gwdrv.inf_amd64_54933c59b5293195\gwdrv.inf" "0" "4e7eab47b" "0000000000000170" "WinSta0\Default"
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\runonce.exe "C:\Windows\system32\runonce.exe" -r
Source: C:\Windows\System32\runonce.exeProcess created: C:\Windows\System32\grpconv.exe "C:\Windows\System32\grpconv.exe" -o
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Windows\System32\net.exe "C:\Windows\system32\net.exe" start gwdrv
Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start gwdrv
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Windows\SysWOW64\wevtutil.exe "C:\Windows\system32\wevtutil.exe" im "C:\Users\user\AppData\Local\Temp\nsx9694.tmp\eventlog.man" /rf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll" /mf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll"
Source: C:\Windows\SysWOW64\wevtutil.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\wevtutil.exeProcess created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" im "C:\Users\user\AppData\Local\Temp\nsx9694.tmp\eventlog.man" /rf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll" /mf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll" /fromwow64
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Program Files (x86)\GlassWire\GWCtlSrv.exe "C:\Program Files (x86)\GlassWire\GWCtlSrv.exe" "-i"
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Program Files (x86)\GlassWire\GWCtlSrv.exe "C:\Program Files (x86)\GlassWire\GWCtlSrv.exe" "-s"
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknownProcess created: C:\Program Files (x86)\GlassWire\GWCtlSrv.exe "C:\Program Files (x86)\GlassWire\GWCtlSrv.exe"
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" "C:\Program Files (x86)\GlassWire\glasswire.exe"
Source: unknownProcess created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: C:\Windows\explorer.exeProcess created: C:\Program Files (x86)\GlassWire\GlassWire.exe "C:\Program Files (x86)\GlassWire\GlassWire.exe"
Source: unknownProcess created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknownProcess created: C:\Program Files (x86)\GlassWire\GlassWire.exe "C:\Program Files (x86)\GlassWire\glasswire.exe" -hide
Source: unknownProcess created: C:\Program Files (x86)\GlassWire\GlassWire.exe "C:\Program Files (x86)\GlassWire\glasswire.exe" -hide
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exe "C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exe" /install /quiet /norestartJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exe "C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exe" "https://www.glasswire.com/stat/install.php?v=3.4.694&build_type=full&os=Ten&platform=x64&update=0&install_id=8AC7009D4B52E62F54AD1F4176FBF27962F3EAF3F7DDE916A08729FD64A8AEEE&referrer=https%3A%2F%2Fwww.google.com%2F&user_agent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F129.0.0.0+Safari%2F537.36+Edg%2F129.0.0.0&ga_client_id=1231827075.1728319357" "nsis$$.tmp"Jump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Windows\system32\drivers\gwdrv.infJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Windows\System32\net.exe "C:\Windows\system32\net.exe" start gwdrvJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Windows\SysWOW64\wevtutil.exe "C:\Windows\system32\wevtutil.exe" im "C:\Users\user\AppData\Local\Temp\nsx9694.tmp\eventlog.man" /rf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll" /mf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll"Jump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Program Files (x86)\GlassWire\GWCtlSrv.exe "C:\Program Files (x86)\GlassWire\GWCtlSrv.exe" "-i"Jump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Program Files (x86)\GlassWire\GWCtlSrv.exe "C:\Program Files (x86)\GlassWire\GWCtlSrv.exe" "-s"Jump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" "C:\Program Files (x86)\GlassWire\glasswire.exe"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeProcess created: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe "C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exe" -burn.filehandle.attached=524 -burn.filehandle.self=640 /install /quiet /norestartJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeProcess created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exe "C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{4C6967F0-7861-4E5E-A266-A79F91D53451} {8D47B6A8-8425-45E8-BA0B-10ED43630BCC} 1148Jump to behavior
Source: C:\Windows\System32\rundll32.exeProcess created: C:\Windows\System32\runonce.exe "C:\Windows\system32\runonce.exe" -r
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{1b9ae675-a69a-784f-a0a3-d898132a09ba}\gwdrv.inf" "9" "4e7eab47b" "0000000000000144" "WinSta0\Default" "0000000000000170" "208" "C:\Windows\system32\drivers"
Source: C:\Windows\System32\svchost.exeProcess created: C:\Windows\System32\drvinst.exe DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gwdrv.inf_amd64_54933c59b5293195\gwdrv.inf" "0" "4e7eab47b" "0000000000000170" "WinSta0\Default"
Source: C:\Windows\System32\runonce.exeProcess created: C:\Windows\System32\grpconv.exe "C:\Windows\System32\grpconv.exe" -o
Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start gwdrv
Source: C:\Windows\SysWOW64\wevtutil.exeProcess created: C:\Windows\System32\wevtutil.exe "C:\Windows\system32\wevtutil.exe" im "C:\Users\user\AppData\Local\Temp\nsx9694.tmp\eventlog.man" /rf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll" /mf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll" /fromwow64
Source: C:\Windows\explorer.exeProcess created: C:\Program Files (x86)\GlassWire\GlassWire.exe "C:\Program Files (x86)\GlassWire\GlassWire.exe"
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: userenv.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: propsys.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: dwmapi.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: oleacc.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: shfolder.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: msvcp140.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: msvcp140_atomic_wait.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: vcruntime140.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: riched20.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: usp10.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: msls31.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: mswsock.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: rasadhlp.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: fwpuclnt.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: dui70.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: duser.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: chartv.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: atlthunk.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: wtsapi32.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: winsta.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: linkinfo.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: ntshrui.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: explorerframe.dllJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeSection loaded: netutils.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeSection loaded: msi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeSection loaded: version.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeSection loaded: msxml3.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeSection loaded: wldp.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeSection loaded: profapi.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeSection loaded: feclient.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: msi.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: msxml3.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: feclient.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: msimg32.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: windowscodecs.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: explorerframe.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: riched20.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: usp10.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: msls31.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: textshaping.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: edputil.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: urlmon.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: srvcli.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: windows.staterepositoryps.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: sspicli.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: appresolver.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: bcp47langs.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: slc.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: sppc.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: onecorecommonproxystub.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeSection loaded: apphelp.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: cryptbase.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: msi.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: version.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: cabinet.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: msxml3.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: windows.storage.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: wldp.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: uxtheme.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: textinputframework.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: coreuicomponents.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: ntmarta.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: coremessaging.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: wintypes.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: srclient.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: spp.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: powrprof.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: vssapi.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: vsstrace.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: umpdc.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: usoapi.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: sxproxy.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: cryptsp.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: rsaenh.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: feclient.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: iertutil.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: srpapi.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: tsappcmp.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: netapi32.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: devobj.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: vssapi.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: vsstrace.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: authz.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: virtdisk.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: bcd.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: vsstrace.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: fltlib.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: kernel.appcore.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: es.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: amsi.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: userenv.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: profapi.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: vss_ps.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: samcli.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: netutils.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: samlib.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: propsys.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: catsrvut.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: mfcsubs.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: sxs.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: msxml3.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: msasn1.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: clusapi.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: dnsapi.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: iphlpapi.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: wkscli.dllJump to behavior
Source: C:\Windows\System32\VSSVC.exeSection loaded: cscapi.dllJump to behavior
Source: C:\Windows\System32\svchost.exeSection loaded: swprv.dll
Source: C:\Windows\System32\svchost.exeSection loaded: devobj.dll
Source: C:\Windows\System32\svchost.exeSection loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exeSection loaded: virtdisk.dll
Source: C:\Windows\System32\svchost.exeSection loaded: fltlib.dll
Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
Source: C:\Windows\System32\svchost.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exeSection loaded: amsi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: userenv.dll
Source: C:\Windows\System32\svchost.exeSection loaded: profapi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: es.dll
Source: C:\Windows\System32\svchost.exeSection loaded: vss_ps.dll
Source: C:\Windows\System32\svchost.exeSection loaded: fveapi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: fveapi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: fveapi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: fveapi.dll
Source: C:\Windows\System32\svchost.exeSection loaded: vssapi.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: spp.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: srclient.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: srcore.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: vssapi.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: vssapi.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: powrprof.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: vsstrace.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: ktmw32.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: wer.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: bcd.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: umpdc.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: ntmarta.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: dsrole.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: msxml3.dll
Source: C:\Windows\System32\SrTasks.exeSection loaded: vss_ps.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: userenv.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: msisip.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: version.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: rstrtmgr.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: ncrypt.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: ntasn1.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: cabinet.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: cabinet.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dll
Source: C:\Windows\System32\msiexec.exeSection loaded: cabinet.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSection loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exeSection loaded: umpnpmgr.dll
Source: C:\Windows\System32\svchost.exeSection loaded: wldp.dll
Source: C:\Windows\System32\svchost.exeSection loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exeSection loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exeSection loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exeSection loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exeSection loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exeSection loaded: msasn1.dll
Source: C:\Windows\System32\drvinst.exeSection loaded: cryptsp.dll
Source: C:\Windows\System32\drvinst.exeSection loaded: rsaenh.dll
Source: C:\Windows\System32\drvinst.exeSection loaded: cryptbase.dll
Source: C:\Windows\System32\drvinst.exeSection loaded: gpapi.dll
Source: C:\Windows\System32\drvinst.exeSection loaded: ntmarta.dll
Source: C:\Windows\System32\drvinst.exeSection loaded: devrtl.dll
Source: C:\Windows\System32\drvinst.exeSection loaded: drvstore.dll
Source: C:\Windows\System32\drvinst.exeSection loaded: cabinet.dll
Source: C:\Windows\System32\drvinst.exeSection loaded: version.dll
Source: C:\Windows\System32\runonce.exeSection loaded: windows.storage.dll
Source: C:\Windows\System32\runonce.exeSection loaded: wldp.dll
Source: C:\Windows\System32\runonce.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\runonce.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\runonce.exeSection loaded: propsys.dll
Source: C:\Windows\System32\runonce.exeSection loaded: profapi.dll
Source: C:\Windows\System32\runonce.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\runonce.exeSection loaded: edputil.dll
Source: C:\Windows\System32\runonce.exeSection loaded: urlmon.dll
Source: C:\Windows\System32\runonce.exeSection loaded: iertutil.dll
Source: C:\Windows\System32\runonce.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\runonce.exeSection loaded: netutils.dll
Source: C:\Windows\System32\runonce.exeSection loaded: sspicli.dll
Source: C:\Windows\System32\runonce.exeSection loaded: wintypes.dll
Source: C:\Windows\System32\runonce.exeSection loaded: appresolver.dll
Source: C:\Windows\System32\runonce.exeSection loaded: bcp47langs.dll
Source: C:\Windows\System32\runonce.exeSection loaded: slc.dll
Source: C:\Windows\System32\runonce.exeSection loaded: userenv.dll
Source: C:\Windows\System32\runonce.exeSection loaded: sppc.dll
Source: C:\Windows\System32\runonce.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\runonce.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\grpconv.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\grpconv.exeSection loaded: uxtheme.dll
Source: C:\Windows\System32\net.exeSection loaded: mpr.dll
Source: C:\Windows\System32\net.exeSection loaded: wkscli.dll
Source: C:\Windows\System32\net.exeSection loaded: netutils.dll
Source: C:\Windows\System32\net.exeSection loaded: samcli.dll
Source: C:\Windows\System32\net.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\net.exeSection loaded: iphlpapi.dll
Source: C:\Windows\System32\net1.exeSection loaded: samcli.dll
Source: C:\Windows\System32\net1.exeSection loaded: netutils.dll
Source: C:\Windows\System32\net1.exeSection loaded: dsrole.dll
Source: C:\Windows\System32\net1.exeSection loaded: srvcli.dll
Source: C:\Windows\System32\net1.exeSection loaded: wkscli.dll
Source: C:\Windows\System32\net1.exeSection loaded: logoncli.dll
Source: C:\Windows\System32\net1.exeSection loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\wevtutil.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\System32\wevtutil.exeSection loaded: msxml6.dll
Source: C:\Windows\System32\wevtutil.exeSection loaded: wevtapi.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: gweventlog.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: msvcp140.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: msvcp140_atomic_wait.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: vcruntime140.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: msvcp140.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: msvcp140_atomic_wait.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: vcruntime140.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: version.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: wsnmp32.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: msvcp140.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: mswsock.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: gweventlog.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: msvcp140.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: msvcp140_atomic_wait.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: vcruntime140.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: msvcp140.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: msvcp140_atomic_wait.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: vcruntime140.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: version.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: wsnmp32.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: vcruntime140.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: vcruntime140.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: mswsock.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: gweventlog.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: msvcp140.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: msvcp140_atomic_wait.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: userenv.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: vcruntime140.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: version.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: wsnmp32.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: msvcp140.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: msvcp140_atomic_wait.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: vcruntime140.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: msvcp140.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: vcruntime140.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: vcruntime140.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: iphlpapi.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: mswsock.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: windows.storage.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: wldp.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: profapi.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: ntmarta.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: wevtapi.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: wlanapi.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: dhcpcsvc6.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: dhcpcsvc.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: dnsapi.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: appxdeploymentclient.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: windows.applicationmodel.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: twinapi.appcore.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: propsys.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: windows.staterepositorybroker.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: mrmcorer.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: iertutil.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: windows.staterepositorycore.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: windows.ui.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: windowmanagementapi.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: textinputframework.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: inputhost.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: coreuicomponents.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: coremessaging.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: coremessaging.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: wintypes.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: wintypes.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: wintypes.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: bcp47mrm.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: languageoverlayutil.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: wtsapi32.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: winsta.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: devobj.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: msasn1.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: firewallapi.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: fwbase.dll
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSection loaded: fwpolicyiomgr.dll
Source: C:\Windows\explorer.exeSection loaded: aepic.dll
Source: C:\Windows\explorer.exeSection loaded: twinapi.dll
Source: C:\Windows\explorer.exeSection loaded: userenv.dll
Source: C:\Windows\explorer.exeSection loaded: iphlpapi.dll
Source: C:\Windows\explorer.exeSection loaded: powrprof.dll
Source: C:\Windows\explorer.exeSection loaded: windows.storage.dll
Source: C:\Windows\explorer.exeSection loaded: dxgi.dll
Source: C:\Windows\explorer.exeSection loaded: windows.storage.dll
Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exeSection loaded: propsys.dll
Source: C:\Windows\explorer.exeSection loaded: coremessaging.dll
Source: C:\Windows\explorer.exeSection loaded: urlmon.dll
Source: C:\Windows\explorer.exeSection loaded: windows.storage.dll
Source: C:\Windows\explorer.exeSection loaded: windows.storage.dll
Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exeSection loaded: wtsapi32.dll
Source: C:\Windows\explorer.exeSection loaded: wininet.dll
Source: C:\Windows\explorer.exeSection loaded: uxtheme.dll
Source: C:\Windows\explorer.exeSection loaded: dwmapi.dll
Source: C:\Windows\explorer.exeSection loaded: sspicli.dll
Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exeSection loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exeSection loaded: ntmarta.dll
Source: C:\Windows\explorer.exeSection loaded: cryptsp.dll
Source: C:\Windows\explorer.exeSection loaded: wldp.dll
Source: C:\Windows\explorer.exeSection loaded: iertutil.dll
Source: C:\Windows\explorer.exeSection loaded: srvcli.dll
Source: C:\Windows\explorer.exeSection loaded: netutils.dll
Source: C:\Windows\explorer.exeSection loaded: umpdc.dll
Source: C:\Windows\explorer.exeSection loaded: ninput.dll
Source: C:\Windows\explorer.exeSection loaded: explorerframe.dll
Source: C:\Windows\explorer.exeSection loaded: actxprxy.dll
Source: C:\Windows\explorer.exeSection loaded: aepic.dll
Source: C:\Windows\explorer.exeSection loaded: twinapi.dll
Source: C:\Windows\explorer.exeSection loaded: userenv.dll
Source: C:\Windows\explorer.exeSection loaded: iphlpapi.dll
Source: C:\Windows\explorer.exeSection loaded: powrprof.dll
Source: C:\Windows\explorer.exeSection loaded: windows.storage.dll
Source: C:\Windows\explorer.exeSection loaded: dxgi.dll
Source: C:\Windows\explorer.exeSection loaded: windows.storage.dll
Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exeSection loaded: propsys.dll
Source: C:\Windows\explorer.exeSection loaded: coremessaging.dll
Source: C:\Windows\explorer.exeSection loaded: urlmon.dll
Source: C:\Windows\explorer.exeSection loaded: windows.storage.dll
Source: C:\Windows\explorer.exeSection loaded: windows.storage.dll
Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exeSection loaded: wtsapi32.dll
Source: C:\Windows\explorer.exeSection loaded: wininet.dll
Source: C:\Windows\explorer.exeSection loaded: uxtheme.dll
Source: C:\Windows\explorer.exeSection loaded: dwmapi.dll
Source: C:\Windows\explorer.exeSection loaded: sspicli.dll
Source: C:\Windows\explorer.exeSection loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exeSection loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exeSection loaded: ntmarta.dll
Source: C:\Windows\explorer.exeSection loaded: cryptsp.dll
Source: C:\Windows\explorer.exeSection loaded: wldp.dll
Source: C:\Windows\explorer.exeSection loaded: iertutil.dll
Source: C:\Windows\explorer.exeSection loaded: srvcli.dll
Source: C:\Windows\explorer.exeSection loaded: netutils.dll
Source: C:\Windows\explorer.exeSection loaded: umpdc.dll
Source: C:\Windows\explorer.exeSection loaded: ninput.dll
Source: C:\Windows\explorer.exeSection loaded: explorerframe.dll
Source: C:\Windows\explorer.exeSection loaded: actxprxy.dll
Source: C:\Windows\explorer.exeSection loaded: windows.staterepositoryps.dll
Source: C:\Windows\explorer.exeSection loaded: edputil.dll
Source: C:\Windows\explorer.exeSection loaded: smartscreenps.dll
Source: C:\Windows\explorer.exeSection loaded: policymanager.dll
Source: C:\Windows\explorer.exeSection loaded: msvcp110_win.dll
Source: C:\Windows\explorer.exeSection loaded: wintypes.dll
Source: C:\Windows\explorer.exeSection loaded: appresolver.dll
Source: C:\Windows\explorer.exeSection loaded: bcp47langs.dll
Source: C:\Windows\explorer.exeSection loaded: slc.dll
Source: C:\Windows\explorer.exeSection loaded: sppc.dll
Source: C:\Windows\explorer.exeSection loaded: onecorecommonproxystub.dll
Source: C:\Windows\explorer.exeSection loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\explorer.exeSection loaded: apphelp.dll
Source: C:\Windows\explorer.exeSection loaded: pcacli.dll
Source: C:\Windows\explorer.exeSection loaded: mpr.dll
Source: C:\Windows\explorer.exeSection loaded: sfc_os.dll
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeSection loaded: apphelp.dll
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeSection loaded: wtsapi32.dll
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeSection loaded: qt5svg.dll
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeSection loaded: qt5winextras.dll
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeSection loaded: qt5widgets.dll
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeSection loaded: qt5gui.dll
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeSection loaded: qt5core.dll
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeSection loaded: dwmapi.dll
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeSection loaded: msvcp140.dll
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeSection loaded: msvcp140_atomic_wait.dll
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeSection loaded: vcruntime140.dll
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeSection loaded: qt5widgets.dll
Source: C:\Users\user\Desktop\GlassWireSetup.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32Jump to behavior
Source: Uninstall.lnk.0.drLNK file: ..\..\..\..\..\..\Program Files (x86)\GlassWire\uninstall.exe
Source: GlassWire.lnk.0.drLNK file: ..\..\..\..\..\..\Program Files (x86)\GlassWire\GlassWire.exe
Source: GlassWire 3.4.lnk.0.drLNK file: ..\..\..\..\..\..\..\Program Files (x86)\GlassWire\GlassWire.exe
Source: GlassWire.lnk0.0.drLNK file: ..\..\..\Program Files (x86)\GlassWire\GlassWire.exe
Source: C:\Users\user\Desktop\GlassWireSetup.exeAutomated click: Next >
Source: C:\Users\user\Desktop\GlassWireSetup.exeAutomated click: I accept the terms of the License Agreement
Source: C:\Users\user\Desktop\GlassWireSetup.exeAutomated click: Next >
Source: C:\Users\user\Desktop\GlassWireSetup.exeAutomated click: Next >
Source: C:\Users\user\Desktop\GlassWireSetup.exeAutomated click: Next >
Source: C:\Users\user\Desktop\GlassWireSetup.exeAutomated click: Install
Source: Window RecorderWindow detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\GlassWireSetup.exeWindow detected: < &Back&Next >Cancel License AgreementPlease review the license terms before installing GlassWire.Press Page Down to see the rest of the agreement.GLASSWIRE SERVICES SUBSCRIPTION AGREEMENTTERMS AND CONDITIONSThese are the terms on which GlassWire a brand owned by Domotz Inc ("we" or "Domotz" or GlassWire) enable you the Subscriber ("you" or "Subscriber") to access our integrated technology platform as outlined in further detail in this Agreement our website and the Documentation which is available to Subscribers via the internet.These Terms of Service (the "Terms") including any extension annex and update together with the GlassWire Privacy Policy govern the way you will use our platform and all related services.Please read these terms carefully before you download any GlassWire Software use any GlassWire Services or Service Licenses. These terms explain who we are how we will provide the Services to you what to do if there is a problem and other important information.Please refer to our Privacy Policy for information on how we collect use and disclose information from our users. You acknowledge and agree that your use of the Services is subject to our Privacy Policy.ACCEPTANCEYou are deemed to have accepted the terms of this Agreement and will have created a binding contract with GlassWire upon any of the following events: (a) download or installation of any GlassWire Services or related Software; (b) access to or use of any GlassWire Services or related Software; (c) payment for GlassWire Services or related Software Subscription or Service Licenses; (d) entering into an order form for GlassWire Services or related Software Subscription or Service Licenses; or (e) clicking an "accept" button or other similar acknowledgment indicating your acceptance of this Agreement. If you do not agree to be bound by this Agreement you may not access or use the Services or any related. Please read through the entirety of this Agreement to review important provisions regarding intellectual property disclaimers limitations of liability indemnification waivers exclusive law and jurisdiction for resolution of disputes and other legal restrictions.By using our Services you agree to be bound by these Terms. If you don't agree to be bound by these Terms do not use the Services. If you are accessing and using the Services on behalf of a company (such as your employer) or other legal entity you represent and warrant that you have the authority to bind that company or other legal entity and each of its affiliates to these Terms. In that case "you" and "your" will refer to that company or other legal entity and its affiliates.INFORMATION ABOUT US AND CONTACT DETAILSThe subscription services provided by GlassWire to you under this Agreement including the GlassWire website cloud services desktop web and mobile applications and other services and functionality ("Services") are provided by Domotz Inc a company incorporated in the State of Delaware USA. Our office are a
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeWindow detected: Number of UI elements: 23
Source: GlassWireSetup.exeStatic PE information: certificate valid
Source: GlassWireSetup.exeStatic file information: File size 83546864 > 1048576
Source: GlassWireSetup.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: C:\agent\_work\8\s\build\ship\x86\burn.pdb source: vc_redist.x86.exe, 00000001.00000000.1730721661.00000000005FB000.00000002.00000001.01000000.00000005.sdmp, vc_redist.x86.exe, 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmp, vc_redist.x86.exe, 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmp, vc_redist.x86.exe, 00000002.00000000.1731634886.00000000008AB000.00000002.00000001.01000000.00000007.sdmp, VC_redist.x86.exe, 00000003.00000000.1736115821.0000000000E3B000.00000002.00000001.01000000.0000000C.sdmp, VC_redist.x86.exe, 00000003.00000002.1918918991.0000000000E3B000.00000002.00000001.01000000.0000000C.sdmp, VC_redist.x86.exe, 00000003.00000003.1866100025.00000000012D5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\plugins\iconengines\qsvgicon.pdb source: GlassWireSetup.exe, 00000000.00000003.2253359318.0000000002756000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Jenkins\workspace\Glasswire-Consumer-rc\.build\build\msvc-win-x86-release-full-production\bin\GWInstSt.pdb source: GWInstSt.exe
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdb source: GlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb source: GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\users\tvo\dev\securemix\glasswire-windows-driver\.build\bins\Production-x64\generic-driver\gwdrv.pdb source: GlassWireSetup.exe, 00000000.00000003.2316678417.00000000055AC000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2252884220.000000000275E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: revocationDateX509_REVOKEDlastUpdateX509_CRL_INFOcrlX509_CRLcrypto\x509\x_crl.cX509_CRL_add0_revokedX509_CRL_METHOD_newcompiler: cl /Zi /Fdossl_static.pdb /MD /Zl /Gs0 /GF /Gy -MD -O2 -Ob2 -MD -O2 -Ob2 -DL_ENDIAN -DOPENSSL_PIC -DNDEBUG;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Users\jenkins\.conan\data\openssl\3.1.0\_\_\package\85c19aeb1a95eed600c2a699e15fa9ae0bd53a34\res\lib\ossl-modules.dll@@@@@@@@@hHHHH@@@@@@@@@@@@@@@@@@( source: GlassWireSetup.exe, 00000000.00000003.1938926313.0000000003252000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: compiler: cl /Zi /Fdossl_static.pdb /MD /Zl /Gs0 /GF /Gy -MD -O2 -Ob2 -MD -O2 -Ob2 -DL_ENDIAN -DOPENSSL_PIC -DNDEBUG source: GlassWireSetup.exe, 00000000.00000003.1938926313.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B067000.00000002.00000001.01000000.0000000F.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B0E9000.00000002.00000001.01000000.0000000F.sdmp, GlassWireSetup.exe, 00000000.00000003.1938926313.0000000003252000.00000004.00001000.00020000.00000000.sdmp
Source: Binary string: C:\Jenkins\workspace\Glasswire-Consumer-rc\.build\build\msvc-win-x86-release-full-production\bin\nsihelper.pdb source: GlassWireSetup.exe, 00000000.00000003.1938926313.0000000003305000.00000004.00001000.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2568711641.000000006B252000.00000002.00000001.01000000.0000000F.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B19C000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\lib\Qt5Svg.pdb source: GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: krevocationDateX509_REVOKEDlastUpdateX509_CRL_INFOcrlX509_CRLcrypto\x509\x_crl.cX509_CRL_add0_revokedX509_CRL_METHOD_newcompiler: cl /Zi /Fdossl_static.pdb /MD /Zl /Gs0 /GF /Gy -MD -O2 -Ob2 -MD -O2 -Ob2 -DL_ENDIAN -DOPENSSL_PIC -DNDEBUG;CPUINFO: OPENSSL_ia32cap=0x%llx:0x%llxOPENSSL_ia32cap env:%sos-specificC:\Users\jenkins\.conan\data\openssl\3.1.0\_\_\package\85c19aeb1a95eed600c2a699e15fa9ae0bd53a34\res\lib\ossl-modules.dll@@@@@@@@@hHHHH@@@@@@@@@@@@@@@@@@( source: GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B0E9000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\dev\src\hg\manycam\glasswire\core\build\bin\win7-release\x86\driver\gwdrv.pdb source: GlassWireSetup.exe, 00000000.00000003.2251540397.0000000002758000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\dev\src\hg\manycam\glasswire\core\build\bin\vc110-release\x64\driver\gwdrv.pdb source: GlassWireSetup.exe, 00000000.00000003.2247096759.000000000275D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\imageformats\qico.pdb"" source: GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ?crypto\stack\stack.cOPENSSL_sk_dupOPENSSL_sk_deep_copysk_reserveOPENSSL_sk_new_reserveOPENSSL_sk_reserveOPENSSL_sk_insertOPENSSL_sk_seti=%dcompiler: cl /Zi /Fdossl_static.pdb /MD /Zl /Gs0 /GF /Gy -MD -O2 -Ob2 -MD -O2 -Ob2 -DL_ENDIAN -DOPENSSL_PIC -DNDEBUGOpenSSL 3.1.0 14 Mar 20233.1.0built on: Thu Aug 24 07:39:01 2023 UTCplatform: VC-conan-Release-Windows-x86-Visual Studio-16OPENSSLDIR: "C:\Users\jenkins\.conan\data\openssl\3.1.0\_\_\package\85c19aeb1a95eed600c2a699e15fa9ae0bd53a34\res"ENGINESDIR: "\lib\engines-3"MODULESDIR: "\lib\ossl-modules"CPUINFO: N/Anot available source: GlassWireSetup.exe, 00000000.00000003.1938926313.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B067000.00000002.00000001.01000000.0000000F.sdmp
Source: Binary string: D:\dev\src\hg\manycam\glasswire\core\build\bin\win7-release\x64\driver\gwdrv.pdb source: GlassWireSetup.exe, 00000000.00000003.2249868436.0000000002755000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: D:\dev\src\hg\manycam\glasswire\core\build\bin\vc110-release\x86\driver\gwdrv.pdb source: GlassWireSetup.exe, 00000000.00000003.2248500311.000000000275C000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtwinextras\lib\Qt5WinExtras.pdb.. source: GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Core.pdbU source: GlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtwinextras\lib\Qt5WinExtras.pdb source: GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Gui.pdb source: GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtsvg\lib\Qt5Svg.pdb,, source: GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5OpenGL.pdb source: GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5Widgets.pdb source: GlassWireSetup.exe, 00000000.00000003.2222713240.000000000275D000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\plugins\platforms\qwindows.pdb source: GlassWireSetup.exe, 00000000.00000003.2263010670.0000000002750000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: C:\Users\qt\work\qt\qtbase\lib\Qt5OpenGL.pdb55 source: GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmp
Source: initial sampleStatic PE information: section where entry point is pointing to: .boot
Source: GWInstSt.exe.0.drStatic PE information: section name:
Source: GWInstSt.exe.0.drStatic PE information: section name:
Source: GWInstSt.exe.0.drStatic PE information: section name:
Source: GWInstSt.exe.0.drStatic PE information: section name:
Source: GWInstSt.exe.0.drStatic PE information: section name:
Source: GWInstSt.exe.0.drStatic PE information: section name:
Source: GWInstSt.exe.0.drStatic PE information: section name:
Source: GWInstSt.exe.0.drStatic PE information: section name:
Source: GWInstSt.exe.0.drStatic PE information: section name: .debug
Source: GWInstSt.exe.0.drStatic PE information: section name: .themida
Source: GWInstSt.exe.0.drStatic PE information: section name: .boot
Source: GWCtlSrv.exe.0.drStatic PE information: section name:
Source: GWCtlSrv.exe.0.drStatic PE information: section name:
Source: GWCtlSrv.exe.0.drStatic PE information: section name:
Source: GWCtlSrv.exe.0.drStatic PE information: section name:
Source: GWCtlSrv.exe.0.drStatic PE information: section name:
Source: GWCtlSrv.exe.0.drStatic PE information: section name:
Source: GWCtlSrv.exe.0.drStatic PE information: section name:
Source: GWCtlSrv.exe.0.drStatic PE information: section name:
Source: GWCtlSrv.exe.0.drStatic PE information: section name:
Source: GWCtlSrv.exe.0.drStatic PE information: section name:
Source: GWCtlSrv.exe.0.drStatic PE information: section name: .debug
Source: GWCtlSrv.exe.0.drStatic PE information: section name: .themida
Source: GWCtlSrv.exe.0.drStatic PE information: section name: .boot
Source: GWEventLog.dll.0.drStatic PE information: section name:
Source: GWEventLog.dll.0.drStatic PE information: section name:
Source: GWEventLog.dll.0.drStatic PE information: section name:
Source: GWEventLog.dll.0.drStatic PE information: section name:
Source: GWEventLog.dll.0.drStatic PE information: section name:
Source: GWEventLog.dll.0.drStatic PE information: section name:
Source: GWEventLog.dll.0.drStatic PE information: section name:
Source: GWEventLog.dll.0.drStatic PE information: section name:
Source: GWEventLog.dll.0.drStatic PE information: section name: .debug
Source: GWEventLog.dll.0.drStatic PE information: section name: .themida
Source: GWEventLog.dll.0.drStatic PE information: section name: .boot
Source: nsihelper.dll.0.drStatic PE information: section name:
Source: nsihelper.dll.0.drStatic PE information: section name:
Source: nsihelper.dll.0.drStatic PE information: section name:
Source: nsihelper.dll.0.drStatic PE information: section name:
Source: nsihelper.dll.0.drStatic PE information: section name:
Source: nsihelper.dll.0.drStatic PE information: section name:
Source: nsihelper.dll.0.drStatic PE information: section name:
Source: nsihelper.dll.0.drStatic PE information: section name:
Source: nsihelper.dll.0.drStatic PE information: section name:
Source: nsihelper.dll.0.drStatic PE information: section name: .debug
Source: nsihelper.dll.0.drStatic PE information: section name: .themida
Source: nsihelper.dll.0.drStatic PE information: section name: .boot
Source: GWIdlMon.exe.0.drStatic PE information: section name:
Source: GWIdlMon.exe.0.drStatic PE information: section name:
Source: GWIdlMon.exe.0.drStatic PE information: section name:
Source: GWIdlMon.exe.0.drStatic PE information: section name:
Source: GWIdlMon.exe.0.drStatic PE information: section name:
Source: GWIdlMon.exe.0.drStatic PE information: section name:
Source: GWIdlMon.exe.0.drStatic PE information: section name:
Source: GWIdlMon.exe.0.drStatic PE information: section name:
Source: GWIdlMon.exe.0.drStatic PE information: section name:
Source: GWIdlMon.exe.0.drStatic PE information: section name: .debug
Source: GWIdlMon.exe.0.drStatic PE information: section name: .themida
Source: GWIdlMon.exe.0.drStatic PE information: section name: .boot
Source: vc_redist.x86.exe.0.drStatic PE information: section name: .wixburn
Source: GWUnlock.exe.0.drStatic PE information: section name:
Source: GWUnlock.exe.0.drStatic PE information: section name:
Source: GWUnlock.exe.0.drStatic PE information: section name:
Source: GWUnlock.exe.0.drStatic PE information: section name:
Source: GWUnlock.exe.0.drStatic PE information: section name:
Source: GWUnlock.exe.0.drStatic PE information: section name:
Source: GWUnlock.exe.0.drStatic PE information: section name:
Source: GWUnlock.exe.0.drStatic PE information: section name:
Source: GWUnlock.exe.0.drStatic PE information: section name: .debug
Source: GWUnlock.exe.0.drStatic PE information: section name: .themida
Source: GWUnlock.exe.0.drStatic PE information: section name: .boot
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name:
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name:
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name:
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name:
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name:
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name:
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name:
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name:
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name:
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name:
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name: .debug
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name: .themida
Source: GWUpgradeMonitor.exe.0.drStatic PE information: section name: .boot
Source: GlassWire.exe.0.drStatic PE information: section name:
Source: GlassWire.exe.0.drStatic PE information: section name:
Source: GlassWire.exe.0.drStatic PE information: section name:
Source: GlassWire.exe.0.drStatic PE information: section name:
Source: GlassWire.exe.0.drStatic PE information: section name:
Source: GlassWire.exe.0.drStatic PE information: section name:
Source: GlassWire.exe.0.drStatic PE information: section name:
Source: GlassWire.exe.0.drStatic PE information: section name:
Source: GlassWire.exe.0.drStatic PE information: section name:
Source: GlassWire.exe.0.drStatic PE information: section name:
Source: GlassWire.exe.0.drStatic PE information: section name: .debug
Source: GlassWire.exe.0.drStatic PE information: section name: .themida
Source: GlassWire.exe.0.drStatic PE information: section name: .boot
Source: Qt5Core.dll.0.drStatic PE information: section name: .qtmimed
Source: qsvgicon.dll.0.drStatic PE information: section name: .qtmetad
Source: qico.dll.0.drStatic PE information: section name: .qtmetad
Source: qwindows.dll.0.drStatic PE information: section name: .qtmetad
Source: windows.dll.0.drStatic PE information: section name:
Source: windows.dll.0.drStatic PE information: section name:
Source: windows.dll.0.drStatic PE information: section name:
Source: windows.dll.0.drStatic PE information: section name:
Source: windows.dll.0.drStatic PE information: section name:
Source: windows.dll.0.drStatic PE information: section name:
Source: windows.dll.0.drStatic PE information: section name:
Source: windows.dll.0.drStatic PE information: section name:
Source: windows.dll.0.drStatic PE information: section name:
Source: windows.dll.0.drStatic PE information: section name: .debug
Source: windows.dll.0.drStatic PE information: section name: .themida
Source: windows.dll.0.drStatic PE information: section name: .boot
Source: vc_redist.x86.exe.1.drStatic PE information: section name: .wixburn
Source: VC_redist.x86.exe.2.drStatic PE information: section name: .wixburn
Source: VC_redist.x86.exe.3.drStatic PE information: section name: .wixburn
Source: mfc140.dll.10.drStatic PE information: section name: .didat
Source: mfc140u.dll.10.drStatic PE information: section name: .didat
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2F2F pushfd ; iretd 0_3_053F2F32
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2F2F pushfd ; iretd 0_3_053F2F32
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2A23 pushfd ; iretd 0_3_053F2A3A
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2A23 pushfd ; iretd 0_3_053F2A3A
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2A1F pushfd ; iretd 0_3_053F2A22
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2A1F pushfd ; iretd 0_3_053F2A22
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F271F pushfd ; iretd 0_3_053F2722
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F271F pushfd ; iretd 0_3_053F2722
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F881D push edx; ret 0_3_053F881E
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F7C15 push edx; ret 0_3_053F7C16
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2E13 pushfd ; iretd 0_3_053F2E2A
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2E13 pushfd ; iretd 0_3_053F2E2A
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2707 pushfd ; iretd 0_3_053F270A
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2707 pushfd ; iretd 0_3_053F270A
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2C7B pushfd ; iretd 0_3_053F2D82
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2C7B pushfd ; iretd 0_3_053F2D82
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2E73 pushfd ; iretd 0_3_053F2EA2
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2E73 pushfd ; iretd 0_3_053F2EA2
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2E6F pushfd ; iretd 0_3_053F2E72
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2E6F pushfd ; iretd 0_3_053F2E72
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2767 pushfd ; iretd 0_3_053F276A
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2767 pushfd ; iretd 0_3_053F276A
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2C63 pushfd ; iretd 0_3_053F2C7A
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2C63 pushfd ; iretd 0_3_053F2C7A
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2963 pushfd ; iretd 0_3_053F2992
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2963 pushfd ; iretd 0_3_053F2992
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F295F pushfd ; iretd 0_3_053F2962
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F295F pushfd ; iretd 0_3_053F2962
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2C5F pushfd ; iretd 0_3_053F2C62
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F2C5F pushfd ; iretd 0_3_053F2C62
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053FA352 pushad ; ret 0_3_053FA365
Source: GWInstSt.exe.0.drStatic PE information: section name: entropy: 7.5398444579069155
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140esn.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140ita.dllJump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\Temp\OLD945C.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140deu.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\Qt5Svg.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\vcamp140.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140jpn.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140chs.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\Qt5Widgets.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfcm140u.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: 3bd8c5.rbf (copy)Jump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\iconengines\qsvgicon.dllJump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{1b774c08-0e2d-f04a-affb-563599d0a20e}\gwdrv.sys (copy)Jump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\vcruntime140.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\StartMenu.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_2.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140fra.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\GWIdlMon.exeJump to dropped file
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeFile created: C:\ProgramData\Package Cache\{8d5fdf81-7022-423f-bd8b-b513a1050ae1}\VC_redist.x86.exeJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\driver\legacy-x64\gwdrv.sysJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: 3bd8c7.rbf (copy)Jump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeFile created: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\vcomp140.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140rus.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_1.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Windows\System32\drivers\gwdrv.sysJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140cht.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_codecvt_ids.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\Qt5Core.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfcm140.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: 3bd8c8.rbf (copy)Jump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\driver\legacy-x86\gwdrv.sysJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\GlassWire.exeJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\concrt140.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: 3bd8c0.rbf (copy)Jump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\uninstall.exeJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\Qt5Gui.dllJump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{1b774c08-0e2d-f04a-affb-563599d0a20e}\SET8C50.tmpJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\nsDialogs.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\platforms\qwindows.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\driver\x64\gwdrv.sysJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\GWUpgradeMonitor.exeJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\vccorlib140.dllJump to dropped file
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\wixstdba.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\driver\win7-x86\gwdrv.sysJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\nsihelper.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140u.dllJump to dropped file
Source: C:\Windows\System32\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\{1b9ae675-a69a-784f-a0a3-d898132a09ba}\SET89B0.tmpJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\plugins\windows.dllJump to dropped file
Source: C:\Windows\System32\rundll32.exeFile created: C:\Users\user\AppData\Local\Temp\{1b9ae675-a69a-784f-a0a3-d898132a09ba}\gwdrv.sys (copy)Jump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140kor.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: 3bd8c6.rbf (copy)Jump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\GWEventLog.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\Qt5WinExtras.dllJump to dropped file
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\driver\win7-x64\gwdrv.sysJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_atomic_wait.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140enu.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\imageformats\qico.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\nsExec.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\Qt5OpenGL.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\GWUnlock.exeJump to dropped file
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeFile created: C:\ProgramData\Package Cache\{8d5fdf81-7022-423f-bd8b-b513a1050ae1}\VC_redist.x86.exeJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140esn.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140ita.dllJump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{1b774c08-0e2d-f04a-affb-563599d0a20e}\SET8C50.tmpJump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\Temp\OLD945C.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140deu.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\vcamp140.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140jpn.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140chs.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfcm140u.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\vccorlib140.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140.dllJump to dropped file
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\wixstdba.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140u.dllJump to dropped file
Source: C:\Windows\System32\drvinst.exeFile created: C:\Windows\System32\DriverStore\Temp\{1b774c08-0e2d-f04a-affb-563599d0a20e}\gwdrv.sys (copy)Jump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\vcruntime140.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140kor.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_2.dllJump to dropped file
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140fra.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_atomic_wait.dllJump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeFile created: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\vcomp140.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140enu.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140rus.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_1.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Windows\System32\drivers\gwdrv.sysJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfc140cht.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_codecvt_ids.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\SysWOW64\mfcm140.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\concrt140.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\ASIO-LICENSE_1_0.txtJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\GEOIP-LICENSE.txtJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\GEOLITE2-LICENSE.txtJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\LZ4-LICENSE.txtJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\OPENSSL-LICENSE.txtJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\PROTOBYUF-LICENSE.txtJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\QT-LICENSE.GPL3-EXCEPT.txtJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\QT-LICENSE.txtJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\RAPIDJSON-LICENSE.txtJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\RAPIDXML-LICENSE.txtJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\Program Files (x86)\GlassWire\copyrights\ZLIB-LICENSE.txtJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1028\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1029\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1031\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1036\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1040\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1041\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1042\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1045\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1046\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1049\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1055\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\2052\license.rtfJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeFile created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\3082\license.rtfJump to behavior

Boot Survival

barindex
Creates an autostart registry key pointing to binary in C:\Windows
Source: C:\Windows\System32\rundll32.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv
Creates multiple autostart registry keys
Source: C:\Users\user\Desktop\GlassWireSetup.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GlassWireJump to behavior
Source: C:\Windows\System32\rundll32.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeRegistry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SystemRestoreJump to behavior
Source: C:\Windows\System32\SrTasks.exeRegistry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\SPP
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GlassWireJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GlassWire\Uninstall.lnkJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GlassWire\GlassWire.lnkJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GlassWireJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run GlassWireJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {8d5fdf81-7022-423f-bd8b-b513a1050ae1}Jump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {8d5fdf81-7022-423f-bd8b-b513a1050ae1}Jump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {8d5fdf81-7022-423f-bd8b-b513a1050ae1}Jump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce {8d5fdf81-7022-423f-bd8b-b513a1050ae1}Jump to behavior
Source: C:\Windows\System32\rundll32.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv
Source: C:\Windows\System32\rundll32.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv
Source: C:\Windows\System32\rundll32.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv
Source: C:\Windows\System32\rundll32.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce GrpConv

Hooking and other Techniques for Hiding and Protection

barindex
Tries to open files direct via NTFS file id
Source: C:\Windows\System32\drvinst.exeFile opened: NULL
Source: C:\Windows\System32\drvinst.exeFile opened: NULL
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeRegistry key monitored for changes: HKEY_USERS.DEFAULT\Software\Classes
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeRegistry key monitored for changes: HKEY_USERS.DEFAULT\Software\Classes
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\VSSVC.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
Source: C:\Windows\System32\svchost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\drvinst.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\runonce.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\grpconv.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\grpconv.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\grpconv.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\grpconv.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

barindex
Query firmware table information (likely to detect VMs)
Source: C:\Users\user\Desktop\GlassWireSetup.exeSystem information queried: FirmwareTableInformationJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeSystem information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSystem information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSystem information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSystem information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSystem information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSystem information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSystem information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeSystem information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeSystem information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeSystem information queried: FirmwareTableInformation
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeSystem information queried: FirmwareTableInformation
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Windows\System32\svchost.exeFile opened / queried: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F5F84 rdtsc 0_3_053F5F84
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\mfc140esn.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\mfc140ita.dllJump to dropped file
Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\Temp\OLD945C.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\mfc140deu.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\vcamp140.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\mfc140jpn.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\mfc140chs.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: 3bd8c5.rbf (copy)Jump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\mfcm140u.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\mfc140.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GlassWire\iconengines\qsvgicon.dllJump to dropped file
Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{1b774c08-0e2d-f04a-affb-563599d0a20e}\gwdrv.sys (copy)Jump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\System.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\StartMenu.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_2.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\mfc140fra.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GlassWire\GWIdlMon.exeJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GlassWire\driver\legacy-x64\gwdrv.sysJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: 3bd8c7.rbf (copy)Jump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\vcomp140.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\mfc140rus.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeDropped PE file which has not been started: C:\Windows\System32\drivers\gwdrv.sysJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\mfc140cht.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_codecvt_ids.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\mfcm140.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: 3bd8c8.rbf (copy)Jump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GlassWire\driver\legacy-x86\gwdrv.sysJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\concrt140.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: 3bd8c0.rbf (copy)Jump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GlassWire\uninstall.exeJump to dropped file
Source: C:\Windows\System32\drvinst.exeDropped PE file which has not been started: C:\Windows\System32\DriverStore\Temp\{1b774c08-0e2d-f04a-affb-563599d0a20e}\SET8C50.tmpJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\nsDialogs.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GlassWire\platforms\qwindows.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GlassWire\driver\x64\gwdrv.sysJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GlassWire\GWUpgradeMonitor.exeJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\vccorlib140.dllJump to dropped file
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeDropped PE file which has not been started: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\wixstdba.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\nsihelper.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GlassWire\driver\win7-x86\gwdrv.sysJump to dropped file
Source: C:\Windows\System32\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{1b9ae675-a69a-784f-a0a3-d898132a09ba}\SET89B0.tmpJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\mfc140u.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GlassWire\plugins\windows.dllJump to dropped file
Source: C:\Windows\System32\rundll32.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{1b9ae675-a69a-784f-a0a3-d898132a09ba}\gwdrv.sys (copy)Jump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\mfc140kor.dllJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: 3bd8c6.rbf (copy)Jump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GlassWire\driver\win7-x64\gwdrv.sysJump to dropped file
Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Windows\SysWOW64\mfc140enu.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\nsExec.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GlassWire\imageformats\qico.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GlassWire\Qt5OpenGL.dllJump to dropped file
Source: C:\Users\user\Desktop\GlassWireSetup.exeDropped PE file which has not been started: C:\Program Files (x86)\GlassWire\GWUnlock.exeJump to dropped file
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeEvaded block: after key decision
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeEvaded block: after key decision
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeEvaded block: after key decision
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeEvaded block: after key decision
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeEvaded block: after key decision
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeEvasive API call chain: GetLocalTime,DecisionNodes
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCheck user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCheck user administrative privileges: GetTokenInformation,DecisionNodes
Source: C:\Windows\System32\SrTasks.exe TID: 4192Thread sleep time: -300000s >= -30000s
Source: C:\Windows\System32\svchost.exe TID: 6924Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\svchost.exeFile opened: PhysicalDrive0
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005EFDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 005EFE5Dh1_2_005EFDC2
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005EFDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 005EFE56h1_2_005EFDC2
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_0089FDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 0089FE5Dh2_2_0089FDC2
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_0089FDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 0089FE56h2_2_0089FDC2
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E2FDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 05h and CTI: je 00E2FE5Dh3_2_00E2FDC2
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E2FDC2 GetLocalTime followed by cmp: cmp dword ptr [ebp+08h], 01h and CTI: je 00E2FE56h3_2_00E2FDC2
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile Volume queried: C:\Program Files (x86) FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile Volume queried: C:\Program Files (x86) FullSizeInformationJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeFile Volume queried: C:\Windows FullSizeInformationJump to behavior
Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_2_00405C4D GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,0_2_00405C4D
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_2_0040689E FindFirstFileW,FindClose,0_2_0040689E
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_2_00402930 FindFirstFileW,0_2_00402930
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005B3BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,1_2_005B3BC3
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005F4315 FindFirstFileW,FindClose,1_2_005F4315
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005C993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose,1_2_005C993E
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_008A4315 FindFirstFileW,FindClose,2_2_008A4315
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_0087993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose,2_2_0087993E
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_00863BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,2_2_00863BC3
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E34315 FindFirstFileW,FindClose,3_2_00E34315
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E0993E FindFirstFileW,lstrlenW,FindNextFileW,FindClose,3_2_00E0993E
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00DF3BC3 GetFileAttributesW,GetLastError,GetLastError,SetFileAttributesW,GetLastError,GetTempPathW,GetLastError,FindFirstFileW,GetLastError,SetFileAttributesW,DeleteFileW,GetTempFileNameW,MoveFileExW,MoveFileExW,MoveFileExW,FindNextFileW,GetLastError,GetLastError,GetLastError,GetLastError,RemoveDirectoryW,GetLastError,MoveFileExW,GetLastError,FindClose,3_2_00DF3BC3
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005F962D VirtualQuery,GetSystemInfo,1_2_005F962D
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile opened: C:\Users\user\AppData\RoamingJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile opened: C:\Users\userJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile opened: C:\Users\user\AppData\Roaming\MicrosoftJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile opened: C:\Users\user\AppDataJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeFile opened: C:\Users\user\AppData\Roaming\Microsoft\WindowsJump to behavior
Source: VSSVC.exe, 00000005.00000003.1837229215.000002A5C7D7F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}]
Source: GlassWireSetup.exe, 00000000.00000003.2314112487.000000000275E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ^58,59,1,28,121,33,3,12,119,15,6,40,41,42,26,17,120,9,7,44,45,46,47$VMware vCenter Server Appliance
Source: GlassWireSetup.exe, 00000000.00000003.2314112487.000000000275E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ^58,59,1,28,121,33,3,12,119,15,6,40,41,42,26,17,120,9,7,44,45,47$VMware vCenter Server Appliance
Source: SrTasks.exe, 00000008.00000003.1980973687.00000170906C1000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:Y
Source: GlassWireSetup.exe, 00000000.00000003.2314112487.000000000275E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ^(?:(?:Microsoft )?(Windows (?:[a-z]+\s[a-z]+\s|[a-z]+\s)?Server (?:\d{4} R2|\d{4}))(?:,\s|\s)?([a-z]+)?(?: Evaluation)?(?: Edition)?(?:\s|\swith(?:out)? Hyper-V\s)?(SP\d|SP \d|Service Pack \d)?)$Windows Server 2003 and lateros.vendor:'Microsoft', os.family:'Windows', os.product:'%1', os.edition:'%2', os.version:'%3'
Source: GlassWireSetup.exe, 00000000.00000003.2314112487.000000000275E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: aVMware Server ConsoleL
Source: vc_redist.x86.exe, 00000002.00000003.1914093228.00000000011C7000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: GlassWireSetup.exe, 00000000.00000003.2314112487.000000000275E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: )VMware, Inc.'
Source: GlassWireSetup.exe, 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: ^(?:VMWare Photon(?:\/)?(?:\s?Linux)?\s?(?:v)?(\d+?(?:\.\d+?)*?)?)$ q
Source: svchost.exe, 00000006.00000003.1844854538.000001AA63C79000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: SrTasks.exe, 00000008.00000003.1917033317.00000170906BF000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:88
Source: GlassWireSetup.exe, 00000000.00000003.2314112487.000000000275E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware, Inc.h
Source: GlassWireSetup.exe, 00000000.00000003.2314112487.000000000275E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: iVMware, Inc.
Source: GlassWireSetup.exe, 00000000.00000003.2250462089.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2562039781.0000000000661000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1950277165.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1945493985.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1943361465.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1949040704.000000000066B000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: GlassWireSetup.exe, 00000000.00000003.2314112487.000000000275E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: VMware Virtual Infrastructure ClientL
Source: GlassWireSetup.exe, 00000000.00000003.2314112487.000000000275E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: =PVVMware, Inc.
Source: GlassWireSetup.exe, 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpBinary or memory string: m^(?:VMWare Photon(?:\/)?(?:\s?Linux)?\s?(?:v)?(\d+?(?:\.\d+?)*?)?)$Photon Linuxos.vendor:'VMware', os.family:'Linux', os.product:'Photon Linux', os.version:'%1', os.cpe23:'cpe:/o:vmware:photon_os:%1'
Source: svchost.exe, 00000006.00000003.1844854538.000001AA63C71000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: SrTasks.exe, 00000008.00000003.1981823212.00000170906E2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: SrTasks.exe, 00000008.00000003.1954076075.00000170906BE000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: \Device\HarddiskVolume1\??\Volume{ad6cc5d8-f1a9-4873-be33-91b2f05e9306}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:0
Source: GlassWireSetup.exe, 00000000.00000003.2314112487.000000000275E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ^(?:(?:Microsoft )?(Windows (?:[a-z]+\s[a-z]+\s|[a-z]+\s)?Server (?:\d{4} R2|\d{4}))(?:,\s|\s)?([a-z]+)?(?: Evaluation)?(?: Edition)?(?:\s|\swith(?:out)? Hyper-V\s)?(SP\d|SP \d|Service Pack \d)?)$Windows Server 2003 and lateros.vendor:'Microsoft'
Source: GlassWireSetup.exe, 00000000.00000003.2314112487.000000000275E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ^(VMware ESXi?) (\d\.\d+\.\d+) build-\d+ VMware, Inc\. (\S+)$
Source: GlassWireSetup.exe, 00000000.00000003.2314112487.000000000275E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ^(?:(?:Oracle|Sun)?\s?Solaris\s?((?:[789]|10)+?(?:\.\d+?)*?)?)$5-z]+\s)?Server (?:\d{4} R2|\d{4}))(?:,\s|\s)?([a-z]+)?(?: Evaluation)?(?: Edition)?(?:\s|\swith(?:out)? Hyper-V\s)?(SP\d|SP \d|Service Pack \d)?)$
Source: GlassWireSetup.exe, 00000000.00000003.2314112487.000000000275E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: E^"vSphere Management Assistant ([\d\.]+)"$VMware vSphere Management assistant, which is a virtual machine (https://www.vmware.com/support/developer/vima/)os.vendor:'VMware', os.product:'vSphere Management Assistant', os.version:'%1'
Source: GlassWireSetup.exe, 00000000.00000003.2314112487.000000000275E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: ^(VMware ESXi?) (\d\.\d+\.\d+) build-\d+ VMware, Inc\. (\S+)$VMware ESX/ESXios.vendor:'VMware', os.family:'VMware ESX/ESXi', os.product:'%1', os.version:'%2', os.arch:'%3'
Source: GlassWireSetup.exe, 00000000.00000003.2314112487.000000000275E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: aVMware Remote Console-
Source: GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: .?AVQEmulationPaintEngine@@
Source: C:\Users\user\Desktop\GlassWireSetup.exeAPI call chain: ExitProcess graph end nodegraph_0-4100
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeAPI call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeAPI call chain: ExitProcess graph end node
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeAPI call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\GlassWireSetup.exeSystem information queried: ModuleInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeProcess information queried: ProcessInformation

Anti Debugging

barindex
Hides threads from debuggers
Source: C:\Users\user\Desktop\GlassWireSetup.exeThread information set: HideFromDebuggerJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeThread information set: HideFromDebugger
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeThread information set: HideFromDebugger
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeThread information set: HideFromDebugger
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeThread information set: HideFromDebugger
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeThread information set: HideFromDebugger
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeThread information set: HideFromDebugger
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeThread information set: HideFromDebugger
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeThread information set: HideFromDebugger
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeThread information set: HideFromDebugger
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeThread information set: HideFromDebugger
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeThread information set: HideFromDebugger
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess queried: DebugPortJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess queried: DebugObjectHandleJump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeProcess queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeProcess queried: DebugObjectHandle
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeProcess queried: DebugObjectHandle
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeProcess queried: DebugObjectHandle
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeProcess queried: DebugObjectHandle
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeProcess queried: DebugObjectHandle
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeProcess queried: DebugObjectHandle
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeProcess queried: DebugObjectHandle
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeProcess queried: DebugObjectHandle
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess queried: DebugObjectHandle
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess queried: DebugObjectHandle
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess queried: DebugPort
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeProcess queried: DebugObjectHandle
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_3_053F5F84 rdtsc 0_3_053F5F84
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005DE625 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_005DE625
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005E4812 mov eax, dword ptr fs:[00000030h]1_2_005E4812
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_00894812 mov eax, dword ptr fs:[00000030h]2_2_00894812
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E24812 mov eax, dword ptr fs:[00000030h]3_2_00E24812
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005B38D4 GetProcessHeap,RtlAllocateHeap,1_2_005B38D4
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005DE188 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,1_2_005DE188
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005DE625 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_005DE625
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005DE773 SetUnhandledExceptionFilter,1_2_005DE773
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005E3BB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,1_2_005E3BB0
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_0088E188 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_0088E188
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_0088E625 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_0088E625
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_0088E773 SetUnhandledExceptionFilter,2_2_0088E773
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeCode function: 2_2_00893BB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_00893BB0
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E1E188 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_00E1E188
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E1E625 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00E1E625
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E1E773 SetUnhandledExceptionFilter,3_2_00E1E773
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeCode function: 3_2_00E23BB0 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_00E23BB0
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Windows\system32\drivers\gwdrv.infJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Windows\System32\net.exe "C:\Windows\system32\net.exe" start gwdrvJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Windows\SysWOW64\wevtutil.exe "C:\Windows\system32\wevtutil.exe" im "C:\Users\user\AppData\Local\Temp\nsx9694.tmp\eventlog.man" /rf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll" /mf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll"Jump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Program Files (x86)\GlassWire\GWCtlSrv.exe "C:\Program Files (x86)\GlassWire\GWCtlSrv.exe" "-i"Jump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Program Files (x86)\GlassWire\GWCtlSrv.exe "C:\Program Files (x86)\GlassWire\GWCtlSrv.exe" "-s"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeProcess created: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe "C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exe" -burn.filehandle.attached=524 -burn.filehandle.self=640 /install /quiet /norestartJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeProcess created: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exe "C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{4C6967F0-7861-4E5E-A266-A79F91D53451} {8D47B6A8-8425-45E8-BA0B-10ED43630BCC} 1148Jump to behavior
Source: C:\Windows\System32\runonce.exeProcess created: C:\Windows\System32\grpconv.exe "C:\Windows\System32\grpconv.exe" -o
Source: C:\Windows\System32\net.exeProcess created: C:\Windows\System32\net1.exe C:\Windows\system32\net1 start gwdrv
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exe "c:\users\user\appdata\local\temp\nsx9694.tmp\gwinstst.exe" "https://www.glasswire.com/stat/install.php?v=3.4.694&build_type=full&os=ten&platform=x64&update=0&install_id=8ac7009d4b52e62f54ad1f4176fbf27962f3eaf3f7dde916a08729fd64a8aeee&referrer=https%3a%2f%2fwww.google.com%2f&user_agent=mozilla%2f5.0+%28windows+nt+10.0%3b+win64%3b+x64%29+applewebkit%2f537.36+%28khtml%2c+like+gecko%29+chrome%2f129.0.0.0+safari%2f537.36+edg%2f129.0.0.0&ga_client_id=1231827075.1728319357" "nsis$$.tmp"
Source: C:\Users\user\Desktop\GlassWireSetup.exeProcess created: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exe "c:\users\user\appdata\local\temp\nsx9694.tmp\gwinstst.exe" "https://www.glasswire.com/stat/install.php?v=3.4.694&build_type=full&os=ten&platform=x64&update=0&install_id=8ac7009d4b52e62f54ad1f4176fbf27962f3eaf3f7dde916a08729fd64a8aeee&referrer=https%3a%2f%2fwww.google.com%2f&user_agent=mozilla%2f5.0+%28windows+nt+10.0%3b+win64%3b+x64%29+applewebkit%2f537.36+%28khtml%2c+like+gecko%29+chrome%2f129.0.0.0+safari%2f537.36+edg%2f129.0.0.0&ga_client_id=1231827075.1728319357" "nsis$$.tmp"Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005F15CB InitializeSecurityDescriptor,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,CreateWellKnownSid,GetLastError,CreateWellKnownSid,SetEntriesInAclA,SetSecurityDescriptorOwner,GetLastError,SetSecurityDescriptorGroup,GetLastError,SetSecurityDescriptorDacl,GetLastError,CoInitializeSecurity,LocalFree,1_2_005F15CB
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005F393B AllocateAndInitializeSid,CheckTokenMembership,1_2_005F393B
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005DE9A7 cpuid 1_2_005DE9A7
Source: C:\Users\user\Desktop\GlassWireSetup.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Users\user\Desktop\GlassWireSetup.exeQueries volume information: C:\ VolumeInformationJump to behavior
Source: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exeQueries volume information: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\logo.png VolumeInformationJump to behavior
Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\drvinst.exeQueries volume information: C:\Windows\System32\DriverStore\Temp\{1b774c08-0e2d-f04a-affb-563599d0a20e}\gwdrv.cat VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GWCtlSrv.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeQueries volume information: C:\Program Files (x86)\GlassWire\platforms\qwindows.dll VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeQueries volume information: C:\Program Files (x86)\GlassWire\iconengines\qsvgicon.dll VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeQueries volume information: C:\Program Files (x86)\GlassWire\imageformats\qico.dll VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeQueries volume information: C:\Program Files (x86)\GlassWire\lang\en_us.qm VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exeQueries volume information: C:\ VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeQueries volume information: C:\Program Files (x86)\GlassWire\platforms\qwindows.dll VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeQueries volume information: C:\Program Files (x86)\GlassWire\iconengines\qsvgicon.dll VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeQueries volume information: C:\Program Files (x86)\GlassWire\imageformats\qico.dll VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeQueries volume information: C:\Users\user\AppData\Local\GlassWire\client-full\client.conf VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeQueries volume information: C:\Program Files (x86)\GlassWire\lang\en_us.qm VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeQueries volume information: C:\Program Files (x86)\GlassWire\platforms\qwindows.dll VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeQueries volume information: C:\Program Files (x86)\GlassWire\iconengines\qsvgicon.dll VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeQueries volume information: C:\Program Files (x86)\GlassWire\imageformats\qico.dll VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeQueries volume information: C:\Users\user\AppData\Local\GlassWire\client-full\client.conf VolumeInformation
Source: C:\Program Files (x86)\GlassWire\GlassWire.exeQueries volume information: C:\Program Files (x86)\GlassWire\lang\en_us.qm VolumeInformation
Source: C:\Windows\System32\runonce.exeKey value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation Bias
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005C4CE8 ConvertStringSecurityDescriptorToSecurityDescriptorW,GetLastError,CreateNamedPipeW,GetLastError,CreateNamedPipeW,GetLastError,CloseHandle,LocalFree,1_2_005C4CE8
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005DE513 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,1_2_005DE513
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005B60BA GetUserNameW,GetLastError,1_2_005B60BA
Source: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exeCode function: 1_2_005F8733 GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,1_2_005F8733
Source: C:\Users\user\Desktop\GlassWireSetup.exeCode function: 0_2_0040351C EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrlenW,wsprintfW,GetFileAttributesW,DeleteFileW,SetCurrentDirectoryW,CopyFileW,ExitProcess,OleUninitialize,ExitProcess,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,InitOnceBeginInitialize,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,0_2_0040351C
Source: C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

Mitre Att&ck Matrix

ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
Gather Victim Identity InformationAcquire Infrastructure1
Replication Through Removable Media		3
Native API		1
DLL Side-Loading		1
DLL Side-Loading		1
Deobfuscate/Decode Files or Information		OS Credential Dumping22
System Time Discovery		Remote Services11
Archive Collected Data		1
Ingress Tool Transfer		Exfiltration Over Other Network Medium1
System Shutdown/Reboot
CredentialsDomainsDefault Accounts13
Command and Scripting Interpreter		31
Windows Service		1
Access Token Manipulation		3
Obfuscated Files or Information		LSASS Memory11
Peripheral Device Discovery		Remote Desktop Protocol1
Clipboard Data		21
Encrypted Channel		Exfiltration Over BluetoothNetwork Denial of Service
Email AddressesDNS ServerDomain Accounts1
Service Execution		211
Registry Run Keys / Startup Folder		31
Windows Service		2
Software Packing		Security Account Manager1
Account Discovery		SMB/Windows Admin SharesData from Network Shared Drive3
Non-Application Layer Protocol		Automated ExfiltrationData Encrypted for Impact
Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook12
Process Injection		1
DLL Side-Loading		NTDS3
File and Directory Discovery		Distributed Component Object ModelInput Capture14
Application Layer Protocol		Traffic DuplicationData Destruction
Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon Script211
Registry Run Keys / Startup Folder		1
File Deletion		LSA Secrets38
System Information Discovery		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts32
Masquerading		Cached Domain Credentials1
Query Registry		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items24
Virtualization/Sandbox Evasion		DCSync361
Security Software Discovery		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job1
Access Token Manipulation		Proc Filesystem24
Virtualization/Sandbox Evasion		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt12
Process Injection		/etc/passwd and /etc/shadow1
Process Discovery		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
Rundll32		Network Sniffing1
System Owner/User Discovery		Shared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1528306 Sample: GlassWireSetup.exe Startdate: 07/10/2024 Architecture: WINDOWS Score: 34 91 www.glasswire.com 2->91 93 pivot.protect.glasswire.com 2->93 95 api-eu-north-1.protect.glasswire.com 2->95 105 PE file contains section with special chars 2->105 9 GlassWireSetup.exe 24 142 2->9         started        14 explorer.exe 2->14         started        16 GWCtlSrv.exe 2->16         started        18 8 other processes 2->18 signatures3 process4 dnsIp5 99 pivot.protect.glasswire.com 13.50.186.172, 443, 57829 AMAZON-02US United States 9->99 101 127.0.0.1 unknown unknown 9->101 103 api-eu-north-1.protect.glasswire.com 16.16.13.164, 443, 57840, 57848 unknown United States 9->103 59 C:\Users\user\AppData\Local\...behaviorgraphWInstSt.exe, PE32 9->59 dropped 61 C:\Program Files (x86)\...behaviorgraphlassWire.exe, PE32 9->61 dropped 63 C:\Program Files (x86)\...behaviorgraphWCtlSrv.exe, PE32 9->63 dropped 71 27 other files (none is malicious) 9->71 dropped 119 Query firmware table information (likely to detect VMs) 9->119 121 Creates multiple autostart registry keys 9->121 123 Hides threads from debuggers 9->123 20 GWInstSt.exe 9->20         started        24 GWCtlSrv.exe 9->24         started        26 GWCtlSrv.exe 9->26         started        37 5 other processes 9->37 28 GlassWire.exe 14->28         started        125 Tries to detect sandboxes / dynamic malware analysis system (registry check) 16->125 65 C:\Windows\SysWOW64\vcomp140.dll, PE32 18->65 dropped 67 C:\Windows\SysWOW64\vcamp140.dll, PE32 18->67 dropped 69 C:\Windows\SysWOW64\mfcm140u.dll, PE32 18->69 dropped 73 26 other files (none is malicious) 18->73 dropped 30 drvinst.exe 18->30         started        33 drvinst.exe 18->33         started        35 conhost.exe 18->35         started        file6 signatures7 process8 dnsIp9 97 www.glasswire.com 18.244.164.20, 443, 57884 AMAZON-02US United States 20->97 107 Query firmware table information (likely to detect VMs) 20->107 109 Hides threads from debuggers 20->109 111 Tries to detect sandboxes / dynamic malware analysis system (registry check) 20->111 39 conhost.exe 24->39         started        41 conhost.exe 26->41         started        79 C:\Windows\Temp\OLD945C.tmp, PE32+ 30->79 dropped 113 Tries to open files direct via NTFS file id 30->113 81 C:\Windows\System32\...\gwdrv.sys (copy), PE32+ 33->81 dropped 83 C:\Windows\System32\...\SET8C50.tmp, PE32+ 33->83 dropped 85 C:\Windows\Temp\...\vc_redist.x86.exe, PE32 37->85 dropped 87 C:\Users\user\AppData\...\gwdrv.sys (copy), PE32+ 37->87 dropped 89 C:\Users\user\AppData\Local\...\SET89B0.tmp, PE32+ 37->89 dropped 115 Creates multiple autostart registry keys 37->115 117 Creates an autostart registry key pointing to binary in C:\Windows 37->117 43 vc_redist.x86.exe 71 37->43         started        46 runonce.exe 37->46         started        48 conhost.exe 37->48         started        50 3 other processes 37->50 file10 signatures11 process12 file13 75 C:\Windows\Temp\...\VC_redist.x86.exe, PE32 43->75 dropped 77 C:\Windows\Temp\...\wixstdba.dll, PE32 43->77 dropped 52 VC_redist.x86.exe 34 18 43->52         started        55 grpconv.exe 46->55         started        process14 file15 57 C:\ProgramData\...\VC_redist.x86.exe, PE32 52->57 dropped

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.


windows-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

SourceDetectionScannerLabelLink
3bd8c0.rbf (copy)0%ReversingLabs
3bd8c5.rbf (copy)0%ReversingLabs
3bd8c6.rbf (copy)0%ReversingLabs
3bd8c7.rbf (copy)0%ReversingLabs
3bd8c8.rbf (copy)0%ReversingLabs
C:\Program Files (x86)\GlassWire\GWCtlSrv.exe0%ReversingLabs
C:\Program Files (x86)\GlassWire\GWEventLog.dll0%ReversingLabs
C:\Program Files (x86)\GlassWire\GWIdlMon.exe0%ReversingLabs
C:\Program Files (x86)\GlassWire\GWUnlock.exe4%ReversingLabs
C:\Program Files (x86)\GlassWire\GWUpgradeMonitor.exe4%ReversingLabs
C:\Program Files (x86)\GlassWire\GlassWire.exe0%ReversingLabs
C:\Program Files (x86)\GlassWire\Qt5Core.dll0%ReversingLabs
C:\Program Files (x86)\GlassWire\Qt5Gui.dll0%ReversingLabs
C:\Program Files (x86)\GlassWire\Qt5OpenGL.dll0%ReversingLabs
C:\Program Files (x86)\GlassWire\Qt5Svg.dll0%ReversingLabs
C:\Program Files (x86)\GlassWire\Qt5Widgets.dll0%ReversingLabs
C:\Program Files (x86)\GlassWire\Qt5WinExtras.dll0%ReversingLabs
C:\Program Files (x86)\GlassWire\driver\legacy-x64\gwdrv.sys0%ReversingLabs
C:\Program Files (x86)\GlassWire\driver\legacy-x86\gwdrv.sys0%ReversingLabs
C:\Program Files (x86)\GlassWire\driver\win7-x64\gwdrv.sys0%ReversingLabs
C:\Program Files (x86)\GlassWire\driver\win7-x86\gwdrv.sys0%ReversingLabs
C:\Program Files (x86)\GlassWire\driver\x64\gwdrv.sys0%ReversingLabs
C:\Program Files (x86)\GlassWire\iconengines\qsvgicon.dll0%ReversingLabs
C:\Program Files (x86)\GlassWire\imageformats\qico.dll0%ReversingLabs
C:\Program Files (x86)\GlassWire\platforms\qwindows.dll0%ReversingLabs
C:\Program Files (x86)\GlassWire\plugins\windows.dll0%ReversingLabs
C:\Program Files (x86)\GlassWire\uninstall.exe4%ReversingLabs
C:\ProgramData\Package Cache\{8d5fdf81-7022-423f-bd8b-b513a1050ae1}\VC_redist.x86.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsx9694.tmp\StartMenu.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsx9694.tmp\System.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsx9694.tmp\nsDialogs.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsx9694.tmp\nsExec.dll0%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsx9694.tmp\nsihelper.dll3%ReversingLabs
C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exe0%ReversingLabs
C:\Users\user\AppData\Local\Temp\{1b9ae675-a69a-784f-a0a3-d898132a09ba}\SET89B0.tmp0%ReversingLabs
C:\Users\user\AppData\Local\Temp\{1b9ae675-a69a-784f-a0a3-d898132a09ba}\gwdrv.sys (copy)0%ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\concrt140.dll0%ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140.dll0%ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_1.dll0%ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_2.dll0%ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_atomic_wait.dll0%ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_codecvt_ids.dll0%ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\vccorlib140.dll0%ReversingLabs
C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\vcruntime140.dll0%ReversingLabs
C:\Windows\SysWOW64\mfc140.dll0%ReversingLabs
C:\Windows\SysWOW64\mfc140chs.dll0%ReversingLabs
C:\Windows\SysWOW64\mfc140cht.dll0%ReversingLabs
C:\Windows\SysWOW64\mfc140deu.dll0%ReversingLabs
C:\Windows\SysWOW64\mfc140enu.dll0%ReversingLabs
C:\Windows\SysWOW64\mfc140esn.dll0%ReversingLabs
C:\Windows\SysWOW64\mfc140fra.dll0%ReversingLabs
C:\Windows\SysWOW64\mfc140ita.dll0%ReversingLabs
C:\Windows\SysWOW64\mfc140jpn.dll0%ReversingLabs
C:\Windows\SysWOW64\mfc140kor.dll0%ReversingLabs
C:\Windows\SysWOW64\mfc140rus.dll0%ReversingLabs
C:\Windows\SysWOW64\mfc140u.dll0%ReversingLabs
C:\Windows\SysWOW64\mfcm140.dll0%ReversingLabs
C:\Windows\SysWOW64\mfcm140u.dll0%ReversingLabs
C:\Windows\SysWOW64\vcamp140.dll0%ReversingLabs
C:\Windows\SysWOW64\vcomp140.dll0%ReversingLabs
C:\Windows\System32\DriverStore\Temp\{1b774c08-0e2d-f04a-affb-563599d0a20e}\SET8C50.tmp0%ReversingLabs
C:\Windows\System32\DriverStore\Temp\{1b774c08-0e2d-f04a-affb-563599d0a20e}\gwdrv.sys (copy)0%ReversingLabs
C:\Windows\System32\drivers\gwdrv.sys0%ReversingLabs
C:\Windows\Temp\OLD945C.tmp0%ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#0%URL Reputationsafe
http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl00%URL Reputationsafe
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#0%URL Reputationsafe
http://nsis.sf.net/NSIS_ErrorError0%URL Reputationsafe
http://www.symauth.com/cps0(0%URL Reputationsafe
http://www.symauth.com/rpa000%URL Reputationsafe
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z0%URL Reputationsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
api-eu-north-1.protect.glasswire.com
16.16.13.164
truefalse
    		unknown
    pivot.protect.glasswire.com
    		13.50.186.172
    		truefalse
      		unknown
      www.glasswire.com
      		18.244.164.20
      		truefalse
        		unknown

        Contacted URLs

        NameMaliciousAntivirus DetectionReputation
        https://api-eu-north-1.protect.glasswire.com/api/v1.1/agent/eventfalse
          		unknown
          https://api-eu-north-1.protect.glasswire.com/api/v1.1/agent/device/registerfalse
            		unknown
            https://www.glasswire.com/stat/install.php?v=3.4.694&build_type=full&os=Ten&platform=x64&update=0&install_id=8AC7009D4B52E62F54AD1F4176FBF27962F3EAF3F7DDE916A08729FD64A8AEEE&referrer=https%3A%2F%2Fwww.google.com%2F&user_agent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F129.0.0.0+Safari%2F537.36+Edg%2F129.0.0.0&ga_client_id=1231827075.1728319357false
              		unknown
              https://pivot.protect.glasswire.com/api/v1/cell?locale=chfalse
                		unknown

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl0GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                  		unknown
                  http://www.CAcert.org/index.php?id=1004GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                    		unknown
                    http://www.chambersign.orgDGlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                      		unknown
                      http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#GlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253359318.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2263010670.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2222713240.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://www.CAcert.org/index.php?id=10GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                        		unknown
                        https://pivot.protect.glasswire.comj6GlassWireSetup.exe, 00000000.00000003.2250462089.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2562039781.0000000000661000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1950277165.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1945493985.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1943361465.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1949040704.000000000066B000.00000004.00000020.00020000.00000000.sdmpfalse
                          		unknown
                          http://crl.chambersign.org/chambersroot.crl0GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                            		unknown
                            http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0GlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253359318.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2263010670.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2222713240.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmpfalse
                            • URL Reputation: safe
                            		unknown
                            http://www.e-szigno.hu/SZSZ/GlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                              		unknown
                              http://wixtoolset.org/schemas/thmutil/2010vc_redist.x86.exe, 00000002.00000002.1927445488.0000000003570000.00000004.00000800.00020000.00000000.sdmp, vc_redist.x86.exe, 00000002.00000002.1926951441.0000000003040000.00000004.00000020.00020000.00000000.sdmpfalse
                                		unknown
                                https://www.cacert.org/revoke.crlGlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                  		unknown
                                  http://www.startssl.com/policy.pdf04GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                    		unknown
                                    http://repository.swisssign.com/IGlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                      		unknown
                                      http://acedicom.edicomgroup.com/docGlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                        		unknown
                                        http://www.certifikat.dk/repository0GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                          		unknown
                                          http://www.chambersign.org1GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                            		unknown
                                            http://www.quovadisglobal.com/cpsK/GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                              		unknown
                                              http://crl.chambersign.org/chambersignroot.crlGlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                		unknown
                                                http://policy.camerfirma.com:DvGlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                  		unknown
                                                  http://www.pkioverheid.nl/policies/root-policy0GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                    		unknown
                                                    http://www.pkioverheid.nl/policies/root-policyGlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                      		unknown
                                                      https://www.maxmind.com/en/geolite2/eula.GlassWireSetup.exe, 00000000.00000003.2237386093.0000000002759000.00000004.00000020.00020000.00000000.sdmpfalse
                                                        		unknown
                                                        https://ocsp.quovadisoffshore.comGlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                          		unknown
                                                          http://www.apache.org/licenses/LICENSE-2.0CopyrightGlassWire.exe, 00000024.00000003.2591470657.0000000006A1F000.00000004.00001000.00020000.00000000.sdmpfalse
                                                            		unknown
                                                            http://www.trustcenter.de/crl/v2/tc_class_3_ca_II.crlGlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                              		unknown
                                                              http://ca.disig.sk/ca/crl/ca_disig.crl0GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                		unknown
                                                                http://www.CAcert.org/index.php?id=100PGlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                  		unknown
                                                                  https://curl.se/docs/hsts.htmlGlassWireSetup.exe, 00000000.00000003.1938926313.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B067000.00000002.00000001.01000000.0000000F.sdmpfalse
                                                                    		unknown
                                                                    http://crl.oces.certifikat.dk/oces.crlGlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                      		unknown
                                                                      http://www.disig.sk/ca/crl/ca_disig.crl0GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                        		unknown
                                                                        https://www.GlassWire.com/privacy-policy.phpGlassWireSetup.exe, 00000000.00000002.2562039781.0000000000624000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                          		unknown
                                                                          https://creativecommons.org/licenses/by/4.0/.GlassWireSetup.exe, 00000000.00000003.2237386093.0000000002759000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                            		unknown
                                                                            http://www.chambersign.org287GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                              		unknown
                                                                              http://www.startssl.com/policy.pdf0GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                		unknown
                                                                                http://fedir.comsign.co.il/crl/ComSignSecuredCA.crl?GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                  		unknown
                                                                                  http://www.sk.ee/cps/0GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                    		unknown
                                                                                    http://www.valicert.com/rkGlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                      		unknown
                                                                                      http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLGlassWire.exe, 00000024.00000003.2591470657.0000000006A1F000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                        		unknown
                                                                                        http://www.cacert.orgGlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                          		unknown
                                                                                          http://www.CAcert.org/ca.crtGlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                            		unknown
                                                                                            http://www.apache.org/licenses/LICENSE-2.0LicensedGlassWire.exe, 00000024.00000003.2591470657.0000000006A1F000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                              		unknown
                                                                                              http://acedicom.edicomgroup.com/docF-GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                		unknown
                                                                                                http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#GlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253359318.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2263010670.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2222713240.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                • URL Reputation: safe
                                                                                                		unknown
                                                                                                http://ocsp.pki.gva.es0GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                  		unknown
                                                                                                  http://www.startssl.com/policy.pdfBGlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                    		unknown
                                                                                                    https://pivot.protect.glasswire.comGlassWireSetup.exe, 00000000.00000003.1938926313.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B067000.00000002.00000001.01000000.0000000F.sdmp, GlassWireSetup.exe, 00000000.00000003.2250462089.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2562039781.0000000000661000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1950277165.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1945493985.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1943361465.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1949040704.000000000066B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                      		unknown
                                                                                                      http://crl.oces.certifikat.dk/oces.crl0GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                        		unknown
                                                                                                        https://www.glasswire.com/stat/install.php?v=3.4.694&build_type=full&os=GlassWireSetup.exe, 00000000.00000003.1699586932.0000000002762000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2562039781.0000000000624000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                          		unknown
                                                                                                          https://pivot.protect.glasswire.com/api/v1/celld6GlassWireSetup.exe, 00000000.00000003.2250462089.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2562039781.0000000000661000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1950277165.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1945493985.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1943361465.000000000066B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.1949040704.000000000066B000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                            		unknown
                                                                                                            https://api-eu-north-1.protect.glasswire.com/v1/apiGlassWireSetup.exe, 00000000.00000003.2554625404.00000000006C5000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                              		unknown
                                                                                                              http://www.gnu.org/philosophy/why-not-lgpl.htmlGlassWireSetup.exe, 00000000.00000003.2242587337.0000000002757000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2243073905.0000000002759000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                		unknown
                                                                                                                http://www.certicamara.com/dpc/0ZGlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                  		unknown
                                                                                                                  http://crl.pki.wellsfargo.com/wsprca.crl0GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                    		unknown
                                                                                                                    http://www.certplus.com/CRL/class2.crlGlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                      		unknown
                                                                                                                      http://ca.disig.sk/ca/crl/ca_disig.crlGlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                        		unknown
                                                                                                                        http://www.e-szigno.hu/RootCA.crtGlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                          		unknown
                                                                                                                          http://www.e-szigno.hu/SZSZGlassWireSetup.exefalse
                                                                                                                            		unknown
                                                                                                                            http://ocsp.CAcert.org/0(GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                              		unknown
                                                                                                                              http://nsis.sf.net/NSIS_ErrorErrorGlassWireSetup.exe, 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmp, GlassWireSetup.exe, 00000000.00000000.1698449415.000000000040A000.00000008.00000001.01000000.00000003.sdmpfalse
                                                                                                                              • URL Reputation: safe
                                                                                                                              		unknown
                                                                                                                              https://curl.se/docs/alt-svc.htmlGlassWireSetup.exe, 00000000.00000003.1938926313.00000000031D0000.00000004.00001000.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2568137667.000000006B067000.00000002.00000001.01000000.0000000F.sdmpfalse
                                                                                                                                		unknown
                                                                                                                                http://www.entrust.net/CRL/net1.crlGlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                  		unknown
                                                                                                                                  http://www.sansoxygen.comhttp://www.sansoxygen.comThisGlassWire.exe, 00000024.00000003.2591470657.0000000006A1F000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                    		unknown
                                                                                                                                    http://www.symauth.com/cps0(GlassWireSetup.exe, 00000000.00000003.2246018078.000000000275E000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248500311.000000000275C000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247096759.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247599754.0000000002756000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                    • URL Reputation: safe
                                                                                                                                    		unknown
                                                                                                                                    http://www.color.org)GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                      		unknown
                                                                                                                                      http://policy.camerfirma.comvDwNGlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                        		unknown
                                                                                                                                        http://cps.chambersign.org/cps/chambersroot.htmlGlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                          		unknown
                                                                                                                                          http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLCopyrightGlassWire.exe, 00000024.00000003.2591470657.0000000006A1F000.00000004.00001000.00020000.00000000.sdmpfalse
                                                                                                                                            		unknown
                                                                                                                                            https://api-eu-north-1.protect.glasswire.com/api/v1.1/agent/eventd74zGlassWireSetup.exe, 00000000.00000003.2311642643.00000000054C8000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                              		unknown
                                                                                                                                              http://www.entrust.net/CRL/net1.crl0GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                		unknown
                                                                                                                                                https://www.catcert.net/verarrelGlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                  		unknown
                                                                                                                                                  http://crl.securetrust.com/STCA.crlGlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                    		unknown
                                                                                                                                                    http://ocsp.pki.gva.esTGlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                      		unknown
                                                                                                                                                      http://www.disig.sk/ca0fGlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                        		unknown
                                                                                                                                                        https://api-eu-north-1.protect.glasswire.com/agent-api/v1/license/activatekGlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                          		unknown
                                                                                                                                                          http://www.firmaprofesional.com?GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                            		unknown
                                                                                                                                                            http://www.e-szigno.hu/RootCA.crlGlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              		unknown
                                                                                                                                                              http://www.symauth.com/rpa00GlassWireSetup.exe, 00000000.00000003.2246018078.000000000275E000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2248500311.000000000275C000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247096759.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2247599754.0000000002756000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                              • URL Reputation: safe
                                                                                                                                                              		unknown
                                                                                                                                                              http://www.sk.ee/juur/crl/0GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                		unknown
                                                                                                                                                                http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0zGlassWireSetup.exe, 00000000.00000003.2211012822.0000000002B5A000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253903688.0000000002753000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2253359318.0000000002756000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2218822316.000000000275B000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2263010670.0000000002750000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2217905186.0000000002754000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2223516885.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2222713240.000000000275D000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2219603181.000000000275E000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                • URL Reputation: safe
                                                                                                                                                                		unknown
                                                                                                                                                                http://crl.chambersign.org/chambersignroot.crl0GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                  		unknown
                                                                                                                                                                  http://crl.xrampsecurity.com/XGCA.crl0GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                    		unknown
                                                                                                                                                                    https://api-eu-north-1.protect.glasswire.com/endpoint-api/v1/endpoint/%s/geoip-db/downloadJZGlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                      		unknown
                                                                                                                                                                      http://www.quovadis.bm0GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                        		unknown
                                                                                                                                                                        http://cps.chambersign.org/cps/chambersroot.htmlUDwmGlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                          		unknown
                                                                                                                                                                          http://www.wellsfargo.com/certpolicyGlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                            		unknown
                                                                                                                                                                            http://ocsp.pki.gva.esGlassWireSetup.exe, GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                              		unknown
                                                                                                                                                                              http://www.trustdst.com/certificates/policy/ACES-index.html0GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                		unknown
                                                                                                                                                                                http://crl.netsolssl.com/NetworkSolutionsCertificateAuthority.crlGlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                  		unknown
                                                                                                                                                                                  http://www.firmaprofesional.com0GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                    		unknown
                                                                                                                                                                                    http://www.openssl.org/)GlassWireSetup.exe, 00000000.00000003.2241198688.0000000002756000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                      		unknown
                                                                                                                                                                                      https://api-eu-north-1.protect.glasswire.com/endpoint-api/v1/endpoint/%s/heartbeat/%sGlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                        		unknown
                                                                                                                                                                                        http://www.pkioverheid.nl/policies/root-policy-G20GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                          		unknown
                                                                                                                                                                                          https://www.netlock.net/docsGlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                            		unknown
                                                                                                                                                                                            http://www.trustcenter.de/crl/v2/tc_class_2_ca_II.crlGlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                              		unknown
                                                                                                                                                                                              http://appsyndication.org/2006/appsynvc_redist.x86.exe, VC_redist.x86.exefalse
                                                                                                                                                                                                		unknown
                                                                                                                                                                                                http://fedir.comsign.co.il/crl/ComSignCA.crl0GlassWireSetup.exe, 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000002.2564008009.00000000053F0000.00000004.00000020.00020000.00000000.sdmp, GlassWireSetup.exe, 00000000.00000003.2311642643.0000000005424000.00000004.00000020.00020000.00000000.sdmpfalse
                                                                                                                                                                                                  		unknown

                                                                                                                                                                                                  World Map of Contacted IPs

                                                                                                                                                                                                  • No. of IPs < 25%
                                                                                                                                                                                                  • 25% < No. of IPs < 50%
                                                                                                                                                                                                  • 50% < No. of IPs < 75%
                                                                                                                                                                                                  • 75% < No. of IPs

                                                                                                                                                                                                  Public IPs

                                                                                                                                                                                                  IPDomainCountryFlagASNASN NameMalicious
                                                                                                                                                                                                  18.244.164.20
                                                                                                                                                                                                  		www.glasswire.comUnited States
                                                                                                                                                                                                  		16509AMAZON-02USfalse
                                                                                                                                                                                                  13.50.186.172
                                                                                                                                                                                                  		pivot.protect.glasswire.comUnited States
                                                                                                                                                                                                  		16509AMAZON-02USfalse
                                                                                                                                                                                                  16.16.13.164
                                                                                                                                                                                                  		api-eu-north-1.protect.glasswire.comUnited States
                                                                                                                                                                                                  		unknownunknownfalse

                                                                                                                                                                                                  Private

                                                                                                                                                                                                  IP
                                                                                                                                                                                                  127.0.0.1

                                                                                                                                                                                                  General Information

                                                                                                                                                                                                  Joe Sandbox version:41.0.0 Charoite
                                                                                                                                                                                                  Analysis ID:1528306
                                                                                                                                                                                                  Start date and time:2024-10-07 18:57:51 +02:00
                                                                                                                                                                                                  Joe Sandbox product:CloudBasic
                                                                                                                                                                                                  Overall analysis duration:0h 11m 52s
                                                                                                                                                                                                  Hypervisor based Inspection enabled:false
                                                                                                                                                                                                  Report type:full
                                                                                                                                                                                                  Cookbook file name:default.jbs
                                                                                                                                                                                                  Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                                                                                                                                                                                                  Number of analysed new started processes analysed:40
                                                                                                                                                                                                  Number of new started drivers analysed:0
                                                                                                                                                                                                  Number of existing processes analysed:0
                                                                                                                                                                                                  Number of existing drivers analysed:0
                                                                                                                                                                                                  Number of injected processes analysed:0
                                                                                                                                                                                                  Technologies:
                                                                                                                                                                                                  • HCA enabled
                                                                                                                                                                                                  • EGA enabled
                                                                                                                                                                                                  • AMSI enabled
                                                                                                                                                                                                  Analysis Mode:default
                                                                                                                                                                                                  Analysis stop reason:Timeout
                                                                                                                                                                                                  Sample name:GlassWireSetup.exe
                                                                                                                                                                                                  Detection:SUS
                                                                                                                                                                                                  Classification:sus34.evad.winEXE@50/230@3/4
                                                                                                                                                                                                  EGA Information:
                                                                                                                                                                                                  • Successful, ratio: 80%
                                                                                                                                                                                                  HCA Information:
                                                                                                                                                                                                  • Successful, ratio: 92%
                                                                                                                                                                                                  • Number of executed functions: 159
                                                                                                                                                                                                  • Number of non-executed functions: 266
                                                                                                                                                                                                  Cookbook Comments:
                                                                                                                                                                                                  • Found application associated with file extension: .exe

                                                                                                                                                                                                  Warnings

                                                                                                                                                                                                  • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                                                                                                                                                                                                  • Excluded IPs from analysis (whitelisted): 184.28.90.27
                                                                                                                                                                                                  • Excluded domains from analysis (whitelisted): fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, e16604.g.akamaiedge.net, ctldl.windowsupdate.com, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, dns.msftncsi.com, fe3cr.delivery.mp.microsoft.com
                                                                                                                                                                                                  • Execution Graph export aborted for target GWInstSt.exe, PID 7728 because there are no executed function
                                                                                                                                                                                                  • Not all processes where analyzed, report is missing behavior information
                                                                                                                                                                                                  • Report creation exceeded maximum time and may have missing disassembly code information.
                                                                                                                                                                                                  • Report size exceeded maximum capacity and may have missing behavior information.
                                                                                                                                                                                                  • Report size exceeded maximum capacity and may have missing disassembly code.
                                                                                                                                                                                                  • Report size getting too big, too many NtCreateFile calls found.
                                                                                                                                                                                                  • Report size getting too big, too many NtEnumerateKey calls found.
                                                                                                                                                                                                  • Report size getting too big, too many NtOpenFile calls found.
                                                                                                                                                                                                  • Report size getting too big, too many NtOpenKeyEx calls found.
                                                                                                                                                                                                  • Report size getting too big, too many NtProtectVirtualMemory calls found.
                                                                                                                                                                                                  • Report size getting too big, too many NtQueryValueKey calls found.
                                                                                                                                                                                                  • Report size getting too big, too many NtSetInformationFile calls found.
                                                                                                                                                                                                  • VT rate limit hit for: GlassWireSetup.exe

                                                                                                                                                                                                  Simulations

                                                                                                                                                                                                  Behavior and APIs

                                                                                                                                                                                                  TimeTypeDescription
                                                                                                                                                                                                  12:59:02API Interceptor30x Sleep call for process: SrTasks.exe modified
                                                                                                                                                                                                  13:00:07API Interceptor1x Sleep call for process: GlassWireSetup.exe modified
                                                                                                                                                                                                  13:00:10API Interceptor1x Sleep call for process: GWCtlSrv.exe modified
                                                                                                                                                                                                  13:00:16API Interceptor399x Sleep call for process: GlassWire.exe modified
                                                                                                                                                                                                  13:00:16API Interceptor2x Sleep call for process: svchost.exe modified
                                                                                                                                                                                                  17:59:05AutostartRun: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce {8d5fdf81-7022-423f-bd8b-b513a1050ae1} "C:\ProgramData\Package Cache\{8d5fdf81-7022-423f-bd8b-b513a1050ae1}\VC_redist.x86.exe" /burn.runonce
                                                                                                                                                                                                  18:00:08AutostartRun: HKCU\Software\Microsoft\Windows\CurrentVersion\Run GlassWire "C:\Program Files (x86)\GlassWire\glasswire.exe" -hide
                                                                                                                                                                                                  18:00:17AutostartRun: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run GlassWire "C:\Program Files (x86)\GlassWire\glasswire.exe" -hide

                                                                                                                                                                                                  Joe Sandbox View / Context

                                                                                                                                                                                                  IPs

                                                                                                                                                                                                  ⊘No context

                                                                                                                                                                                                  Domains

                                                                                                                                                                                                  ⊘No context

                                                                                                                                                                                                  ASNs

                                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                  AMAZON-02USContract_Agreement_Monday October 2024.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  • 205.201.46.12
                                                                                                                                                                                                  DocuSign-Docx.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  • 3.161.82.108
                                                                                                                                                                                                  https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                  • 18.239.18.92
                                                                                                                                                                                                  https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.htr.gtdzwq?v=frudxdxrtxfilfrjx.htrd.iwtlt___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpjOGJiNWZiM2U4NjZhMDk1M2Y0MGVjY2U1MDhmYjQ4YTo3OmM4Y2I6MDdlZDdhNDI4N2UyMzc1NGJjZGQ1YjkyOWYyODg2OTI5ZDkyNzU0YTQ2NWI4MzhkYWZlMmM3NjA5ZGMyZGNmMzpoOlQ6VA#YnJhbmRvbi53YW5nQGludGVncmFjb25uZWN0LmNvbQ==Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                  • 108.138.7.80
                                                                                                                                                                                                  na.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  • 3.138.214.206
                                                                                                                                                                                                  https://future.nhs.ukGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  • 13.224.245.61
                                                                                                                                                                                                  na.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  • 54.247.62.1
                                                                                                                                                                                                  https://eu.pbe.encryption.symantec.com/login.html?msgUserId=682e23d9f715c97c&enterprise=lgas&locale=en_USGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  • 3.11.184.196
                                                                                                                                                                                                  na.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  • 54.171.230.55
                                                                                                                                                                                                  4zeGOaTirn.exeGet hashmaliciousNjratBrowse
                                                                                                                                                                                                  • 18.153.198.123
                                                                                                                                                                                                  AMAZON-02USContract_Agreement_Monday October 2024.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  • 205.201.46.12
                                                                                                                                                                                                  DocuSign-Docx.pdfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  • 3.161.82.108
                                                                                                                                                                                                  https://email.oxblue.com/e3t/Ctc/Q+113/cdDrv04/VXdfjN46m5dxW4GJlKB4fd0DdW2sbCLr5lTFq6N7Hm8xT3qgyTW7Y8-PT6lZ3lzW1ccS1H8Y8rzXW1hrlTV77h1NhW5_pVzH8bsnn6W1PWxqV8D5TN_W4_z5yx2Cz_4sMrZF-GqDHzcW8pZQ3N3BhYgKW3tmwg72n4TxDW4fS46V1-s7dgW57YVF64HfrMMW2BxxC75X21XdW1nBYw_1PMVGyW8s_YKQ6BTQZmW8wDJ4k3-yNbbW2_BGfy66mfVdW937hqt5kq1CcW4XD3mN54BQSWW4G8TK98NTx7zW74frv25zlZbQW5ztJ6n6fGJFrMSqBjr36qwYW2tk9Xh21wMKrW5RXwDq1M2mmrW3nyq_P20wBvNN8-tVH1nqcD1W5m3Vz04sj9CQf2ygfDq04Get hashmaliciousUnknownBrowse
                                                                                                                                                                                                  • 18.239.18.92
                                                                                                                                                                                                  https://url.avanan.click/v2/r01/___https://www.tiktok.com/qnspdA7?fni=6cbb&qfsl=js&xhjsj=gnt_zwq&yfwljy=myyux:ddBBB.lttlqj.htr.gtdzwq?v=frudxdxrtxfilfrjx.htrd.iwtlt___.YXAzOnNvdXRoZXJua2l0Y2hlbmFuZGdyaWxsOmE6bzpjOGJiNWZiM2U4NjZhMDk1M2Y0MGVjY2U1MDhmYjQ4YTo3OmM4Y2I6MDdlZDdhNDI4N2UyMzc1NGJjZGQ1YjkyOWYyODg2OTI5ZDkyNzU0YTQ2NWI4MzhkYWZlMmM3NjA5ZGMyZGNmMzpoOlQ6VA#YnJhbmRvbi53YW5nQGludGVncmFjb25uZWN0LmNvbQ==Get hashmaliciousHTMLPhisherBrowse
                                                                                                                                                                                                  • 108.138.7.80
                                                                                                                                                                                                  na.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  • 3.138.214.206
                                                                                                                                                                                                  https://future.nhs.ukGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  • 13.224.245.61
                                                                                                                                                                                                  na.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  • 54.247.62.1
                                                                                                                                                                                                  https://eu.pbe.encryption.symantec.com/login.html?msgUserId=682e23d9f715c97c&enterprise=lgas&locale=en_USGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  • 3.11.184.196
                                                                                                                                                                                                  na.elfGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  • 54.171.230.55
                                                                                                                                                                                                  4zeGOaTirn.exeGet hashmaliciousNjratBrowse
                                                                                                                                                                                                  • 18.153.198.123

                                                                                                                                                                                                  JA3 Fingerprints

                                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                  37f463bf4616ecd445d4a1937da06e19SecuriteInfo.com.Win64.TrojanX-gen.22573.8055.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  • 18.244.164.20
                                                                                                                                                                                                  down.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  • 18.244.164.20
                                                                                                                                                                                                  jre-6-windows-i586.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  • 18.244.164.20
                                                                                                                                                                                                  transferencia.exeGet hashmaliciousFormBook, GuLoaderBrowse
                                                                                                                                                                                                  • 18.244.164.20
                                                                                                                                                                                                  SM-0230- J - TOOL 10 DEGREE FOR DWT MACHINE-MF5i.exeGet hashmaliciousGuLoader, Snake KeyloggerBrowse
                                                                                                                                                                                                  • 18.244.164.20
                                                                                                                                                                                                  t5985gRtZo.lnkGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  • 18.244.164.20
                                                                                                                                                                                                  ZAMOWIEN.EXE.exeGet hashmaliciousAgentTesla, GuLoaderBrowse
                                                                                                                                                                                                  • 18.244.164.20
                                                                                                                                                                                                  0urFbKxdvL.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                  • 18.244.164.20
                                                                                                                                                                                                  zncaKWwEdq.exeGet hashmaliciousVidarBrowse
                                                                                                                                                                                                  • 18.244.164.20
                                                                                                                                                                                                  file.exeGet hashmaliciousClipboard Hijacker, Stealc, VidarBrowse
                                                                                                                                                                                                  • 18.244.164.20

                                                                                                                                                                                                  Dropped Files

                                                                                                                                                                                                  MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                                                                                                                                  3bd8c6.rbf (copy)00#U2800.exeGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                    file.exeGet hashmaliciousLummaC StealerBrowse
                                                                                                                                                                                                      file.exeGet hashmaliciousLummaC, Clipboard Hijacker, Cryptbot, LummaC StealerBrowse
                                                                                                                                                                                                        file.exeGet hashmaliciousLummaC, Cryptbot, LummaC StealerBrowse
                                                                                                                                                                                                          get wifi info temp.exeGet hashmaliciousBabuk, TrojanRansomBrowse
                                                                                                                                                                                                            system.exeGet hashmaliciousGhostRat, NitolBrowse
                                                                                                                                                                                                              abc.exeGet hashmaliciousGhostRat, NitolBrowse
                                                                                                                                                                                                                TS-240531-UF1-Creal.exeGet hashmaliciousPython Stealer, Creal StealerBrowse
                                                                                                                                                                                                                  Microsoft_Teams_SC.ba#.batGet hashmaliciousUnknownBrowse
                                                                                                                                                                                                                    System.exeGet hashmaliciousUnknownBrowse

                                                                                                                                                                                                                      Created / dropped Files

                                                                                                                                                                                                                      3bd8c0.rbf (copy)

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):148864
                                                                                                                                                                                                                      Entropy (8bit):6.623619304977769
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:bCgW5wW7E0JJbNRiQJ/dtSoxV6dzHacl9IzscYPG/jGt+:yuUVBxVS6cLS3/jGt
                                                                                                                                                                                                                      MD5:1B4F15CC7C242E15E2042B7AB60F0A60
                                                                                                                                                                                                                      SHA1:66A8347A980C62A9F6EFEC559D1ACF80C082E43E
                                                                                                                                                                                                                      SHA-256:E848D39DA54B1816644F8DE1F620E6633E6BCA2B2A9F937A6FBCB246D841E211
                                                                                                                                                                                                                      SHA-512:FC6477AED270A2D7EB7C12D4A289B0B764CE1F36457999FFC7ADC3E13587133985BC6168A60F431D8F96E5998D50C45756CFB3ADEBA291A3B1D144829129E9B4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............L..L..L...M..L...M...L...M...L..M...L..M..L..M..L0.M..L..L...L..M..L..M..L..vL..L..M..LRich..L........PE..L....~.a.........."!.........L......0........................................p............@.................................X!..(....0..............."...#...P..`...po..8............................o..@............ ..T............................text...E........................... ..`.data...(...........................@....idata....... ......................@..@.rsrc........0......................@..@.reloc..`....P......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      3bd8c5.rbf (copy)

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4827528
                                                                                                                                                                                                                      Entropy (8bit):7.034823816178361
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:98304:TijXcKQ6Mp4MFQ7956Xk00ChS9M4qZTd159S2ygpdhCV/FLOAkGkzdnEVomFHKn2:O7cKJsFQ7EAklLZT5c2ygpdhChFLOyom
                                                                                                                                                                                                                      MD5:DE1DBEBFBEAD286054F0D9921D2AB59C
                                                                                                                                                                                                                      SHA1:CBC3133813FF3003CDFAA5FAE5A03877BF2C3940
                                                                                                                                                                                                                      SHA-256:CDE83F3B384C3AF0C3E929D56A027B2C1DDEEE05CD6E14002861DE943B76461F
                                                                                                                                                                                                                      SHA-512:14F0A023EB7B22E293FF8F83E43195F037B18942DABC088F7A3ACCB5657421C05C85C95770BCD84E5869822FC2C7F05CC6B4B88D7D0A01D0D5A701C73BD276AC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........'..vt..vt..vti.su..vti.qu..vti.ru..vt...t..vt.wu..vt.ru..vt.uu..vti.wu..vt..wt..vt.su..vt..u..vt.vu..vt..t..vt.tu..vtRich..vt................PE..L....~.a.........."!.....R/..l.......*......p/...............................J.......I...@A.........................~.......]0.......0...............I..#...`F.....l@..8...........................@4..@............P0......p.......................text....P/......R/................. ..`.data........p/......V/.............@....idata...T...P0..V..../.............@..@.didat........0......N0.............@....rsrc.........0......R0.............@..@.reloc.......`F.......E.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                      3bd8c6.rbf (copy)

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5127088
                                                                                                                                                                                                                      Entropy (8bit):6.861766335751532
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:98304:bJZczGW8ke6KllNHsyBqGeQVrrNW2XkGMWrGFLOAkGkzdnEVomFHKnPUUdMG:XczGRGKLBZ/YGkGMWKFLOyomFHKnPr1
                                                                                                                                                                                                                      MD5:E76B52D11DB435D36453D26C8B446A8F
                                                                                                                                                                                                                      SHA1:6E20C17ED973E38D4A3F26CFC020AF05FF9A6EEA
                                                                                                                                                                                                                      SHA-256:E422C9366A53536A35E307EF301F08661C28C29B7FCDA1B454333C6A41C6BB21
                                                                                                                                                                                                                      SHA-512:486BE0145D5E439D3D9F5191A4A49EA3685619796557CD7A361117C25A279EE7B94A9FF70C4D73ADBE839A6CE508AB15692DDD8FD6EABC3DBEF18B68D6B0C67F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Joe Sandbox View:
                                                                                                                                                                                                                      • Filename: 00#U2800.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: file.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: get wifi info temp.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: system.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: abc.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: TS-240531-UF1-Creal.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: Microsoft_Teams_SC.ba#.bat, Detection: malicious, Browse
                                                                                                                                                                                                                      • Filename: System.exe, Detection: malicious, Browse
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8'..Vt..Vt..VtI.Su..VtI.Qu..VtI.Ru..Vt...t..Vt..Wu..Vt..Ru..Vt..Uu..VtI.Wu..Vt..WtX.Vt..Su..Vt.._u7.Vt..Vu..Vt...t..Vt..Tu..VtRich..Vt................PE..L......a.........."!......3..r......`L......../..............................`N.....M.N...@A............................L.....4...... 5...............N..'....J.|...p.3.8............................a..@.............4.......3......................text.....3.......3................. ..`.data...H.....3.......3.............@....idata..DS....4..T....4.............@..@.didat........5.......4.............@....rsrc........ 5.......4.............@..@.reloc..|.....J......tJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                      3bd8c7.rbf (copy)

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):75144
                                                                                                                                                                                                                      Entropy (8bit):6.3113139700554575
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:FVkyQTCvV3XRVd4Sb30CMhqMQC2OX1y3BVO5nc/lcwsZGqlyQI3nP20c9LHAiIsy:9QsVn3b3bMhqMXk/SwsZGHpclr7gph
                                                                                                                                                                                                                      MD5:F6ECEEFE01D0049C8AF1462B61B09FB5
                                                                                                                                                                                                                      SHA1:A91F0643EDA6EDF26AEA79E40262485D30673453
                                                                                                                                                                                                                      SHA-256:C833B4835B4364E9F285778023C16FC17258F4FA79201F89A9D85705AC79AFC6
                                                                                                                                                                                                                      SHA-512:7588137A670ADB0642EC4C66152F05EA0860B2056B726CA12D0C37899C65AC499DC3BF11BD76B6705B217E96C355D6486F0C1F407AA816685836B5935208B58D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........U............Q........,............................,.....Q..............................@............Rich............................PE..L....~.a.........."!.....@..........MN.......P...............................0......7.....@.........................`....... ............................#... ..L...lU..8............................T..@............P..(............R..H............text....>.......@.................. ..`.rdata..T....P.......D..............@..@.data...............................@....rsrc...............................@..@.reloc..L.... ......................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      3bd8c8.rbf (copy)

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):75144
                                                                                                                                                                                                                      Entropy (8bit):6.31364801660595
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:GDCAxICoV3XRI5MSNe+TgFCnzPA93BVO5n4nfOwsZGwlyQM7busGttL+ae3uEOVW:OxMVnaNtTgQAxnGwsZGdxIseEXH
                                                                                                                                                                                                                      MD5:48EB0B4031C5E12E267091A0B7A744B5
                                                                                                                                                                                                                      SHA1:19ADE2F28D14257667AC37CBB5DBF65851FA825F
                                                                                                                                                                                                                      SHA-256:B1C4C7265E13B256265DE07DAA92BC6B33A9EEE667B5696781C9D7C1C427DFF1
                                                                                                                                                                                                                      SHA-512:AE9E7EC5699DF35ADC6163C5427C5B03EDB859E623088A91DF748565693E7A82756A6500C5B4D07AD31B2852275414F12F00E84ABC9DD120E133BDE8CA3B313D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........U............Q........,............................,.....Q..............................@............Rich............................PE..L....~.a.........."!.....@..........MN.......P...............................0......_~....@.........................`....... ............................#... ..L...lU..8............................T..@............P..(............R..H............text....>.......@.................. ..`.rdata..T....P.......D..............@..@.data...............................@....rsrc...............................@..@.reloc..L.... ......................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Config.Msi\3bd8bf.rbs

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18878
                                                                                                                                                                                                                      Entropy (8bit):5.4661690917236205
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:Pyzyg63FaQbI93JdA1rZHqAeKzbR7/xRweJEQYfrxvqdIWDrxvqdIWg8nlE/vrTn:PxqQ6U1UXiz
                                                                                                                                                                                                                      MD5:1B171E552555B3DF5B6C2B62B0748C9D
                                                                                                                                                                                                                      SHA1:90CDE65FEE61DF40376CDD02AFE3DF956511A9AA
                                                                                                                                                                                                                      SHA-256:4D41FD0D02A612381218F0B03206C8DE32E621B2722E6B6F0892FCF5C7603B9D
                                                                                                                                                                                                                      SHA-512:FBC705B01242A1409718E88F811727A000368EA3582557D60E3B961F32BB2C6E294A739785069C39A860414244354E20A5D8759AD7761C4D579FC2EC4782B1B9
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:...@IXOS.@.....@bgGY.@.....@.....@.....@.....@.....@......&.{1679EF65-55F3-4248-B91E-6B3BE1A69CDF};.Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.29.30139..vc_runtimeMinimum_x86.msi.@.....@.u...@.....@........&.{C903B036-1F58-4F43-8CA4-2797FED0F6CC}.....@.....@.....@.....@.......@.....@.....@.......@....;.Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.29.30139......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E3819B64-3C56-3DD7-921D-00B011AD31DE}&.{1679EF65-55F3-4248-B91E-6B3BE1A69CDF}.@......&.{E8E39D3B-4F35-36D8-B892-4B28336FE041}&.{1679EF65-55F3-4248-B91E-6B3BE1A69CDF}.@......&.{A2AA960C-FD3C-3A6D-BD6F-14933011AFB3}&.{1679EF65-55F3-4248-B91E-6B3BE1A69CDF}.@......&.{A2E7203F-60C2-3D7E-8A46-DB3D381A2CE6}&.{1679EF65-55F3-4248-B91E-6B3BE1A69CDF}.@......&.{BC0399EF-5E9D-3C7C-BFF5-5E9A95C96DAF}&.{1679EF65-55F3-4248-B91E-6B3BE1A69CDF}.@......&.{763CEC2D-A166-4806-9E55-7D0676C9B2C2}&

                                                                                                                                                                                                                      C:\Config.Msi\3bd8c4.rbs

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:modified
                                                                                                                                                                                                                      Size (bytes):20971
                                                                                                                                                                                                                      Entropy (8bit):5.3419991505301665
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:YoY9vi2m0Ve2SD4QsBRgOtRweJcOqfrdIMrd5kQP4WfLsyEhx5S9hP2lpsb:You7m0Ve2SD4QsBRgOQrFr0mFQjS9T
                                                                                                                                                                                                                      MD5:F3AD559D097D711DCAAE64F7FA0D44FC
                                                                                                                                                                                                                      SHA1:93E376528246E7DF9B00297EF99ED5783406A090
                                                                                                                                                                                                                      SHA-256:F4E8A5655285034E5B49DA495A38594E000C47C65FB5AE46658F7A5F37967B02
                                                                                                                                                                                                                      SHA-512:15872C5446C132C7B35243342BCF0C8940E1616F53D14AD46CEF755B0BF54A5F77429B98811F575FA69E8214A074A0862E0CEBCA2BE08621EA05F98145165AD4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:...@IXOS.@.....@cgGY.@.....@.....@.....@.....@.....@......&.{1AEA8854-7597-4CD3-948F-8DE364D94E07}>.Microsoft Visual C++ 2019 X86 Additional Runtime - 14.29.30139..vc_runtimeAdditional_x86.msi.@.....@.u...@.....@........&.{02910D02-C4AB-4DC8-8CDC-AD5C0F55DDF0}.....@.....@.....@.....@.......@.....@.....@.......@....>.Microsoft Visual C++ 2019 X86 Additional Runtime - 14.29.30139......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{E3819B64-3C56-3DD7-921D-00B011AD31DE}&.{1AEA8854-7597-4CD3-948F-8DE364D94E07}.@......&.{4FD4AB8C-C57F-3782-9230-9CCA22153AD3}&.{1AEA8854-7597-4CD3-948F-8DE364D94E07}.@......&.{46A1EA6B-3D81-3399-8991-127F7F7AE76A}&.{1AEA8854-7597-4CD3-948F-8DE364D94E07}.@......&.{C94DDE19-CC70-3B9A-A6AF-5CA7340B9B9A}&.{1AEA8854-7597-4CD3-948F-8DE364D94E07}.@......&.{946D6FA6-49BB-3415-AD2D-4D634C432CF0}&.{1AEA8854-7597-4CD3-948F-8DE364D94E07}.@......&.{E533B148-A83A-3788-A763-0C6C4

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\GWCtlSrv.exe

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):8850560
                                                                                                                                                                                                                      Entropy (8bit):7.9825372144653155
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:196608:73HGhrVeY1K07QajnpuRkZvw3WhX70r0yBue23pTQjq:LsrVeo7/LERCeWh322Z
                                                                                                                                                                                                                      MD5:56D6DB5EA2E8EF737A0CF9C808B8D533
                                                                                                                                                                                                                      SHA1:659A719EBB08B5D20C12EAC3439EF0F6ECD9CC54
                                                                                                                                                                                                                      SHA-256:C456879C6929E73D7E7AFA8DEACA7C6204BFBFA374CD886F61E1C6516594DC77
                                                                                                                                                                                                                      SHA-512:3AEB1D4A4A6EBDAA0E4BDF6DC757B4773C2720BBE7C12D8ABF02BBBF64F103ED3603717A116CCE467071ECAE4FB45FB5E3EECEAC99A5D8F89C9D32195F9A86DD
                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.......`Q.$0..$0..$0..-H3.20..B_].#0..vE..(0..vE..+0..vE.."0...l].&0..oH..&0..oH..%0..$0..30...E...3...E..'0..vE...0..oH..<0..$0..w3...E..W2...E..%0...E_.%0..$07.%0...E..%0..Rich$0..........PE..L...d.f......................I.....X.y...... ....@.................................H.....@...........................'......'.......'................p.............'.8...................H.'.................................`................... Q........dA................. ..` J.,.. .......jA.............@..@ .`...........:O.............@... ....`.......FP.............@..@ y............NP.............@... (........t...TP.............@..@ +.............Q.............@... ..............Q.............@..@ ..............Q.............@..@ 9t.......j....Q.............@..B.debug........'......:V.............@..@

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\GWEventLog.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4555912
                                                                                                                                                                                                                      Entropy (8bit):7.974880583651749
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:98304:0RScBYvTsXuzlAoBiRuZXthvpAcoqtnBz0Re7Pzgk:FcBYBzlADQXthvTo8xt
                                                                                                                                                                                                                      MD5:8D2B6AB034DD0AFCAFAA4FB49C70F26A
                                                                                                                                                                                                                      SHA1:55876776D480095BFFE0BA9C839E7C09643A703A
                                                                                                                                                                                                                      SHA-256:15A886D8CE798D9E1FE55B19462D2C85C32D93A2BA87A7878E2ACFB07FF4E793
                                                                                                                                                                                                                      SHA-512:B36BA31383B35CE7A2BA36BD8536C1A8DA45CC3CF99D1CFBDF92EC1B49A6159F9A6AC2C33DE543FB696B3C0A7353C5CED7F37605EECD4759A696A0DAF856D935
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........,.[.M...M...M...5_..M...8...M...8...M...8...M....1..M...5...M...8...O...M...M...8...M...M..CL...8...M...8...M...83..M...M[..M...8...M..Rich.M..........................PE..L.....f...........!......E.........X........ E.............................. ........E...@..........................@W.....,SW.H.... T..M...........VE.x............0W.8...................HbW...............................S.@................... ..E......................... ..` Y.... E..V..................@..@ {.....R.."...L..............@... .L....S......n..............@..@ f.....S......r..............@... +.....T......t..............@... ......T......v..............@..@.rsrc....M... T..N...x..............@..@ |....pT.....................@..B.debug.......0W......J..............@..@.edata.......@W......L..............@..@.idata.......PW.

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\GWIdlMon.exe

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5426304
                                                                                                                                                                                                                      Entropy (8bit):7.977630235999512
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:98304:oRnjKm2kriL9wbKMNLzbfC1SSNf4HL7NJctOZ9MjVMAoqRLYTx+HxQdpmj:ol2lLF42f2NJgNqAIIHx4pmj
                                                                                                                                                                                                                      MD5:1C41B1C31717490B13B721A92F8D4888
                                                                                                                                                                                                                      SHA1:6095A5E5F448586FC8A10F0C1D8A71217AFDC80E
                                                                                                                                                                                                                      SHA-256:52E94630D854AB674FEC8E2551E79004DD0A8B78CAE75928BFBABD105EDE9E8E
                                                                                                                                                                                                                      SHA-512:7F8C62054D2B9D5A29AB256948B974B0F87528FE827EE434FE16052990BCDCF3FF23B96773E9CF77E6BAC4EF8694CB27C6F5BB7124558517288398DE84E7D71E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......I.lf...5...5...5...5...5_..4...5_..4...5_..4%..5_..4...5<..5...5F..4...5F..4...5...5...5..4...5F..4...5...5...5..4...5..5...5...5...5..4...5Rich...5........................PE..L...m.f..................d.........X.........e...@..................................}S...@.................................Y.........................R.p...............8...................H....................................................... 9.d......................... ..` S.....e.....................@..@ .....x..B....$.............@... .Z....z.......%.............@..@ .....pz.......%.............@..@ +.....{.......%.............@... ......{.......%.............@..@ ......{.......%.............@..@ ......{.......%.............@..B.debug................'.............@..@.idata................'.............@....tls....

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\GWUnlock.exe

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4263544
                                                                                                                                                                                                                      Entropy (8bit):7.952472311436876
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:98304:ivDH49vNduhs9GT5z6UWLJSKyPItMPznqStp3pq+:iLEjuhs9GVzBoJJbsLbHpX
                                                                                                                                                                                                                      MD5:49288DC3FAB1E8DCE5EF7CB57228F7F8
                                                                                                                                                                                                                      SHA1:30FBC4E83B5B4D5A2825E992EF5CBC586921F0B8
                                                                                                                                                                                                                      SHA-256:B4250113C8B9D39680A89C1083AEED625D2B97E701E25D1DBF69A7161B955049
                                                                                                                                                                                                                      SHA-512:8BC0D5F87F84E81186F5827346CE07C7A67283DEDB87ACAEFD9797948C1AA8186E8C648536921996C16B576C1D6491411CD94DE2AD1D7768C839932B5F6CF3A4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............a..a..a...\..a.....a.....a.....a.....a.....a..a..`.....c..a..a.....a...0..a..aX..a.....a.Rich.a.........................PE..L.....f.................(*..T......X.|......@*...@..................................B...@.................................8.8.H.....9...............@.x.............8.8........................................................................... a&*......................... ..` .U...@*..n..................@..@ tP....3......x..............@... OF....4.....................@..@ .C...P4.."..................@..@ ......4.....................@..@ .u....4.....................@..@ ....07.....................@..B.debug........8.....................@..@.idata........8.....................@....rsrc.........9.....................@..@.themida..A...;.................

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\GWUpgradeMonitor.exe

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7737984
                                                                                                                                                                                                                      Entropy (8bit):7.978346550584956
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:98304:iKvdmipVf/SFxJ1lFtw92HfWdRgPEuQqWrmYCDRnacuKIcHMoZigl3SbGYc24j:iK/fqNDvHfAzqQm53IdoZiES9cfj
                                                                                                                                                                                                                      MD5:9274E67B4143277D3299BD509D718543
                                                                                                                                                                                                                      SHA1:9FAE7C1847D23BE8B5EA0EE643B5CD5BADDFD366
                                                                                                                                                                                                                      SHA-256:4273973F7037A79318F163E9620AAB9FE60C918158464E924A80710CF390578D
                                                                                                                                                                                                                      SHA-512:E16C67C07D5C01BFB6F8E6B36E7A7DF0B74C704E1A3D65A53D0DA900BEA429387B8549AF5CB6BD9549DC278153F8D823F119CDA8A01D6BFA13AEAD67430A56FE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                      Preview:MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$......................<.....R.............................R......................M......M.........S...................P.....8...........Rich...................PE..L.....f.....................>N.....X`$...... ....@.......................... V.......v...@.............................o...Y.........................u.p.....V.........8...................8....................................................... "........Z&................. ..` ..?.. .......`&.............@..@ q........j...8=.............@... .l............=.............@..@ ..............=.............@..@ .....p.......n>.............@..@ .............p>.............@... .............r>.............@..@ .u...........t>.............@..@ ..... .......Z?.............@..B.debug................B.............@..@

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\GlassWire.exe

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):12010624
                                                                                                                                                                                                                      Entropy (8bit):7.973232481017457
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:196608:RJH26uwJh47gKSaInZpx5XB5dxtRYIfiHXm+79DwLAYyA7jGpoPoiJjTAI8J+:RJXuwH47g4IJJfd7hkmE2nwilX8J+
                                                                                                                                                                                                                      MD5:E4ADF42227B3BADFCD239669363B4BDF
                                                                                                                                                                                                                      SHA1:72B803820DF55717A235BFFF1E8FA5FA6D63F112
                                                                                                                                                                                                                      SHA-256:F905A4E2AD512354492E558CDC69C9F7A0470CE7FEE4C24A590FC35CA526DC0E
                                                                                                                                                                                                                      SHA-512:7415540C22DDF59DC61853DC8E8ED2ACB82B35571CAE952FACEF4949F8FE4C557CB2E8C89A35999B848BCD357081A5470CC81E61DFE6706B2BB8ECA51D0AEA16
                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$........o2.H.\.H.\.H.\.Av..^.\..a..O.\..{X.D.\..{_.X.\..{Y.b.\..{].N.\.yR..J.\..vX.@.\.H.\._.\.{X.<.\..~Y.O.\..~].B.\.H.].U.\..v].Q.\.{Y...\.{\.I.\.{..I.\.H...I.\.{^.I.\.RichH.\.................PE..L.....f.....................:......X.............@......................................@...........................P.h...\.P.|.....P.................p.............P.8...................8.P..................................................... y.........<................. ..` .zi.......(...<.............@..@ H[...p3.......d.............@... As....:.."....e.............@..@ .h...P>..N....e.............@..@ ......A.......g.............@..@ ......A.......g.............@... ......A.......g.............@..@ .u....A.......g.............@..@ 2....pD.......g.............@..B.debug........P.......m.........

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\Qt5Core.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5386360
                                                                                                                                                                                                                      Entropy (8bit):6.853835454158601
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:49152:A1AH+7g4QrRpvOK8Bbl+Gy+/LZsxRFNHlZTlJsv6tWKFdu9C/cPk4VHEYI9CV4eF:e5gje5lCjzJsv6tWKFdu9CtvDhgwc
                                                                                                                                                                                                                      MD5:BB510A3CE829CEC42308491865DC93F4
                                                                                                                                                                                                                      SHA1:BD2373C567F829C1B9C774E57C131201AB0F72CF
                                                                                                                                                                                                                      SHA-256:2A0C380D3586217A4D19336441A0FACA434B934332813D65AEABF115481D0B43
                                                                                                                                                                                                                      SHA-512:E57CE099C982FB2AD9999592442C323A337AC71EAECBA7F3F3DA10B5ADAC981D7EF1278CB31DA87695EA40CA8702D7C062A814255E125F6CAAD7FA74AFD865F2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$........S.G.2k..2k..2k..J...2k.p]j..2k.%....2k.p]n..2k.p]o..2k.p]h..2k..Yo..2k..Ym..2k..Yj..2k..2j..3k.=Bo..2k.=Bn.D2k.=Bk..2k.=B...2k..2...2k.=Bi..2k.Rich.2k.........................PE..L...&._...........!......(...).....>x&.......(....g.........................pR.......R...@.........................P D.P....=K.......P...............R.x.....P..|.. .A.T...................0.A.....x.A.@.............(..............................text...W.(.......(................. ..`.rdata..n."...(..."...(.............@..@.data........`K..J...FK.............@....qtmimed......K.......K.............@..P.rsrc.........P......~P.............@..@.reloc...|....P..~....P.............@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\Qt5Gui.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5898864
                                                                                                                                                                                                                      Entropy (8bit):6.783738187501369
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:49152:EKUDGaBVW3sDAPNaiCZPcSnt8KQ6oOtA/tiG7WwjrAxLXwQ98vd+hc0WM66fL5cC:3UKssPdOy/tZWnXThVc5tnB6NDrv
                                                                                                                                                                                                                      MD5:010338F1C914C2174E677071BD868112
                                                                                                                                                                                                                      SHA1:9B672BC33C6CF18975E1638F16DCC6E0728053DD
                                                                                                                                                                                                                      SHA-256:35D59C57603A9DBA8910A720DA78FC241F412C4255E93ADA72B61E9D5010B7D0
                                                                                                                                                                                                                      SHA-512:8151CC41527C9EC231FA9DE5236691910209040FADCB0A0501773157A070F7FBE86D5DABDDBAEA5C8BE47B16C520BC36A61F7A3786B0BB99FFA529B254B526F0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......hd.d,.q7,.q7,.q7%}.7:.q7.ju6&.q7.jr6 .q7.jt65.q7.jp6(.q7.up6..q78nt6-.q78np6!.q7,.p7G.q7.uu6<.q7.ut6E.q7.uq6-.q7.u.7-.q7,..7-.q7.us6-.q7Rich,.q7........................PE..L....._...........!.....V6...#......L6......p6..............................pZ.......Z...@..........................%=.0"...GV.h....0X...............Y.p....@X.l!....<.T.....................<.......<.@............p6.|............................text...zT6......V6................. ..`.rdata.... ..p6... ..Z6.............@..@.data...,....@W...... W.............@....rsrc........0X.......W.............@..@.reloc..l!...@X.."....W.............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\Qt5OpenGL.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):275576
                                                                                                                                                                                                                      Entropy (8bit):6.746326294898082
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:vyzfysU2y35sez4ScaXIivFS2JTnll0iEZA+IWlJl0BVQ7DCK/e84tGmaBkEGbCg:UU2Xe2aXIuo2Jzll0y+y/x37
                                                                                                                                                                                                                      MD5:0C857879FFFA66B09529CB83AD785293
                                                                                                                                                                                                                      SHA1:29D12D3DE1BF2E7CC074F1A41B781812A8AECE58
                                                                                                                                                                                                                      SHA-256:CECC7D29C6696E87AFC668BFE1666F77B1C7090B73A29DDC9336A5CA39C9EBF0
                                                                                                                                                                                                                      SHA-512:4259D5AF3C3D92D1AA3DE15BA8AFC928820778FEEB473CBE0C3C7722A1C74F7D3D1BC77B5C9EC8BD61021A57DF991A874CB9C0532DC3C5E45D423EEF4B65CB50
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b.v.&...&...&.../..........$...2...$.......0.......,.......%......!...&..........3......'......'...&...'......'...Rich&...................PE..L....._...........!................-........ .....c.........................0............@.........................0...X....F..........................x.......l&..|...T..............................@............ ...............................text............................... ..`.rdata..r.... ......................@..@.data...............................@....rsrc...............................@..@.reloc..l&.......(..................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\Qt5Svg.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):268912
                                                                                                                                                                                                                      Entropy (8bit):6.743352322705371
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:Z1lj55OgW5ODJ+bXhE4o+K08LJw8Rk8bOvR1yGaucmSJyUIEDv8ma4y4GeO43iUS:ZbJ+bXK4o+K08ROvR8ucmSunyq7t
                                                                                                                                                                                                                      MD5:974842161C3816BA8CDA37BF84EE0495
                                                                                                                                                                                                                      SHA1:60BEFE3FF4E34C8EA892CA7F665D94876A7CBACC
                                                                                                                                                                                                                      SHA-256:4AB6C7FD3D5B495071EADB2CDFC87A25F6118A33BAA09F595BFCC441E1CA2F74
                                                                                                                                                                                                                      SHA-512:D9DB0777587B047737FC2B51E78F9E5DF379A7162E1A2FFFEE240326A7943000757D3ED486637AEC312350EB53FA5FD67D5EA1E2D5CD27720BFD7B26A16EC9E8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........r..j.o.j.o.j.o.ck..l.o..|n.h.o.~xn.h.o..|j...o..|k.`.o..|l.i.o..cn.m.o.j.n...o..cj.g.o..co.k.o..c..k.o.j...k.o..cm.k.o.Richj.o.........PE..L......_...........!.....T...........\.......p.....f......................... .......)....@.............................@}...<..........................p.......8/......T..............................@............p..\............................text...{S.......T.................. ..`.rdata..NL...p...N...X..............@..@.data...............................@....rsrc...............................@..@.reloc..8/.......0..................@..B................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\Qt5Widgets.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4464240
                                                                                                                                                                                                                      Entropy (8bit):6.835526819430574
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:49152:kpo1FNXS+dh75PMvZZNNt+iIo5uL5Sdbtye6cEu0r:yIPqZZUfwusae6ju0r
                                                                                                                                                                                                                      MD5:3EF370D667C488BED53BE70A51C8F89C
                                                                                                                                                                                                                      SHA1:7C8DE8D126D7A6A0AB73303DBB57ED2CB7D485AE
                                                                                                                                                                                                                      SHA-256:EA6341D9AE9381F248CC1DB28967E54DAFB11F59EF72FBF3AE5614C2C78BF919
                                                                                                                                                                                                                      SHA-512:666ADD3B0C7BF526715EDA5E6D03B800486160F7CA5C0DCD30646BC6AB67BD37F2A486EDCC920AEA1BA9CD2880D72994E10203136FC2510CFC57762116F0C5EE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........t..t..t...:.t..W...t..W...t..W...t..W...t.....t.....t......t..t..x......'t......t....V.t..t>.t......t..Rich.t..........PE..L....._...........!......*...........*.......+....e.........................0D.....WED...@..........................Y6..'....>.T....`A...............C.p....pA.`....o5.T....................p5......o5.@.............+../...........................text...:.*.......*................. ..`.rdata..j.....+.......*.............@..@.data....w....@..r....@.............@....rsrc........`A......4A.............@..@.reloc..`....pA......:A.............@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\Qt5WinExtras.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):207472
                                                                                                                                                                                                                      Entropy (8bit):5.83468484411917
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:t7B3LXHsaM6URaWba7e6NZtFC2Hvhductw+aZXoxtqXGeotOfi76:ttTsP6URaURQZjCcvVtw+aZXwwXfi76
                                                                                                                                                                                                                      MD5:386BA9F4726F30CD6B5D949B26B51618
                                                                                                                                                                                                                      SHA1:B8D2AB036790D1A14BE9CDDA56DD5FA7412D82DF
                                                                                                                                                                                                                      SHA-256:B540D9F1C76166A26CDAD6AD96DD9C6C2327295AD93736525D6D96568DA4AF7A
                                                                                                                                                                                                                      SHA-512:83FFCBA53D6BE98B948AFDC1E91BA594F37C6AE4CE5467C4A73A2B558F6B9EBD7B3CDE9B2A812CB8B87AC11A4225035FBACA78BDEA9C07F4B6E67EBC6D865E62
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........{..................z.......z.......z.......z.......................7...........R...7.......7.......7.............7.......Rich............................PE..L...!.._...........!................M........0...............................0.......P....@..........................X..09.............................p.......`)...N..T...........................pN..@............0...............................text...a........................... ..`.rdata......0......................@..@.data..../.......,..................@....rsrc...............................@..@.reloc..`).......*..................@..B........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\copyrights\ASIO-LICENSE_1_0.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1361
                                                                                                                                                                                                                      Entropy (8bit):5.135395644586466
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:8fT20oz6AMIot5LLxUFB93xyPvsjt99QHbsUv4fOk5T0No3SFf:QT3oz6Ec5xUb9EyQHbs5JD3SFf
                                                                                                                                                                                                                      MD5:B51058FEAD1AA71840B79527F5BFFD3D
                                                                                                                                                                                                                      SHA1:BC3C4D41D4CC7753BEA8E7A77FDB7CD384ADBB59
                                                                                                                                                                                                                      SHA-256:BEB8E42E9D6B4284E03304D05A81A0755200A965FC8D0A5E0AEA1E84CF805D6E
                                                                                                                                                                                                                      SHA-512:F1A8D21CCBB6436D289ECFAE65B9019278E40552A2383AAF6C1DFED98AFFE6E7BBF364D67597A131642B62446A0C40495E66A7EFCA7E6DFF72727C6FD3776407
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:Boost Software License - Version 1.0 - August 17th, 2003....Permission is hereby granted, free of charge, to any person or organization..obtaining a copy of the software and accompanying documentation covered by..this license (the "Software") to use, reproduce, display, distribute,..execute, and transmit the Software, and to prepare derivative works of the..Software, and to permit third-parties to whom the Software is furnished to..do so, all subject to the following:....The copyright notices in the Software and this entire statement, including..the above license grant, this restriction and the following disclaimer,..must be included in all copies of the Software, in whole or in part, and..all derivative works of the Software, unless such copies or derivative..works are solely in the form of machine-executable object code generated by..a source language processor.....THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR..IMPLIED, INCLUDING BUT NOT LIMITED TO THE WA

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\copyrights\CURL-COPYING.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1110
                                                                                                                                                                                                                      Entropy (8bit):5.166860791847204
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:JK2lr8Cb7rmq6c9QHbsUv4fOk47OXdKo3txqyoTr9DLFiw:A2lr5mteQHbs5JaOtb3txlCr93Fiw
                                                                                                                                                                                                                      MD5:750BB5F17AD3D1D2517403CA59493736
                                                                                                                                                                                                                      SHA1:7D120F1D9CD7832FE6115E118F43C77B4797AEB2
                                                                                                                                                                                                                      SHA-256:164CEA7F90E83CA8A193A82530C438BDD7E4D21C831F0DD218A8342475EA8868
                                                                                                                                                                                                                      SHA-512:41EE97B0A68A3D91EFE4261571E531D8B0368E89C1DA2BD71A2578A16B4EA50120BF514890DE7C5EE79A9BB9882E0AFBBD0F4DE102BEC80D5A22CA82098D3FC0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:COPYRIGHT AND PERMISSION NOTICE....Copyright (c) 1996 - 2021, Daniel Stenberg, <daniel@haxx.se>, and many..contributors, see the THANKS file.....All rights reserved.....Permission to use, copy, modify, and distribute this software for any purpose..with or without fee is hereby granted, provided that the above copyright..notice and this permission notice appear in all copies.....THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR..IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,..FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. IN..NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,..DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR..OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE..OR OTHER DEALINGS IN THE SOFTWARE.....Except as contained in this notice, the name of a copyright holder shall not..be used in advertising or otherwise to promote th

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\copyrights\GEOIP-LICENSE.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):11560
                                                                                                                                                                                                                      Entropy (8bit):4.476377058372447
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:qf9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8SHfH2:kOu9b01DY/rGBt+dc+aclkT8SH+
                                                                                                                                                                                                                      MD5:D273D63619C9AEAF15CDAF76422C4F87
                                                                                                                                                                                                                      SHA1:47B573E3824CD5E02A1A3AE99E2735B49E0256E4
                                                                                                                                                                                                                      SHA-256:3DDF9BE5C28FE27DAD143A5DC76EEA25222AD1DD68934A047064E56ED2FA40C5
                                                                                                                                                                                                                      SHA-512:4CC5A12BFE984C0A50BF7943E2D70A948D520EF423677C77629707AACE3A95AA378D205DE929105D644680679E70EF2449479B360AD44896B75BAFED66613272
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.. Apache License.. Version 2.0, January 2004.. http://www.apache.org/licenses/.... TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION.... 1. Definitions..... "License" shall mean the terms and conditions for use, reproduction,.. and distribution as defined by Sections 1 through 9 of this document..... "Licensor" shall mean the copyright owner or entity authorized by.. the copyright owner that is granting the License..... "Legal Entity" shall mean the union of the acting entity and all.. other entities that control, are controlled by, or are under common.. control with that entity. For the purposes of this definition,.. "control" means (i) the power, direct or indirect, to cause the.. direction or management of such entity, whether by contract or.. otherwise, or (ii) ownership of fifty percent (50%) or more of the.. outstanding shares, or

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\copyrights\GEOLITE2-COPYRIGHT.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):56
                                                                                                                                                                                                                      Entropy (8bit):4.528325405889029
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:H4RKLAWcKcDOMZsVn:YRKLAQ6Z4n
                                                                                                                                                                                                                      MD5:77EA3FD55FED2B8A62EAB6038D863690
                                                                                                                                                                                                                      SHA1:41C4B44D4AA3ECDBF343E529E31C37CE7DCD95B9
                                                                                                                                                                                                                      SHA-256:C6AB475213837355D55435FDDE4D80560A89ACCBFCD40E182DB9DFACD596BE95
                                                                                                                                                                                                                      SHA-512:5ADA6F6DD6DD017745A93958F4A22E3D1D8868398B2BE27D5556E36E7531FEE200A87CDD8C74A65AB1FACD92131196F01E125C6DF9F71DCF78D747997F160660
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:Database and Contents Copyright (c) 2022 MaxMind, Inc...

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\copyrights\GEOLITE2-LICENSE.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):401
                                                                                                                                                                                                                      Entropy (8bit):4.735627961266463
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:1tXaTRV1xS4pQnLzjTzzKFxeGLXDCbFBKlqjMW9DLMlMfvC6BP3RKwNwY63Sw+OC:1lA1x4zzsxeNB9MlYNi53A/
                                                                                                                                                                                                                      MD5:92D941D0251251E5EDAFDB90DDBF62EB
                                                                                                                                                                                                                      SHA1:E5272265D8CE1F42008688B054FE69136C697D6F
                                                                                                                                                                                                                      SHA-256:3046793C2E66249F2EFF2278768BCE628F2120A9DBD685A7775BB3CD8FD45CBD
                                                                                                                                                                                                                      SHA-512:BE4E77844DC3267BE40AD72884AACE29B49A0B73D21B12977B452DA8EEDFDAE1E9DE0CAEBF0AD25887FF9E7C884F78E68A24BDF9B250392192B0505C18CDDF07
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:Use of this MaxMind product is governed by MaxMind's GeoLite2 End User License Agreement, which can be viewed at https://www.maxmind.com/en/geolite2/eula.....This database incorporates GeoNames [https://www.geonames.org] geographical data, which is made available under the Creative Commons Attribution 4.0 License. To view a copy of this license, visit https://creativecommons.org/licenses/by/4.0/...

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\copyrights\LZ4-LICENSE.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1399
                                                                                                                                                                                                                      Entropy (8bit):5.078717264226341
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:QrX3UnZH+bOV/rYFT7+J4irYFT8LS9V943zrEfkuGKWROC3zSyxsTfy63tGPx/Z4:QrdOV/rYJPirYJ8EV943Bl3+Esm63tGI
                                                                                                                                                                                                                      MD5:383439A18467E19F0E0137A4BF93B8D6
                                                                                                                                                                                                                      SHA1:1B7E9678C01442D5F6E517BD1DDB56CFCD0429E6
                                                                                                                                                                                                                      SHA-256:7CBBC06EBCE8DF2D491DA4546CE76A8FCFEEACE1C591BF14CF16430D9D6B024F
                                                                                                                                                                                                                      SHA-512:C98A26380BF94D211E5BB94ED2A8680A08B53A2259D22854D5F66C3CF2A64E37F4EE66828D578726680E5AC435102782FB5B0BE534FE260195D00B3787466C57
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:BSD 2-Clause License (http://www.opensource.org/licenses/bsd-license.php).... Redistribution and use in source and binary forms, with or without.. modification, are permitted provided that the following conditions are.. met:.... * Redistributions of source code must retain the above copyright.. notice, this list of conditions and the following disclaimer... * Redistributions in binary form must reproduce the above.. copyright notice, this list of conditions and the following disclaimer.. in the documentation and/or other materials provided with the.. distribution..... THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.. "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT.. LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR.. A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT.. OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,.. SPECIAL, EXEMPLARY, OR CONSEQUENTI

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\copyrights\OPENSSL-LICENSE.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6246
                                                                                                                                                                                                                      Entropy (8bit):5.169925801769785
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:4itmxrs1rsy/QZ93OWZ7u2dOrsMrsSC13C3dinCY:4i2rs1rsyilHcPrsMrspdsdWCY
                                                                                                                                                                                                                      MD5:CD010DA4CF5B82714DBC32F3E05DF760
                                                                                                                                                                                                                      SHA1:C52F4AE980AF344F6C98DF74AA8117F6A2C7903C
                                                                                                                                                                                                                      SHA-256:15B8E85F410B23610E424681C010E1B2833C9805F977131713AD6F7DECF3FE90
                                                                                                                                                                                                                      SHA-512:8AA6FC03C353A83BCAB9E65D30C69B5393F1AC6C0181C0B8E357C85CC3A15C63C57D4FBC8082EB8DD539BC885B5AC2808A294ADC42A541EBDC6B06BAB5357CB1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.. LICENSE ISSUES.. ==============.... The OpenSSL toolkit stays under a double license, i.e. both the conditions of.. the OpenSSL License and the original SSLeay license apply to the toolkit... See below for the actual license texts..... OpenSSL License.. ---------------..../* ====================================================================.. * Copyright (c) 1998-2019 The OpenSSL Project. All rights reserved... *.. * Redistribution and use in source and binary forms, with or without.. * modification, are permitted provided that the following conditions.. * are met:.. *.. * 1. Redistributions of source code must retain the above copyright.. * notice, this list of conditions and the following disclaimer... *.. * 2. Redistributions in binary form must reproduce the above copyright.. * notice, this list of conditions and the following disclaimer in.. * the documentation and/or other materials provided with the.. * distribution... *.. * 3. All advertising materials

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\copyrights\PROTOBYUF-LICENSE.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1764
                                                                                                                                                                                                                      Entropy (8bit):5.1400808744788815
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:qO3rYJUrYJk1C4wD7439x3wEWmJC3t2zTHcLkC:n3rYJUrYJk1CnM3b3wQigzTot
                                                                                                                                                                                                                      MD5:CE79A5E699943B3A132C0DEBA1777AC6
                                                                                                                                                                                                                      SHA1:57919D5BF210193D05BA496A870832582F475559
                                                                                                                                                                                                                      SHA-256:F4DF8B2457697851385D9EBB93267832C1DFA24E0E61881952F6B0C452663DC9
                                                                                                                                                                                                                      SHA-512:82CDA6F61E3DFF94228D3EEFE4E1F65DC483ACA9C8597E482C1D6584D2F70AB7327AF6461080447649DC4986B9932025DBCAE5C078A2DBCCA82C3A985D118F4C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:Copyright 2008 Google Inc. All rights reserved.....Redistribution and use in source and binary forms, with or without..modification, are permitted provided that the following conditions are..met:.... * Redistributions of source code must retain the above copyright..notice, this list of conditions and the following disclaimer... * Redistributions in binary form must reproduce the above..copyright notice, this list of conditions and the following disclaimer..in the documentation and/or other materials provided with the..distribution... * Neither the name of Google Inc. nor the names of its..contributors may be used to endorse or promote products derived from..this software without specific prior written permission.....THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS.."AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT..LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR..A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL TH

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\copyrights\QT-LICENSE.GPL3-EXCEPT.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:ASCII text, with CRLF, CR line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):37771
                                                                                                                                                                                                                      Entropy (8bit):4.64776546211539
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:tGX22wnRDFL0BCg1C19KqYiN41uE/MpJPwUsPFL:tF2wQCX5biIli
                                                                                                                                                                                                                      MD5:F90A12D34097E515A5A37F8E08BF591B
                                                                                                                                                                                                                      SHA1:39510E6EB60AFE94501CF5AE544A089B15BCD414
                                                                                                                                                                                                                      SHA-256:F2B0FE8BA218F80D7F47E7A3E9268622492958490BEA964F45DB9645BDC80CEA
                                                                                                                                                                                                                      SHA-512:7B1E201B39034E8A94F346D48878E51AEA0AEFE8B1AD6E51BB51BA009DCC7FFF78ADF1F159EE3E27C87D77121206732BA8BD31B866F939013AA33FB8775B0545
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:This is the GNU General Public License version 3, annotated with The...Qt Company GPL Exception 1.0:......-------------------------------------------------------------------------......The Qt Company GPL Exception 1.0......Exception 1:......As a special exception you may create a larger work which contains the...output of this application and distribute that work under terms of your...choice, so long as the work is not otherwise derived from or based on...this application and so long as the work does not in itself generate...output that contains the output from this application in its original...or modified form.......Exception 2:......As a special exception, you have permission to combine this application...with Plugins licensed under the terms of your choice, to produce an...executable, and to copy and distribute the resulting executable under...the terms of your choice. However, the executable must be accompanied...by a prominent notice offering all users of the executable the entir

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\copyrights\QT-LICENSE.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Non-ISO extended-ASCII text, with very long lines (653), with CRLF, CR line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):46431
                                                                                                                                                                                                                      Entropy (8bit):4.646828657479362
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:44cULZiHGX22wnRDFL0BCg1C19KqYiN41uE/MpJPwUsPFVnFc6ks:tiHF2wQCX5biIlEFcvs
                                                                                                                                                                                                                      MD5:CBF8D9D1E75470109A8CF29317346EA0
                                                                                                                                                                                                                      SHA1:303C65F8BAB64340DA75BE47A132F35975FE0C09
                                                                                                                                                                                                                      SHA-256:F62335FC575C9C885D33F9FE778B1AB75879F0099D1D31E4DAE45CA56085F6C0
                                                                                                                                                                                                                      SHA-512:6C6297AAE303915A1A50965C78D6FBB6C15679701357CF3C2D605F23A58486661FFED237AA3449403CEFFDADA1B5577C2DB9040B2832F86A03C50837CFD4064F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:GENERAL...-------......Qt is available under a commercial license with various pricing models and packages that meet a variety of needs. Commercial Qt license keeps your code proprietary where only you can control and monetize on your end product.s development, user experience and distribution. You also get great perks like additional functionality, productivity enhancing tools, world-class support and a close strategic relationship with The Qt Company to make sure your product and development goals are met.......Qt has been created under the belief of open development and providing freedom and choice to developers. To support that, The Qt Company also licenses Qt under open source licenses, where most of the functionality is available under LGPLv3. It should be noted that the tools as well as some add-on components are available only under GPLv3. In order to preserve the true meaning of open development and uphold the spirit of free software, it is imperative that the rules and regula

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\copyrights\RAPIDJSON-LICENSE.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (739), with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5209
                                                                                                                                                                                                                      Entropy (8bit):5.159843054877752
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:wt8WCoIYOrYJnrYJzph/3f3z9IT32YdPs0QHnoqPsvQHnoJ:wuoHOrsnrsFh/3f3BKPQHnYQHnS
                                                                                                                                                                                                                      MD5:D411D82FF48B1B136C6B35E5AE969DB1
                                                                                                                                                                                                                      SHA1:71024CA6FB0B8D49F839021D75F02AC2E903FF1A
                                                                                                                                                                                                                      SHA-256:55972017B8F8BFFEE8922B5BE4BA582AC401A3B70B5E62A4B8FBEA56342B0500
                                                                                                                                                                                                                      SHA-512:BC943588C003F00CDA4E1388A3D37B1B2EE201ACF8BC7792531C5223192B2F3A01F7892B6AC505A3EE21C011EA0EC07AD35771807024CED5CDCF0C10BB57A778
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:Tencent is pleased to support the open source community by making RapidJSON available. .. ..Copyright (C) 2015 THL A29 Limited, a Tencent company, and Milo Yip. All rights reserved.....If you have downloaded a copy of the RapidJSON binary from Tencent, please note that the RapidJSON binary is licensed under the MIT License...If you have downloaded a copy of the RapidJSON source code from Tencent, please note that RapidJSON source code is licensed under the MIT License, except for the third-party components listed below which are subject to different license terms. Your integration of RapidJSON into your own projects may require compliance with the MIT License, as well as the other licenses applicable to the third-party components included within RapidJSON. To avoid the problematic JSON license in your own projects, it's sufficient to exclude the bin/jsonchecker/ directory, as it's the only code under the JSON license...A copy of the MIT License is included in this file.....Other depe

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\copyrights\RAPIDXML-LICENSE.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2804
                                                                                                                                                                                                                      Entropy (8bit):5.1784602494741625
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:tTTp3oz6Ec5xUb9EyQHbs5JD3SFBxdJglQEtEQH9s5XuJ3otF7:diz6d5y9EyQHEOcHiQHTor
                                                                                                                                                                                                                      MD5:D63AB70BA21CA0544B03284958324301
                                                                                                                                                                                                                      SHA1:0173E4174701724DE9B9A5B258D59066215A9FF3
                                                                                                                                                                                                                      SHA-256:794BF3B2ECF5CF0C740AC6C524D66CE6284C4B1DE1F983D21A242B8ABBEB9720
                                                                                                                                                                                                                      SHA-512:4A786544B90F6D1989E4BF7490F86B961CDE78997FFCFDBEE8D12B1F7140E7DD60BE202DCD0927237B53A3802880CE8218EC489427549F39D8BEA1818C2E24E0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:Use of this software is granted under one of the following two licenses,..to be chosen freely by the user.....1. Boost Software License - Version 1.0 - August 17th, 2003..===============================================================================....Copyright (c) 2006, 2007 Marcin Kalicinski....Permission is hereby granted, free of charge, to any person or organization..obtaining a copy of the software and accompanying documentation covered by..this license (the "Software") to use, reproduce, display, distribute,..execute, and transmit the Software, and to prepare derivative works of the..Software, and to permit third-parties to whom the Software is furnished to..do so, all subject to the following:....The copyright notices in the Software and this entire statement, including..the above license grant, this restriction and the following disclaimer,..must be included in all copies of the Software, in whole or in part, and..all derivative works of the Software, unless such copies or d

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\copyrights\RECOG-COPYING.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1317
                                                                                                                                                                                                                      Entropy (8bit):5.1794398708637726
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:l3Unemvol+bOOrmIFT0+JYrmIFTzE79B432sVvEOkDs89ROg32s3yxiTftr8A3t/:iOOrfJwrfJzkB432sVoR32s3EiP3tQHy
                                                                                                                                                                                                                      MD5:700B5F38DC8F71F96087ED0B377ECB2E
                                                                                                                                                                                                                      SHA1:FBCCF38AC693DD5CDB0EFFDE0F864ABA3F27E9D9
                                                                                                                                                                                                                      SHA-256:4B83907AD96472BC78101422F25A25FAAA8F86CEDABA242B39249EC78D37936A
                                                                                                                                                                                                                      SHA-512:32B95B85A7B93D4B4D629C90A9B5DE6C8E351A2C79ED56950785A18F512123976DD0B51D73CD80CD2B107762B4576920698CBAFCF103A56BF1FE42488595498E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:Copyright (c) 2014-2015, Rapid7..All rights reserved.....Redistribution and use in source and binary forms, with or without modification,..are permitted provided that the following conditions are met:....* Redistributions of source code must retain the above copyright notice, this.. list of conditions and the following disclaimer.....* Redistributions in binary form must reproduce the above copyright notice, this.. list of conditions and the following disclaimer in the documentation and/or.. other materials provided with the distribution.....THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND..ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED..WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE..DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR..ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES..(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITU

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\copyrights\RLOTTIE-COPYING.MIT.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (460), with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1060
                                                                                                                                                                                                                      Entropy (8bit):5.073215723692094
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:xr4JHBH0yPP3gtAJq1hp9QHcsUv48Ok4/+dbo3oqxFG:x8JplPvEDTQHcs5ITc3omFG
                                                                                                                                                                                                                      MD5:79B5353B9153841415BB4C6B13E9CC18
                                                                                                                                                                                                                      SHA1:013A03E5D4D98B9024BDD31602AB2BEE60F85F2A
                                                                                                                                                                                                                      SHA-256:712052EE3E10990539E03860460F32A5BD0862B11C7D06A4A9BFD13CC45A8BBD
                                                                                                                                                                                                                      SHA-512:3B565132CFB7E3567D864D9F11C58531110836AFFE3CE5E43AF97284F4A9E5708E71458C32ED482B90FE3CC7DD6407CD76537C23FAED878C43825524094EF959
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:Copyright 2020 (see AUTHORS)....Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:....The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.....THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\copyrights\SQLITE-COPYING.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (666), with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2307
                                                                                                                                                                                                                      Entropy (8bit):4.391070387488877
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:1R5iUEoKkrJQ4U3HdDzbYXo/MTRNsmUl61jPLVjHrn:1R5iaKeJQ4+ZbnO/ntHr
                                                                                                                                                                                                                      MD5:D835C0F72115B0207F33335E035DAC40
                                                                                                                                                                                                                      SHA1:0A14E1AD9BD75A3EA908BC03A8CA45964B6BCC90
                                                                                                                                                                                                                      SHA-256:5489C1262B400EA71C5886CB20F272B54980E2B9EADCFDAF406D808714DD6663
                                                                                                                                                                                                                      SHA-512:2AAC3CCE21BE570BBCF75466F2E92F4A427E27970D002298E61480F8CB5A857B4FFBED2372EE72452463B3850177F7C50CAFD9A9E88A1E53D05147E1A84A9570
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:SQLite Is Public Domain....SQLite is in the..Public Domain..All of the code and documentation in SQLite has been dedicated to the public domain by the authors. All code authors, and representatives of the companies they work for, have signed affidavits dedicating their contributions to the public domain and originals of those signed affidavits are stored in a firesafe at the main offices of Hwaci. All contibutors are citizens of countries that allow creative works to be dedicated into the public domain. Anyone is free to copy, modify, publish, use, compile, sell, or distribute the original SQLite code, either in source code form or as a compiled binary, for any purpose, commercial or non-commercial, and by any means.....The previous paragraph applies to the deliverable code and documentation in SQLite - those parts of the SQLite library that you actually bundle and ship with a larger application. Some scripts used as part of the build process (for example the "configure" scripts genera

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\copyrights\ZLIB-LICENSE.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):911
                                                                                                                                                                                                                      Entropy (8bit):4.450087738624073
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:NBx4XWsEJ9iWfa7FPQ6yPXUbUEDEGUr25iQYkNMVFnFRpxGvZBM0x/O0Mph82luj:XxVMvKcxAbr2UQNNMTpxGvNbyC
                                                                                                                                                                                                                      MD5:692D644174E01C0AE617BD9D67866BF0
                                                                                                                                                                                                                      SHA1:EE613D81C41E6B07DD2407C3F1BFAC3F22B33E96
                                                                                                                                                                                                                      SHA-256:0757226AA4040726240DFCEAB7125D5297202FE7969C41EEE85C112284485C5F
                                                                                                                                                                                                                      SHA-512:969CC5B60F5977A407A2DD300F0DD7ECDAFBE4112DEE317B57F0A3F2B0897B87861AA026B3594B4130AA06C2543BC3BA73748C137C9E9005EE14C85E2B7C06BF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:Copyright (C) 1995-2017 Jean-loup Gailly and Mark Adler.. This software is provided 'as-is', without any express or implied.. warranty. In no event will the authors be held liable for any damages.. arising from the use of this software... Permission is granted to anyone to use this software for any purpose,.. including commercial applications, and to alter it and redistribute it.. freely, subject to the following restrictions:.. 1. The origin of this software must not be misrepresented; you must not.. claim that you wrote the original software. If you use this software.. in a product, an acknowledgment in the product documentation would be.. appreciated but is not required... 2. Altered source versions must be plainly marked as such, and must not be.. misrepresented as being the original software... 3. This notice may not be removed or altered from any source distribution.

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\driver\legacy-x64\gwdrv.cat

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):8392
                                                                                                                                                                                                                      Entropy (8bit):7.308055736770214
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:SUOQDlmMAvzz2dqxSG7+4EQej7Dd8XerF1DnlG8EYKveElfC9zSDi3s6TeDuHfwr:SpQDMMAnYe+PjPqOrlGIKLwBjtlAI0jJ
                                                                                                                                                                                                                      MD5:0D457235E0448235A27706E5F1ED8D8D
                                                                                                                                                                                                                      SHA1:3DFCD92189DB8A7263E22A26A9DB947C2422ED96
                                                                                                                                                                                                                      SHA-256:021E2AB66653D205BAF11373A1E31619E765B560A3046A745E80D7179F16CF83
                                                                                                                                                                                                                      SHA-512:A46F8A4701BA693F8136CFEA97D3073A7C5085DAB24D9EC4333C90DA86A5CAEBAFA18BBB3BFC66F9419ABB336D649CB2C3077BAA0377B2CD55C7E24B85608094
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:0. ...*.H........ .0. ....1.0...`.H.e......0.....+.....7......0...0...+.....7.........W.-C.x........150529043031Z0...+.....7.....0...0..o.R3.E.0.4.A.3.B.C.0.1.B.D.D.4.C.8.A.0.2.9.0.1.E.7.F.3.F.E.1.6.5.2.2.3.4.F.2.6.E.3...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........>.......).....R#O&.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0..w.R4.0.C.3.3.A.D.3.4.4.6.5.3.C.D.A.0.A.A.5.F.B.7.2.5.A.2.A.A.D.C.6.F.6.2.C.9.7.2.1...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+........@.:.De<....rZ*...,.!0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.....z0x00..+.....7...."0 ...O.S........V.i.s.t.a.X.6.4...0D..+.....7....604...H.W.I.D.1....... g.l.a.s.s.w.i.r.e.d.r.i.v

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\driver\legacy-x64\gwdrv.inf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Windows setup INFormation
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3102
                                                                                                                                                                                                                      Entropy (8bit):4.95533981001826
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:52C9dcdSyIfVEP3w7XdGd5pdGdAy8KFqVFOYv:o4dcdvQEf6XdGd5pdGdV8tVFOYv
                                                                                                                                                                                                                      MD5:61F60C794F0B40A68BAC6B61A5145311
                                                                                                                                                                                                                      SHA1:3E04A3BC01BDD4C8A02901E7F3FE1652234F26E3
                                                                                                                                                                                                                      SHA-256:90D0DDB705594AC621D316CB6213F310D99893DA5DC3F0FCB1BC26B2ED9AFFEE
                                                                                                                                                                                                                      SHA-512:605660C74864B2CBB309850000290EB42C542A2FF597E48E1A4A26170967D040283EBF184F2B9665C59EAFBAE9210E529DEB2C0C675C28D1AFBDA26BE084F78F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:;..; driver.inf..;....[Version].. Signature = "$WINDOWS NT$".. Class = GlassWire.. ClassGuid = {917D8DAF-DE89-44B7-8907-B422ECB01F53}.. Provider = %ManufacturerName%.. CatalogFile=gwdrv.cat.. DriverVer=05/29/2015,1.1.15.986....;********************************************..; manufacturer section..;********************************************....[Manufacturer].. %ManufacturerName% = GwCltGeneric, NTamd64....[GwCltGeneric.NTamd64].. %GwCltDesc% = GwClt, GlassWireDriver......;********************************************..; class section..;********************************************....[ClassInstall32.ntamd64].. AddReg = GwCltClassReg....[GwCltClassReg].. HKR,,,0,%ClassName%.. HKR,,Icon,,-5.. HKR,,SilentInstall,,1.. HKR,,DeviceType,0x10001,0x00000012 ; FILE_DEVICE_NETWORK.. HKR,,DeviceCharacteristics,0x10001,0x100 ; FLG_ADDREG_BINVALUETYPE | FLG_ADDREG_TYPE_MULTI_SZ, FILE_DEVICE_SECURE_OPEN.. HKR,,Sec

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\driver\legacy-x64\gwdrv.sys

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):33152
                                                                                                                                                                                                                      Entropy (8bit):6.3569037227104745
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:0PGvRm+amuA/Sxdh2k6mGueuGStSn14qCQ8:goRzaEKxdh2kvWStSni48
                                                                                                                                                                                                                      MD5:77621A3DF170D246DC744CD0767BFAB3
                                                                                                                                                                                                                      SHA1:E52827A5151DDFF725CA3D8486E1EEAD85277BC1
                                                                                                                                                                                                                      SHA-256:08BA4984D8B19337A34E4A2BBCE4AD681FDE09D02A6C421A16F5A717AA12CD84
                                                                                                                                                                                                                      SHA-512:E851E041DFAEE0DB4868B00A6617A89B943093F72F7FAC1FAB0F22BB56BDD80E5F16927E89F48DBFD548C92353D5F527E38530DC5648F87346918AB2C6C46F21
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@..!...!...!.....!..CV...!..CV...!.....!....l..!....j..!...!...!....|..!......!......!......!..Rich.!..................PE..d.....gU.........."......D...,.......D.........@....................................G'....`.................................................P...d.......(.......d....b..........(...@Q..8............................W..p............P..@............................text....9.......:.................. ..h.rdata..\....P.......>..............@..H.data........`.......J..............@....pdata..d............L..............@..HPAGE....'............R.............. ..`INIT.................T.............. ....rsrc...(............\..............@..B.reloc...............`..............@..B................................................................................................................................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\driver\legacy-x86\gwdrv.cat

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):8392
                                                                                                                                                                                                                      Entropy (8bit):7.303739188100594
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:SRPNFMUnYe+PjPqOrlGIKLwBjtlADYKa2R5u:03nYPLbfoOU0aLu
                                                                                                                                                                                                                      MD5:AE4AC25F3C6329554D1C7FDE74BD1CD9
                                                                                                                                                                                                                      SHA1:6D56B16BB050987006BF0B58DF887531B235CC7A
                                                                                                                                                                                                                      SHA-256:008D6FCFCFDE6F7E8D406E3B861F05F84E8E5C4AD32333AA2F6F08DE973BCFC5
                                                                                                                                                                                                                      SHA-512:AA7CA93E65316EE6602C837744DFBABC53C6AB1E235371B85594C01A95A11A00EF94E759696CC8B09653DBD2022FC70FBC7220872CB45C8CAAA36D1C92A17F86
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:0. ...*.H........ .0. ....1.0...`.H.e......0.....+.....7......0...0...+.....7......B.}m..M..H.....150529043033Z0...+.....7.....0...0..w.R8.D.7.C.A.5.9.2.D.3.C.B.1.D.5.7.0.4.7.D.3.D.2.E.3.E.C.6.D.C.2.A.4.7.5.2.1.1.B.5...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+.........|.....W.}=.>..*GR..0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0..o.RA.A.F.4.C.B.B.5.2.1.C.2.7.2.A.B.5.6.D.2.2.7.2.3.D.3.6.1.2.0.4.2.3.2.8.E.3.2.7.1...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........!.r.V.'#.a B2.2q0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.....z0x00..+.....7...."0 ...O.S........V.i.s.t.a.X.8.6...0D..+.....7....604...H.W.I.D.1....... g.l.a.s.s.w.i.r.e.d.r.i.v

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\driver\legacy-x86\gwdrv.inf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Windows setup INFormation
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3084
                                                                                                                                                                                                                      Entropy (8bit):4.951992553670738
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:52hiP4LdQyIfVEP3w7qzPRyOvw7R1POpXlqFWL4gOmJv:52CzyIfVEP3w7wRymgFqVFOYv
                                                                                                                                                                                                                      MD5:24EEFF1BE62CD6CF3F24B3CCB6F6BA69
                                                                                                                                                                                                                      SHA1:AAF4CBB521C272AB56D22723D3612042328E3271
                                                                                                                                                                                                                      SHA-256:2F40A16DF969EAE1E804B6E63A85AF35A38045D5B26057CB9F87CDE4B6653556
                                                                                                                                                                                                                      SHA-512:229BB23DDD9A77195D310AF3BFF3125916718220A493206F2571BAA930BE3DAA8A7FE2AC15BE7569239FE689DA3AA125777A8494BFEFAF7CB13CC58F35BD9BB8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:;..; driver.inf..;....[Version].. Signature = "$WINDOWS NT$".. Class = GlassWire.. ClassGuid = {917D8DAF-DE89-44B7-8907-B422ECB01F53}.. Provider = %ManufacturerName%.. CatalogFile=gwdrv.cat.. DriverVer=05/29/2015,1.1.15.986....;********************************************..; manufacturer section..;********************************************....[Manufacturer].. %ManufacturerName% = GwCltGeneric, NTx86....[GwCltGeneric.NTx86].. %GwCltDesc% = GwClt, GlassWireDriver......;********************************************..; class section..;********************************************....[ClassInstall32.ntx86].. AddReg = GwCltClassReg....[GwCltClassReg].. HKR,,,0,%ClassName%.. HKR,,Icon,,-5.. HKR,,SilentInstall,,1.. HKR,,DeviceType,0x10001,0x00000012 ; FILE_DEVICE_NETWORK.. HKR,,DeviceCharacteristics,0x10001,0x100 ; FLG_ADDREG_BINVALUETYPE | FLG_ADDREG_TYPE_MULTI_SZ, FILE_DEVICE_SECURE_OPEN.. HKR,,Security,

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\driver\legacy-x86\gwdrv.sys

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):27448
                                                                                                                                                                                                                      Entropy (8bit):6.471817341969751
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:FPj/Rwi6UOVD3wv+HtJyFmWFDNFLUl9RyPfDSAPPAGRinYPLbfoOUx3M:FrBu3HthWXGlyHDSmYGRiCQPM
                                                                                                                                                                                                                      MD5:DF5BB8BAF8F27D5DED6500F532159BD1
                                                                                                                                                                                                                      SHA1:9C877993DAEDB797F94A7C72A81F44B82C100019
                                                                                                                                                                                                                      SHA-256:BAE02709FF6ECF6FCE95339B5A11578AF74F166F41C32CDF08F0C43891706F1A
                                                                                                                                                                                                                      SHA-512:6B4B772170293FB59D2D14B991436E7814DDCE9956C871C0C9B68D3D6DBE05DE2FE8522AA9F0C2396766E6CD26FB1914E450E87DBA9110435411269A9FAB8D45
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^.8T?|kT?|kT?|ks..kV?|k.H.kU?|k.H.kP?|ks..kW?|ks..k_?|kT?}ks?|k2.kX?|k2.kU?|k2.kU?|kRichT?|k........................PE..L.....gU.................4..........X7.......@....@.......................................@.................................pq..x.......(............L..8............@..8...........................(F..@............@...............................text...L).......*.................. ..h.rdata.......@......................@..H.data........P.......6..............@...PAGE.........`.......8.............. ..`INIT.........p.......:.............. ....rsrc...(............B..............@..B.reloc..>............F..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\driver\win7-x64\gwdrv.cat

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):8657
                                                                                                                                                                                                                      Entropy (8bit):7.30121172521518
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:93TgQMcnYe+PjPIrK2ePkEEjtlAur9ZCspE+TMArfKo:9xnYPLv8EsUHeMq3
                                                                                                                                                                                                                      MD5:22C7579BB03241829184D21EF69668AB
                                                                                                                                                                                                                      SHA1:09E4B25CBD482356679F95085005D0303BAB8D90
                                                                                                                                                                                                                      SHA-256:50C22D5B327966EE3288F7781E896E6E38B375006B67A409EDBD2712D3DB90A7
                                                                                                                                                                                                                      SHA-512:706A3D83B916AE17F602CACF41AD3D691BDA68E3D19AC6B66AD6FA6024FDF5A5B989D656C0827B18A0D404AD2B8FDEE1C5CC5E6AAF8F89BE28232FF74D34AB67
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:0.!...*.H........!.0.!....1.0...+......0.....+.....7......0...0...+.....7.....~...E.D..}zv+3l..150529043022Z0...+.....7.....0...0..w.R2.5.C.C.7.3.9.C.2.D.A.1.F.B.A.2.E.3.7.E.1.8.1.A.C.0.8.8.D.3.1.E.9.8.E.5.9.0.4.D...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+........%.s.-....~........M0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0..o.R3.E.0.4.A.3.B.C.0.1.B.D.D.4.C.8.A.0.2.9.0.1.E.7.F.3.F.E.1.6.5.2.2.3.4.F.2.6.E.3...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........>.......).....R#O&.0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.....z0x00..+.....7...."0 ...O.S........V.i.s.t.a.X.6.4...0D..+.....7....604...H.W.I.D.1....... g.l.a.s.s.w.i.r.e.d.r.i.v.e.r

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\driver\win7-x64\gwdrv.inf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Windows setup INFormation
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3102
                                                                                                                                                                                                                      Entropy (8bit):4.95533981001826
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:52C9dcdSyIfVEP3w7XdGd5pdGdAy8KFqVFOYv:o4dcdvQEf6XdGd5pdGdV8tVFOYv
                                                                                                                                                                                                                      MD5:61F60C794F0B40A68BAC6B61A5145311
                                                                                                                                                                                                                      SHA1:3E04A3BC01BDD4C8A02901E7F3FE1652234F26E3
                                                                                                                                                                                                                      SHA-256:90D0DDB705594AC621D316CB6213F310D99893DA5DC3F0FCB1BC26B2ED9AFFEE
                                                                                                                                                                                                                      SHA-512:605660C74864B2CBB309850000290EB42C542A2FF597E48E1A4A26170967D040283EBF184F2B9665C59EAFBAE9210E529DEB2C0C675C28D1AFBDA26BE084F78F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:;..; driver.inf..;....[Version].. Signature = "$WINDOWS NT$".. Class = GlassWire.. ClassGuid = {917D8DAF-DE89-44B7-8907-B422ECB01F53}.. Provider = %ManufacturerName%.. CatalogFile=gwdrv.cat.. DriverVer=05/29/2015,1.1.15.986....;********************************************..; manufacturer section..;********************************************....[Manufacturer].. %ManufacturerName% = GwCltGeneric, NTamd64....[GwCltGeneric.NTamd64].. %GwCltDesc% = GwClt, GlassWireDriver......;********************************************..; class section..;********************************************....[ClassInstall32.ntamd64].. AddReg = GwCltClassReg....[GwCltClassReg].. HKR,,,0,%ClassName%.. HKR,,Icon,,-5.. HKR,,SilentInstall,,1.. HKR,,DeviceType,0x10001,0x00000012 ; FILE_DEVICE_NETWORK.. HKR,,DeviceCharacteristics,0x10001,0x100 ; FLG_ADDREG_BINVALUETYPE | FLG_ADDREG_TYPE_MULTI_SZ, FILE_DEVICE_SECURE_OPEN.. HKR,,Sec

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\driver\win7-x64\gwdrv.sys

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):33248
                                                                                                                                                                                                                      Entropy (8bit):6.35823953069854
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:0PGvRm+amuA/Sxdh2k6mGueuGItSn0FESm:goRzaEKxdh2kvWItSn2m
                                                                                                                                                                                                                      MD5:3CF2C2F026B06D3F6B9A402DD50D5C9B
                                                                                                                                                                                                                      SHA1:4F451C061BD21941803B995939F1660E5617D080
                                                                                                                                                                                                                      SHA-256:EEC63C73D54BC6F9AA53F6A248A041E3A0F1CE39386DA6243B42D1C14A322B2B
                                                                                                                                                                                                                      SHA-512:396AD45BEB8B55F93B506B4EF268800E39391080F2E5254ADC020D7409AB12E4361EC5A1F40C185BA935A3000D909C4C26ACA8C0A0CBFF0CE3BC51BC8945FE30
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........@..!...!...!.....!..CV...!..CV...!.....!....l..!....j..!...!...!....|..!......!......!......!..Rich.!..................PE..d.....gU.........."......D...,.......D.........@..........................................`.................................................P...d.......(.......d....b..........(...@Q..8............................W..p............P..@............................text....9.......:.................. ..h.rdata..\....P.......>..............@..H.data........`.......J..............@....pdata..d............L..............@..HPAGE....'............R.............. ..`INIT.................T.............. ....rsrc...(............\..............@..B.reloc...............`..............@..B................................................................................................................................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\driver\win7-x86\gwdrv.cat

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):8657
                                                                                                                                                                                                                      Entropy (8bit):7.305832368829902
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:9Ag+PQFMAnYe+PjPIrK2ePkEEjtlAur9ZCspE+TMArfU6g1g:9vSenYPLv8EsUHeMq5
                                                                                                                                                                                                                      MD5:A9B8582628AEE5CE486F592AF2FB1ACB
                                                                                                                                                                                                                      SHA1:3C27AFC9E4CE4C039408EB599BA991A5918EC1AF
                                                                                                                                                                                                                      SHA-256:52D6B0ACBB9A6C1610F415DD366DC36046908CDB0734A7505BDAD09F19C9A92A
                                                                                                                                                                                                                      SHA-512:8233C150C6FD3C939B6A8ED4E25A25AE840CC690ABB53343150BD2D084A564AB48C02B4770EC1151334354C0D10163A36FA5627C12744AFAE68F610F9B09DBA2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:0.!...*.H........!.0.!....1.0...+......0.....+.....7......0...0...+.....7.......w)..C.V)..0a...150529043025Z0...+.....7.....0...0..w.R8.E.9.C.9.5.1.2.8.5.4.D.4.A.E.2.5.D.D.A.7.E.D.4.1.7.9.5.1.B.9.C.2.C.7.D.2.2.7.2...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+.............MJ.].~.....,}"r0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0..o.RA.A.F.4.C.B.B.5.2.1.C.2.7.2.A.B.5.6.D.2.2.7.2.3.D.3.6.1.2.0.4.2.3.2.8.E.3.2.7.1...1...02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...i.n.f...0E..+.....7...17050...+.....7.......0!0...+...........!.r.V.'#.a B2.2q0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.....z0x00..+.....7...."0 ...O.S........V.i.s.t.a.X.8.6...0D..+.....7....604...H.W.I.D.1....... g.l.a.s.s.w.i.r.e.d.r.i.v.e.r

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\driver\win7-x86\gwdrv.inf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Windows setup INFormation
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3084
                                                                                                                                                                                                                      Entropy (8bit):4.951992553670738
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:52hiP4LdQyIfVEP3w7qzPRyOvw7R1POpXlqFWL4gOmJv:52CzyIfVEP3w7wRymgFqVFOYv
                                                                                                                                                                                                                      MD5:24EEFF1BE62CD6CF3F24B3CCB6F6BA69
                                                                                                                                                                                                                      SHA1:AAF4CBB521C272AB56D22723D3612042328E3271
                                                                                                                                                                                                                      SHA-256:2F40A16DF969EAE1E804B6E63A85AF35A38045D5B26057CB9F87CDE4B6653556
                                                                                                                                                                                                                      SHA-512:229BB23DDD9A77195D310AF3BFF3125916718220A493206F2571BAA930BE3DAA8A7FE2AC15BE7569239FE689DA3AA125777A8494BFEFAF7CB13CC58F35BD9BB8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:;..; driver.inf..;....[Version].. Signature = "$WINDOWS NT$".. Class = GlassWire.. ClassGuid = {917D8DAF-DE89-44B7-8907-B422ECB01F53}.. Provider = %ManufacturerName%.. CatalogFile=gwdrv.cat.. DriverVer=05/29/2015,1.1.15.986....;********************************************..; manufacturer section..;********************************************....[Manufacturer].. %ManufacturerName% = GwCltGeneric, NTx86....[GwCltGeneric.NTx86].. %GwCltDesc% = GwClt, GlassWireDriver......;********************************************..; class section..;********************************************....[ClassInstall32.ntx86].. AddReg = GwCltClassReg....[GwCltClassReg].. HKR,,,0,%ClassName%.. HKR,,Icon,,-5.. HKR,,SilentInstall,,1.. HKR,,DeviceType,0x10001,0x00000012 ; FILE_DEVICE_NETWORK.. HKR,,DeviceCharacteristics,0x10001,0x100 ; FLG_ADDREG_BINVALUETYPE | FLG_ADDREG_TYPE_MULTI_SZ, FILE_DEVICE_SECURE_OPEN.. HKR,,Security,

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\driver\win7-x86\gwdrv.sys

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (native) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):27568
                                                                                                                                                                                                                      Entropy (8bit):6.473536006304043
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:0/Pj/Rwi6UOVD3wv+HtJyFmWFDNFLUl9MyPfDSAPPlonYPLv8EsUHeM5:0/rBu3HthWXGQyHDSmNoFEZ
                                                                                                                                                                                                                      MD5:AEB4FE736D76F36AE2A7EB1EAD2344FF
                                                                                                                                                                                                                      SHA1:27038F37A8D13FA8A2CED8196BD36A073D042FAD
                                                                                                                                                                                                                      SHA-256:F77280B236B96DEEF80E8F69BA4C591D6F8645C2FB0545C806EC7FF1C12F8A7D
                                                                                                                                                                                                                      SHA-512:931EA0E86C18B987F0DF41CFC8112ABB86CD48B62EADB14494D4BB777791FABB08052BD7D7E7D0E5A1C4279A8CF6D19EBCD91632D0B290F9A73C081DF1B851BA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........^.8T?|kT?|kT?|ks..kV?|k.H.kU?|k.H.kP?|ks..kW?|ks..k_?|kT?}ks?|k2.kX?|k2.kU?|k2.kU?|kRichT?|k........................PE..L.....gU.................4..........X7.......@....@..................................w....@.................................pq..x.......(............L...............@..8...........................(F..@............@...............................text...L).......*.................. ..h.rdata.......@......................@..H.data........P.......6..............@...PAGE.........`.......8.............. ..`INIT.........p.......:.............. ....rsrc...(............B..............@..B.reloc..>............F..............@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\driver\x64\gwdrv.cat

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):11615
                                                                                                                                                                                                                      Entropy (8bit):7.3868789934614245
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:wOOgvXhARJCUnEwKUNhYCBkyLrp0KBQfX01k9z3AX6USwFVW:xARgUNh3BkyRxB+R9zW7HW
                                                                                                                                                                                                                      MD5:542FCDD371B6C4D2D8689514BD618AF5
                                                                                                                                                                                                                      SHA1:36A4959B6100263D4E0615E981E08E425604FCEC
                                                                                                                                                                                                                      SHA-256:0BA953EDEA4CACC7FFA37275B95B5DAD3BF8410E8649C1B98D9C59336ED01D2E
                                                                                                                                                                                                                      SHA-512:A951AA9AA5729A59C8CF31F65F1EBE1BC2037AC53393EBF5D859B95A66F1701DBCD1E466A49ACD80A56E44039C0D6E4D5CA6247A98EF9D341EF3C4227FFE68FC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:0.-[..*.H........-L0.-H...1.0...`.H.e......0.....+.....7......0...0...+.....7.......5.v.E...R.|....240617150138Z0...+.....7.....0..?0....z..lbX...i##.d>j.t=1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...s.y.s...0.....s..Q.`a..Z....:...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...i.n.f...0.... ...U...;.}A@.K..M..u..K.7..C0!.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ...U...;.}A@.K..M..u..K.7..C0!.0... .KZze..J7......~....*........H.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .KZze..J7......~....*........H.....0...0....+.....7......0.....S.u.

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\driver\x64\gwdrv.inf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Windows setup INFormation
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2458
                                                                                                                                                                                                                      Entropy (8bit):4.908381744177934
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:McNx2HvlzPtPbdZ0d7OPd/eohC/fr+ypHhqFWi4lTXlfv:McNx2P5hbdyd7O9eYEfFoEDlfv
                                                                                                                                                                                                                      MD5:4ADE9CA0F531877BF4AFA77A0122FE46
                                                                                                                                                                                                                      SHA1:A973FDC751DE606195E4BF5ADEF604863A13111F
                                                                                                                                                                                                                      SHA-256:BE4B5A7A65B0064A37FEE1CAD48385827ED9E50BA22A95E6CCDEF49DD5C248A5
                                                                                                                                                                                                                      SHA-512:EAA5E18E04FF44C1120DD6F951A954BEE85000507F3D1579BF23FB360B9BDEE05FD4BE15154304712A9B4E528CF961EDBD64F112E61A70CF0FBDFCC2AE72E307
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:;..; generic-driver.inf..; .NT$ARCH$....[Version].. Signature = "$WINDOWS NT$".. Class = GlassWire.. ClassGuid = {917D8DAF-DE89-44B7-8907-B422ECB01F53}.. Provider = %ManufacturerName%.. CatalogFile = gwdrv.cat.. DriverVer = 06/17/2024,17.44.6.748.. PnpLockdown = 1....;********************************************..; driver install section..;********************************************....[SourceDisksNames].. 1 = %DiskName%,,,""....[SourceDisksFiles].. gwdrv.sys = 1,,....[DestinationDirs].. DefaultDestDir = 12 ; %windir%\system32\drivers.. GwGeneric.DriverFiles = 12 ; %windir%\system32\drivers....[DefaultInstall.NTamd64].. OptionDesc = %GwGenericDriverDescription%.. CopyFiles = GwGeneric.CopyDriverFiles....[DefaultUninstall.NTamd64].. LegacyUninstall=1.. DelFiles = GwGeneric.DeleteDriverFiles....[GwGeneric.CopyDriverFiles].. gwdrv.sys,,,0x00000040 ; COPYFLG_OVERWRITE_OLDER_ONLY....[GwGeneric.DeleteD

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\driver\x64\gwdrv.sys

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):48296
                                                                                                                                                                                                                      Entropy (8bit):6.297840034594717
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:E0v8QOvjN2NGTn77rmisnSENWGvw4emXubnjeW5aYz6lBhJ/4tBH3ZEpw9zYUb0:E0EQOv4NGTn77rmisnSeWGvBaGJ/4tB8
                                                                                                                                                                                                                      MD5:715021B0BC7B2E8E3C13B384CDE5B392
                                                                                                                                                                                                                      SHA1:006275D68C8A2BA58477AED1980835EB58512329
                                                                                                                                                                                                                      SHA-256:42B85F2E37FFE04970D6BB1476978046EAD72DDF57392E396AD54A08B52A4AA0
                                                                                                                                                                                                                      SHA-512:BEBB72A7F11694463DDFD7575E67F078360BF32C75B0630FDEE30BC8A5649E53C2F56BFDF55ADD494CADA9A78C6E58E25FF675AA432E296F5D1CF6AE0595E910
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5...[D..[D..[D..\E..[D..]E..[D..XE..[D.._E..[D..ZE..[D..ZD..[D.`_E..[D.`.D..[D.`YE..[DRich..[D........................PE..d....Kpf.........."....(.n...$......Pl.........@....................................4}.....A................................................0...d.......(.......l........(.......... ...8...............................@............................................text....f.......h.................. ..h.rdata..h............l..............@..H.data...h............~..............@....pdata..l...........................@..HINIT....P........................... ..b.rsrc...(...........................@..B.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\iconengines\qsvgicon.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):40560
                                                                                                                                                                                                                      Entropy (8bit):6.795607810015785
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:ccdZm5mjw1lQR8Z3Zf3V+hFem0wKk84XmuZVvf3iPmbLyv1:zu1lQQ3Zf3V+Lem0wKk845ZVvP7y1
                                                                                                                                                                                                                      MD5:13EE4671CD7B8572EB31C5C9CCEBE34C
                                                                                                                                                                                                                      SHA1:E4594AD2802B98F70075EC0BC1C82CE098560812
                                                                                                                                                                                                                      SHA-256:2982FA84D7E8E6BC79361470C07999D0C5044203E08B4F08FBF126AACC684B31
                                                                                                                                                                                                                      SHA-512:446E7EB9BEE21D62CC91CC99BAD6A91D462911386E2409BFDFAEBE008A845AAC3860B802A741ADDD31BFE195DF0CC9E24754D9CE78DCF88093BE5F5C1198ABAC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............................................................B.........X..B......B......B.v....B......Rich...................PE..L......_...........!.....8...8.......>.......P......................................C.....@.........................0]..x....]..........H............p..p............T..T....................U......0U..@............P..x............................text....6.......8.................. ..`.rdata...%...P...&...<..............@..@.data................b..............@....qtmetadj............d..............@..P.rsrc...H............f..............@..@.reloc...............j..............@..B........................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\imageformats\qico.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):36976
                                                                                                                                                                                                                      Entropy (8bit):6.770510480252743
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:UwLKUeP1ob4OgufLCJGqU2SZ6HseoZVvAK3iPmbLD/:RKUeP1WyufLCJGqU2SZ6HseoZVvP7T
                                                                                                                                                                                                                      MD5:25E1040C2D912EC9534B02382E84ABC1
                                                                                                                                                                                                                      SHA1:3519BE123EE167E087692F5700EA67FB68D4C7BA
                                                                                                                                                                                                                      SHA-256:7A8701351739E8E8D03628228EB455958E6045C0C95A1EC09E373EE737C68F51
                                                                                                                                                                                                                      SHA-512:8CC0702DFA015221BECD4BA41A7710971CD2E7A2C4E90E491A66E3DBF61204832CF8720BFDFF2EBDAFAE1852C4F85C30BBC2CEF2B6A58380DBE92480219494D0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z.O..d!..d!..d!......d!... ..d!... ..d!...$..d!...%..d!..."..d!.. ..d!..d .d!..$..d!..!..d!.....d!..#..d!.Rich.d!.........PE..L...1._...........!.........4......;4.......@............................................@.........................`M..t....M..........@............b..p............D..T....................E.......D..@............@...............................text....,.......................... ..`.rdata...!...@..."...2..............@..@.data........p.......T..............@....qtmetad.............V..............@..P.rsrc...@............X..............@..@.reloc...............\..............@..B................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\lang\de_de.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):153966
                                                                                                                                                                                                                      Entropy (8bit):4.67031491075959
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:Dug1vpzep/+fhFFBcKx5l3qMiSFN7bN87s4rpielfThjx:Dbvs/YskZiT/
                                                                                                                                                                                                                      MD5:6858693636780F33C73F280FD66ADFAB
                                                                                                                                                                                                                      SHA1:238F8037C98B543A87EE2886AC2085BD434FB612
                                                                                                                                                                                                                      SHA-256:CB2CB8D2389853B6E0BDEC77786777F2FEAB3695F70B79D6B876EE2FDFC54768
                                                                                                                                                                                                                      SHA-512:66A1BCA2DF317888A852C674BF9F2843A465E662BC5CBE2C9CBFFFADB535731BA474935435F35A1B7A801B1732764799A395FEBF74F18F7D7BFE1863C95E239C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......de_DEB..'....-..&....B.......d.......h.......m...1...s...X...............i.......+...........;.......;.......;.......;...%...O.......O...........L..-...;...8....I..9D......:....7..;....j..<.......<....F..=.......>.......?....6..@....i..Ec......G.......H,..t...H,..=...H,..H...H,..b...H,..&...Hp...C..Hp..>o..Hp..I...J...A...J....[..J...)Z..J.......M...n...N:..w...N:..I...ND..o'..P^..*...Rc..s...S...C...V....0..ZS..~...[N......[^../...[`......_...5M.._........B......G....-..H....c..I.......J.......K.......L....;..M....q..N.......O.......P.......W....|..X.......YD......Z.......[....T..\.......].......^......._....,..`....b..g.......h............?...:..t9...s..tm...s.......s..>....s..I+...s..(.......c............t.......y...X......t............Y.......c...;...E...|......Y........e...........}...4...0..Z+...0.......c.........Ig.......c.......\..........c.......j..x....j..r...5.......5...x...8).....F.......L...AD..L...z...L...R...P....6..bz..z...c~...X..l....K...c...v.

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\lang\en_gb.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1739
                                                                                                                                                                                                                      Entropy (8bit):4.745579671293287
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:qm5MDy/6/lB/bGtAztAVqOt/IhqFEV6NrtLZcwfvrN9rS5dHJHo:qm5SyM6ApAVtAM2SzGtBo
                                                                                                                                                                                                                      MD5:FBA12A911DBBE33DEB6E53058BDADAF3
                                                                                                                                                                                                                      SHA1:9A96E8AD562905B611B5C3AC9952BD18EE475890
                                                                                                                                                                                                                      SHA-256:5D0E309EC0AEA1D59F874EA066029332C8CA25DCBC5713C14A3A743E32883247
                                                                                                                                                                                                                      SHA-512:5081C9BB5BBE353E4EB5D9E2A072FC210F0D3013AD8D369AA766F77E4DD23A83244F46EFCFC2445A8863179CEB826072856701B8F03DF8AD5186288FCB1C25CB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......en_GBB....../....p.L`....b..B..............~...5.&.~.....v0........>.....hI.............hP....... ....(.N0....Y.u.....O..S4.....f(I.....xJ.............i........N.Y.o.u. .h.a.v.e. .%.n. .d.a.y. .o.f. .G.l.a.s.s.W.i.r.e. .r.e.m.a.i.n.i.n.g......P.Y.o.u. .h.a.v.e. .%.n. .d.a.y.s. .o.f. .G.l.a.s.s.W.i.r.e. .r.e.m.a.i.n.i.n.g...........(You have %n days of GlassWire remaining......Strings::AboutDialog.....J.Y.o.u.r. .p.r.e.m.i.u.m. .t.r.i.a.l. .e.x.p.i.r.e.s. .i.n. .%.n. .d.a.y......L.Y.o.u.r. .p.r.e.m.i.u.m. .t.r.i.a.l. .e.x.p.i.r.e.s. .i.n. .%.n. .d.a.y.s...........&Your premium trial expires in %n days......Strings::Ads......{.OSN-e...........Chinese Simplified.....Strings::Languages......~A..N-e...........Chinese Traditional.....Strings::Languages.......E.n.g.l.i.s.h..........English.....Strings::Languages.....0.E.n.g.l.i.s.h. .(.U.n.i.t.e.d. .K.i.n.g.d.o.m.)..........English (GB).....Strings::Languages.......F.r.a.n...a.i.s..........French.....Strings::Languages

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\lang\en_us.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1849
                                                                                                                                                                                                                      Entropy (8bit):4.743223564416303
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:qd/WCn0/lB/bGtAztAVqUwet/IhqFEV6NrtLZcwfvrN9rS5dHJHo:qdlq6ApAMetAM2SzGtBo
                                                                                                                                                                                                                      MD5:CA99D2A19FC6A6C1577A02BAE8942C24
                                                                                                                                                                                                                      SHA1:6FDB3DA9509A4318A30517E44013118014BD484F
                                                                                                                                                                                                                      SHA-256:478F4A7D9C02CC88CD3BF9446A47C282200DED9141DB5FE9389ADA54FD5BCB67
                                                                                                                                                                                                                      SHA-512:7317A60DD194E0E68430E3C656FF11096864347EF641A7BC162B27F4D757916607D46D7038904BE0CB360A06C26BBE714ED0E1ABB00A9187780A8E117291F52D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......en_USB....../..............L`.......B...........^..~.....&.~...I.v0....|...>.....hI.............hP....R.. ......N0......u........S4...<.f(I.....xJ............}i...v....N.Y.o.u. .h.a.v.e. .%.n. .d.a.y. .o.f. .G.l.a.s.s.W.i.r.e. .r.e.m.a.i.n.i.n.g......P.Y.o.u. .h.a.v.e. .%.n. .d.a.y.s. .o.f. .G.l.a.s.s.W.i.r.e. .r.e.m.a.i.n.i.n.g...........(You have %n days of GlassWire remaining......Strings::AboutDialog.....J.Y.o.u.r. .p.r.e.m.i.u.m. .t.r.i.a.l. .e.x.p.i.r.e.s. .i.n. .%.n. .d.a.y......L.Y.o.u.r. .p.r.e.m.i.u.m. .t.r.i.a.l. .e.x.p.i.r.e.s. .i.n. .%.n. .d.a.y.s...........&Your premium trial expires in %n days......Strings::Ads.......%.n. .S.e.r.v.i.c.e......%.n. .S.e.r.v.i.c.e.s..........%n Service(s).....Strings::FirewallPage......{.OSN-e...........Chinese Simplified.....Strings::Languages......~A..N-e...........Chinese Traditional.....Strings::Languages.......E.n.g.l.i.s.h..........English.....Strings::Languages.....0.E.n.g.l.i.s.h. .(.U.n.i.t.e.d. .K.i.n.g.d.o

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\lang\es_es.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):121059
                                                                                                                                                                                                                      Entropy (8bit):4.702288421630279
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:LhUIHn5gmOsPsvjS9rdmRgNwJsi69546r72gK6TLQ2KI3jUF80:LhxH55ObkrdmXmT1n4WLJ2S0
                                                                                                                                                                                                                      MD5:5B32279183B5B94A84A5BD4450350F43
                                                                                                                                                                                                                      SHA1:CCAE752C75DEABE6F92C30EC3BAB9CFE5B4A4063
                                                                                                                                                                                                                      SHA-256:763E7515E4BBC8C1EB0B4820C9DE3167D23857D62EB09247946CAF62A31B83B0
                                                                                                                                                                                                                      SHA-512:CE1EF274F34FA1B18013E1E990635823D39F6460F3DBE158B0F5B41FE5E35234277785D70C7906B35195BE59A9E2495AA6EDE8F5126FD72DF3784C802A9A1805
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......es_ESB.."....-.......B.......d.......h.......m.......s...........T.......g......a........@...;...R...;..@b...;..h....;.......O..."...O..............-....!..8...D...9D..G...:...G...;...G...<...H...<....D..=...HJ..>...H{..?...H...@...H...Ec......G...I...H,..g...H,...K..H,...p..H,...6..Hp..t...Hp......Hp......J...X...J.......J....i..M...+]..N:..j...N:...K..ND..+...P^...v..Rc..0...S.......V...h4..ZS..<&..[N..=:..[^......[`..=..._......._....g...B..}...G...B...H...C...I...C?..J...Cs..K...C...L...C...M...D...N...DC..O...Dw..P...D...W...E...X...ED..YD..Ex..Z...E...[...E...\...F...]...FN..^...F..._...F...`...F...g...GO..h...G.......J....:..gJ...s..g....s......s.......s...x...s...............t.......y...5......h7.......8...Y...$...c...~...E...................V...........}...H...0...o...0.......c..................y....................c...j...j..l<...j../...5...c...5...k...8)......F...z"..L...5...L...m...P.... ..bz..nN..c~...J..l....=...c.......~..5....`..9........x...e..q..

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\lang\fr_fr.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):155072
                                                                                                                                                                                                                      Entropy (8bit):4.658774783128883
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:PKJtntvaJigsU8FK5pJYKYV5itsNmtA3DFV6WfQ6fZGLK9Vf0o+:PstFaJit5V5it+TFV7JIiN2
                                                                                                                                                                                                                      MD5:3B82181CE2CF1F0FEFDB4A276E9EF741
                                                                                                                                                                                                                      SHA1:A9D40E5C6F5D85BC7CFE2BFCCE27906687041FF5
                                                                                                                                                                                                                      SHA-256:4098822A846916D2AD8FC90A7FAECF2BE24A5E91C864236A0CD7CF8E8ECFF46A
                                                                                                                                                                                                                      SHA-512:367C60FB67448082A57344655C2E9AF22424418651F5988C816409ECDFFD6AC4C3012BBBC22182990BD596A0411C95CC5DF6ED67CFDAA0ACC15940B8BF529868
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......fr_FRB..'....-..*....B...l...d...-...h...T...m...{...s..................................U...;.......;.......;...6...;.......O...X...O..............-...9...8....o..9D......:.......;.......<.......<.......=....8..>....o..?.......@.......Ec.....G.......H,..qJ..H,..:...H,..F...H,..`...H,..*...Hp..~...Hp..<5..Hp..F...J...?...J....}..J...-...J.......M...mE..N:..u...N:..G:..ND..m...P^../F..Rc..r...S...A...V....h..ZS..~>..[N......[^..3...[`...=.._...2..._........B.....G....+..H....e..I.......J.......K.......L....M..M.......N.......O.......P....5..W.......X.......YD......Z....R..[.......\.......].......^....:.._....t..`.......g.......h....Y.......g...:..q....s..q....s.......s..<u...s..Fm...s..,N......a........4...t.......y..........rp...........Y.......c......E..........W(...................}.......0..W....0.......c..........F................R..........c.......j..v]...j..q...5.......5...v!..8).....F....B..L...B...L...w...L...P`..P....*..bz..xu..c~...N..l....O...c.....

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\lang\it_it.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):120600
                                                                                                                                                                                                                      Entropy (8bit):4.690052826578399
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:Xe1cKOg91UkHevnlwjcfrjHBc3QlPWrN0G/vXEaBXR:2791UkWnlw4HB3urSG/vXF
                                                                                                                                                                                                                      MD5:75E3D59DCD17A4DAEA349A0D1EE4219D
                                                                                                                                                                                                                      SHA1:94D9A76EAB7978B8E50C0582D2EBD16944991732
                                                                                                                                                                                                                      SHA-256:0038A0C577093F443B403C8295655953B11106E121933A68E15A5FB957F41FC3
                                                                                                                                                                                                                      SHA-512:62E6FC4DF820A7BEF7679200936BC347DD6B370D9304B9EAACD2B05AE820255E7BC752E4F5E4CCF408C91EC80A13A486A194B36FC2C2FEF72504E556A8E99B11
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......it_ITB.."....-.......B.......d.......h...B...m...i...s..........................`............;.......;..>....;..f....;.......O.......O...........;..-.......8...CP..9D..E...:...F"..;...FS..<...F...<.......=...F...>...F...?...G...@...GH..Ec...5..G...Gy..H,..e...H,......H,......H,......Hp..s=..Hp......Hp......J...V...J.......J.......M...)...N:..i...N:......ND..*2..P^...{..Rc../...S....P..V...f:..ZS..:...[N..;...[^......[`..<..._......._........B..{Q..G...AF..H...Az..I...A...J...A...K...B...L...BL..M...B...N...B...O...B...P...C...W...C...X...C...YD..C...Z...D...[...DQ..\...D...]...D...^...D..._...E!..`...EU..g...E...h...E.......Hy...:..f....s..fR...s.......s.......s.......s...........a...t.......y..........f............Y.......c.......E...G...........................}.......0.......0...6...c...........i......xm.......0.......^...c.......j..j....j..-k..5...a...5...j...8)...t..F...x...L...4...L...l...P.......bz..l...c~......l........c...e...~..3]...`..8........}...e..p..

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\lang\ja_jp.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):96950
                                                                                                                                                                                                                      Entropy (8bit):5.738208855317683
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:0i6DhgDh+1hWXA2i5F9X6CKJ1Zsr1FGJs7sdmhyxhPc33k:IShwF92J1ZkAx7PT
                                                                                                                                                                                                                      MD5:AA4CC4D2D0FC6273555F3A50ADB1FEBC
                                                                                                                                                                                                                      SHA1:1ACCB0F3231351E7CE04E7D3052FC6DB93B42A55
                                                                                                                                                                                                                      SHA-256:03AE99D1A719E0BEDA008C787565688B64A3D54DDCADDAD3208364F4C1CECFCB
                                                                                                                                                                                                                      SHA-512:B0C6B34F6C70B678EF8C731964E0E59A4581EF211A4695B5A6D916C01389BAD19139B8BD3F60E20B9BB91ECA57A2CCC62B7CCE33FC3ED226CF595C141B4AA52D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......ja_JPB.."....-..Q....B.......d..5....h..5....m..6....s..61......0Z......2........u......2....;.......;.......;.......;..3R...O.......O..3&......4<..-......8....1..9D......:.......;....R..<.......<....x..=.......>.......?.......@....Q..Ec......G.......H,..J...H,.....H,.....H,..Q...Hp..T...Hp...j..Hp......J.......J...S...J.../...M....J..N:..M4..N:... ..ND......P^..T...Rc.....S.......V....4..ZS...~..[N......[^..W...[`...%.._....B.._...5....B..)...G.......H....K..I.......J.......K.......L....#..M....Y..N.......O.......P.......W....d..X.......YD......Z.......[....<..\....r..].......^......._.......`....J..g.......h............N...:..JD...s..Jx...s...S...s......s...w...s..R........3...t..{U...y../_......J.......~....Y..E....c..0....E../........I......A........T...}.......0......0..BO...c..2-.............Y.......FM...........c..2....j..NJ...j...5..5.......5...N...8)......F...Y<..L...'b..L...O...P.......bz..O...c~......l....{...c..4f...~...A...`...............e..R..

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\lang\ko_kr.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):95780
                                                                                                                                                                                                                      Entropy (8bit):5.798041098839606
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:+dvtjS4BL/InFeikPCLnCzoav3gBlJn1Q2yGD8ZJuck:8vHBcnFeiAvwfJuNSm8
                                                                                                                                                                                                                      MD5:612FAF0981E6BBBDBC6185D2AECC4CED
                                                                                                                                                                                                                      SHA1:134CC4CDACC426E3296EAEF8E3887F56C893B9F1
                                                                                                                                                                                                                      SHA-256:3EC3BA2D5CFA9C87EFB106A6286F49F4E8671D3BB5BD8BC2B83902F32BA73E79
                                                                                                                                                                                                                      SHA-512:56FB1302E3831BF30506DFB5F0EC14A5BFB54A77863D3171CC4B7D94AF26BD1AF7ACA501103ACA2CE119548E1938099A321EEB2EEC6B9300D065A29719A0C040
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......ko_KRB.."....-..L....B..*....d..1....h..1....m..1....s..2.......,>......-....................;...3...;...<...;.......;../2...O.......O../.......0...-....`..8....S..9D......:....A..;....t..<.......<...*r..=.......>.......?....@..@....s..Ec..*...G.......H,..I...H,...j..H,......H,..M...Hp..T...Hp...Z..Hp......J.......J...O/..J...+{..M.......N:..M"..N:...R..ND.....P^..Px..Rc...e..S.......V....<..ZS......[N.....[^..S...[`...W.._......._...1g...B..%d..G....7..H....m..I.......J.......K.......L....E..M....{..N.......O.......P.......W.......X.......YD......Z....(..[....^..\.......].......^......._....6..`....l..g.......h............f...:..J....s..JN...s...%...s......s......s..NC.......]...t..z....y..+O......J.......}....Y..@....c..,h...E..+..............=l...........}.......0.......0..=....c..................Y!......A............c.......j..N:...j......5.......5...N...8)......F...YT..L...'...L...O...P....H..bz..O...c~...:..l........c..08...~......`...............e..R..

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\lang\pl_pl.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):118303
                                                                                                                                                                                                                      Entropy (8bit):4.832468826480095
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:/jb4Z4WzojS86S3Ev47Xivi3riBCV0n0RlkD:/jb4Z4zS86V4vic0nL
                                                                                                                                                                                                                      MD5:C115DC1310E21730A96939AEC0D8897D
                                                                                                                                                                                                                      SHA1:FB4A3D4AF2E25355D1A1715A8DE6E580713CEA96
                                                                                                                                                                                                                      SHA-256:FED5468A1868949C9BCECE67E2ED990C26470ED62532DA1C7BB5006D905E35DC
                                                                                                                                                                                                                      SHA-512:3959BA0D50F1013AD8C82E78BD24332C06DC263CE010F0A8D922FE00C182D0D02220F9EABFE32E62E52AF83691CD7691CE903306051B440F3B4C59D592122B30
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......plB.."....-...M...B..yP...d.......h...<...m...c...s..........z.......|.......X.......}....;......;..8....;..^....;..~C...O...b...O..~........U..-.......8...<...9D..?...:...?...;...?...<...@...<...x...=...@?..>...@p..?...@...@...@...Ec..yw..G...A...H,..c...H,......H,......H,...w..Hp..q9..Hp......Hp...f..J...O...J.......J...z...M..."...N:..gl..N:......ND..#9..P^......Rc..'...S....I..V...^...ZS..4y..[N..5...[^......[`..64.._....5.._........B..s...G...:...H...:...I...;,..J...;`..K...;...L...;...M...;...N...<0..O...<d..P...<...W...<...X...=1..YD..=e..Z...=...[...=...\...>...]...>5..^...>i.._...>...`...>...g...?6..h...?j......A....:..d....s..dR...s...l...s...Q...s.......s...............t.......y..y.......d............Y.......c..{....E..z}....... .......%.......c...}.......0.......0.......c..}........*......vW.......B...........c..}....j..h....j..&4..5...Z...5...h...8)...r..F...v...L...4...L...j~..P.......bz..j...c~......l........c.......~..,L...`..2,.......i...e..n....e

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\lang\pt_br.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):118591
                                                                                                                                                                                                                      Entropy (8bit):4.7421993388256505
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:ZGjC1MlQNWpr38fn3CtX7Dp1poI7Wocd2+lcO67cE8tI6jMrOoT2Se0mstcwiYLx:QWOlWusdZcOhIOotTtL+FIIBC
                                                                                                                                                                                                                      MD5:4D63ECC34332E650F36DFE7B41A26145
                                                                                                                                                                                                                      SHA1:D454B665918BAA8053C7989B86ACABA47EBBFE57
                                                                                                                                                                                                                      SHA-256:275EDCDF0879384027BC5BE1FA1CDC13EB597A766D4A16F615B2C0DEA7C943A2
                                                                                                                                                                                                                      SHA-512:3E789CA7D442D1CB8BF2F11EEFD70F5E27E44A860AAE64A551FD15C88E791334C2CE86B28818960ABA71855FBE9C14B4F653F0BC4FA66BF072A29CA2B292BD09
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......pt_BRB.."....-.......B..z....d...|...h.......m.......s..........|J......~S......Y........0...;.......;..8p...;.._8...;.......O.......O..............-....5..8...<...9D..?...:...?...;...@...<...@3..<...z:..=...@f..>...@...?...@...@...@...Ec..z...G...A2..H,..c...H,..._..H,......H,......Hp..q...Hp......Hp......J...P~..J....7..J...{a..M...#...N:..gx..N:......ND..$I..P^......Rc..)...S.......V..._j..ZS..4b..[N..5...[^...%..[`..63.._......._....O...B..t...G...:...H...:...I...;/..J...;e..K...;...L...;...M...<...N...<=..O...<s..P...<...W...=...X...=H..YD..=~..Z...=...[...=...\...> ..]...>V..^...>..._...>...`...>...g...?a..h...?.......B6...:..d....s..d^...s...l...s.......s...R...s...........\...t.......y..{-......d........<...Y.......c..|t...E..{................Z...........}...Z...0.......0.......c..~}..............v{...................c...Z...j..h....j..'V..5...[:..5...h~..8)......F...v...L...4...L...jF..P.......bz..j...c~......l........c.......~..-p...`..2M.......z...e..nt.

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\lang\ru_ru.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):117588
                                                                                                                                                                                                                      Entropy (8bit):5.371360847433551
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:yCJ4zwY0BdwH6BfEuSH0HpUILxfOmT4hN9cyuK8XbqHVGAVzGr:YUSHCWM47o
                                                                                                                                                                                                                      MD5:9BBBFD7E19ECB15240616AD93A00317F
                                                                                                                                                                                                                      SHA1:576BA90831224F691CF5417D29F9C742134E339E
                                                                                                                                                                                                                      SHA-256:3D64EA6D96EE9B2FB3BDDD00CD22E9707EC2130D0C4AB61C921F5ED30AC29D82
                                                                                                                                                                                                                      SHA-512:54CE7EC394F5590B648FB7847F772614230507727EF4F475A78E741F1DFCD703402F0E6CF93981E86892104B3A1AB6A6E02CEE3BDC58724305639361C75D71C0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......ru_RUB.."....-.......B..v5...d..~&...h..~M...m..~t...s..~.......w.......z.......U.......z....;...!...;..5....;..[X...;..{t...O.......O..{H......|r..-.......8...9...9D..;...:...<...;...<...<...<...<...u...=...=4..>...=i..?...=...@...=...Ec..v\..G...>...H,..aq..H,......H,......H,......Hp..n...Hp......Hp...G..J...M...J....Y..J...v...M.......N:..e...N:......ND.. &..P^......Rc..$...S.......V...[...ZS..0...[N..2...[^.../..[`..2..._....|.._...}....B..pb..G...7[..H...7...I...7...J...8...K...8;..L...8s..M...8...N...8...O...9...P...9S..W...9...X...9...YD..:0..Z...:h..[...:...\...:...]...;...^...;H.._...;...`...;...g...<%..h...<]......>....:..a....s..a....s...)...s...0...s.......s...E.......]...t.......y..v.......b........:...Y...N...c..x....E..wt.......Q.......X...........}...X...0.......0.......c..z5..............su...................c..{....j..fX...j..#7..5...Wf..5...f ..8)......F...s...L...1...L...g...P....z..bz..hn..c~......l........c..|....~..(....`...........,...e..l..

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\lang\tr_tr.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):116862
                                                                                                                                                                                                                      Entropy (8bit):4.847260612162405
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:lm/BcFUyodxffAK/DNt9wdry56NNOo9+1U6YvVylu5bOQa:lGx/75y6t
                                                                                                                                                                                                                      MD5:1DF00E21D8E00539D14720270FD94A33
                                                                                                                                                                                                                      SHA1:93F6EED3E642274E76C13CD121023060980E7681
                                                                                                                                                                                                                      SHA-256:AE8320F19E7CA8B588CFBED42709550363E6389DEA8B3A3A00AE81C5858F68E5
                                                                                                                                                                                                                      SHA-512:39569F487FB2422B3243BE1BF34F20D8013091E925C4C9E9E26E5CDFB0B2CF74852479CE7BA84C379CBF67BBAA57B93C0354F94481D72DD1886651BBAF091631
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......tr_TRB.."....-...2...B..t....d..|z...h..|....m..|....s..|.......vR......xI......TO......y$...;......;..3....;..Y....;..y....O...s...O..y~......z...-...."..8...8)..9D..:x..:...;...;...;J..<...;}..<...t4..=...;...>...;...?...<...@...<I..Ec..t...G...<|..H,..`5..H,...@..H,......H,...\..Hp..mi..Hp...V..Hp......J...K@..J.......J...uY..M...!...N:..c...N:......ND..!...P^...D..Rc..&%..S....x..V...Z...ZS../...[N..0...[^...m..[`..1..._......._...|K...B..n...G...6...H...6C..I...6y..J...6...K...6...L...7...M...7Q..N...7...O...7...P...7...W...8\..X...8...YD..8...Z...8...[...94..\...9j..]...9...^...9..._...:...`...:B..g...:...h...:.......=d...:..`h...s..`....s...A...s.......s...)...s...........O...t.......y..u#......aM.......0...Y.......c..v|...E..u............................}... ...0...6...0...w...c..xs.......s......r........=...........c..yN...j..eP...j..$u..5...U...5...e...8)...u..F...r...L...2...L...g...P.......bz..gx..c~......l........c..z....~..)....`..-........:...e..kD.

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\lang\zh_cn.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):90029
                                                                                                                                                                                                                      Entropy (8bit):5.7409352896197
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:ecmJtJ05Y5TmK4CovMfR7eGhZThr62QIGz2QFwcyctex9n3Pccp2Shs8gOyJ8oZV:GJDpYvWlb63zvoWcr126oZNQfvPo
                                                                                                                                                                                                                      MD5:7728D53F706458841E1BB612A5CB6BA4
                                                                                                                                                                                                                      SHA1:C6D9ED467D92036C44154FFF971CB011BFFE2DA7
                                                                                                                                                                                                                      SHA-256:104E3EDFBBCCA6A621100F2E8F54148A0AC0617EA4E290BD4646B62E527CAB90
                                                                                                                                                                                                                      SHA-512:CC78F1FABA59DA5C5E9F4C80D740231BDFFF5E75471E53F2041DDC37C3795121E28949E461DF4C8BECFC4CACF7B022E3377A86E3AB2BD07931E68ADEDECF55F8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......zh_CNB.."....-..6{...B.......d...!...h...H...m...q...s...................................K...;.......;.......;.......;.......O.......O..............-....7..8.......9D...G..:.......;.......<....L..<....-..=.......>......?.......@.......Ec......G....K..H,..A...H,...E..H,.....H,..6...Hp..K;..Hp...'..Hp...>..J....]..J...8...J....6..M......N:..D...N:...u..ND......P^..9...Rc.....S....)..V.......ZS.....[N.....[^..<...[`...4.._......._........B...%..G.......H.......I....H..J....~..K......L.......M.... ..N....V..O......P.......W....+..X....a..YD.....Z.......[.......\....9..]....o..^......_.......`.......g....z..h...............:..A4...s..Aj...s...1...s...Y...s.......s..7........&...t..o$...y..........A.......q....Y..+....c.......E.................(g......u....}..y/...0.......0..(....c..................OS......,.......|....c...u...j..E....j...P..5.......5...D...8)......F...O...L...!...L...FF..P.......bz..F...c~......l........c.......~.......`...........+...e..Il.

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\lang\zh_tw.qm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Qt Translation file
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):89358
                                                                                                                                                                                                                      Entropy (8bit):5.758960372143689
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:DydsPmAon83VB00VuAUvuGSfZac27+f+F58yjy8T5721augUn6X+32SrO81M9Vtk:Dy2PmlaFT8ci58t1G+BrRCtnPVnJ38ZB
                                                                                                                                                                                                                      MD5:D2EF2EB5A6B97CB190CEAC0EA1D0BE30
                                                                                                                                                                                                                      SHA1:DA38C9609D21AF876E8C17401B019D871865241F
                                                                                                                                                                                                                      SHA-256:F7FD058793B1752F56DFA13A3E0002C69B005176E1CED3BDA67DBBD1D5424C06
                                                                                                                                                                                                                      SHA-512:EC0F80378F81B132C28A74FA5F43EEF0F8A11980F9A04011259E6BBE8149DD184AC990152DE49DC40E01624B78A9719979D66A27B50958F32C11B6BBA76A1DAD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<.d....!..`.......zh_TWB.."....-..4$...B...Y...d.......h.......m.......s...9...............?.......Y...........;.......;.......;.......;.......O.......O...X.......V..-.......8.......9D...(..:.......;.......<....-..<.......=....`..>......?.......@.......Ec......G....,..H,..@...H,......H,......H,..4N..Hp..J...Hp......Hp......J.......J...6?..J.......M....v..N:..C...N:......ND......P^..7...Rc.....S.......V.......ZS.....[N...t..[^..:...[`......_......._........B......G......H.......I....)..J...._..K......L.......M.......N....7..O....m..P......W.......X....B..YD...x..Z......[.......\.......]....P..^......_......`.......g....[..h...............:..@....s..@....s...g...s.......s.......s..5a.......A...t..nw...y..........A.......q....Y..)4...c.......E...f..............&"......u....}..x....0.......0..&....c...i.......U......N.......*7......|1...c...(...j..D....j...K..5.......5...Dt..8)......F...N...L...!...L...E...P.......bz..F@..c~...j..l........c.......~.......`...............e..H..

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\platforms\qwindows.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1224304
                                                                                                                                                                                                                      Entropy (8bit):6.8133383934578005
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:ODpg2QmODTJROAxb4KHA2N8L+0C+6eCKMY3EEsBIzdCGvpzdZROB7G:ThwJN2NSC/glTZ
                                                                                                                                                                                                                      MD5:BD1EC1F4D17DC2CD4FC6AF56816315CB
                                                                                                                                                                                                                      SHA1:967837641D9615251A5714C1356CAD9D57DB528C
                                                                                                                                                                                                                      SHA-256:E66F04440A71EBF67DC8DB8E5C49F5956B43BD0C77D385D7D4C8D16F1E57934E
                                                                                                                                                                                                                      SHA-512:596BFCB49CA96F0D9456D235DA916B58F34EEFA3C4C5DE55F9B62C951FC6D9A5310A5524BAA75138FB2A6C4472473369B9066080C93C6579093290DAE022E0D8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......q..d5..75..75..7<.y7!..7...6 ..7...6?..7...6=..7...61..7!..66..7!..64..7...61..7...6...7!..6 ..75..7...7...6|..7...64..7...74..7...64..7Rich5..7................PE..L...q._...........!.....L...R....../K.......`......................................0.....@.........................._..x...._..........H...............p.... ..\...t!..T....................".......!..@............`..l............................text....J.......L.................. ..`.rdata..\6...`...8...P..............@..@.data....V.......6..................@....qtmetad............................@..P.rsrc...H...........................@..@.reloc..\.... ......................@..B................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\plugins\windows.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4633224
                                                                                                                                                                                                                      Entropy (8bit):7.979606200709923
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:98304:HAZUiwtGX432uu8tHfQOD3S0GfOgAfyel1MqH0yDnkhrj:HNizVCtHft3S0GWP6eAqHHop
                                                                                                                                                                                                                      MD5:7E5628742C540006116FA547418EE2B5
                                                                                                                                                                                                                      SHA1:385B51619287141E70A88F4FF448095574461E04
                                                                                                                                                                                                                      SHA-256:3FF1FD30B35F814D27A23A215BD7C1F761E88A663251412C324F156BFFAB0C41
                                                                                                                                                                                                                      SHA-512:D3348BB5A9A15AF0A9135116ED6A9D40FFBB8B3A6E70D05B5469C470C93F3F699D2E7BE4FB140572918FB04AB285A956DC2CCAA31C2CB883B9A8B419604DE42E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........v;...h...h...h...i...h...i...h...i...h...h...h...i...hk..io..h...h...h...i...h..h..h...h...hk..i...hk..i...hk..h...h...h...hk..i...hRich...h................PE..L...t.f...........!......=.........X@........>..............................P........F...@..........................@N.S....WN.x....pN...............F.x....@.......0N.8...................HbN...............................K.@................... P.=......................... ..` .]....>.....................@..@ ;....pJ.....................@... k\... K.....................@..@ ......K.....................@... +.....K.....................@... ......K.....................@..@ ......K.....................@..@ .`....K..b..................@..B.debug.......0N......p..............@..@.edata.......@N......r..............@..@.idata.......PN......t..

                                                                                                                                                                                                                      C:\Program Files (x86)\GlassWire\uninstall.exe

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):9394760
                                                                                                                                                                                                                      Entropy (8bit):7.948373286582361
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:196608:YYeu/06Y9xSyOQ75l7DoJ/N8rZWqd079q7D+9kb2sMgNlgPAk9o90Ud+dgE/uBe:Y6cbQyvl7DeMWq/7D4ZsMglg4rPNEmA
                                                                                                                                                                                                                      MD5:7260D89877406CE2A512772FBC3122A7
                                                                                                                                                                                                                      SHA1:DA58FA5D89ED435F90C4C33FE6C350CA1425BA0C
                                                                                                                                                                                                                      SHA-256:5CAB9DA9A7EE79F9FF4AED76AE4ACFB4683AD75D8DB290B05C914723700BAB4B
                                                                                                                                                                                                                      SHA-512:E8BC48BF49299CFC29C94577FDAD8B1C933D3A87A460C77B5993985E0DEBB7257157A6ECE161AFC5D95EC4A88EE6A548218B86C80635A3844A3FEDF1B406A2AA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 4%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN.*_...PN..PO.JPN.*_...PN.s~..PN..VH..PN.Rich.PN.........................PE..L....C.f.................j..........R5............@.......................... ...........@..........................................................+..x............................................................................................text....h.......j.................. ..`.rdata..d............n..............@..@.data...............................@....ndata.......P...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Network\Downloader\edb.log

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1310720
                                                                                                                                                                                                                      Entropy (8bit):1.3073471094458293
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:5JCnRjDxImmaooCEYhlOe2Pp4mH45l6MFXDaFXpVv1L0Inc4lfEnogVsiJKrvrg:KooCEYhgYEL0In
                                                                                                                                                                                                                      MD5:A80DC751FBDE9355E4242B18B991A30A
                                                                                                                                                                                                                      SHA1:CEBD203F5076EE1B276EE944F37E46CA107C3003
                                                                                                                                                                                                                      SHA-256:D756F2F565542B5B53FA4B19597B6AFB77D4470F6858EABADB4A6C36A8C48CF1
                                                                                                                                                                                                                      SHA-512:A52AD35EC67E892F50227002AA09502AA17C78E5951E368D8C4A28F1E14A95DAF472333072D2B22AC489AC84D18DA78B69A140661FD9F148F6055C990960C516
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:z3..........@..@.;...{..................<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@..........................................#.................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                      File Type:Extensible storage engine DataBase, version 0x620, checksum 0x3009ffef, page size 16384, DirtyShutdown, Windows version 10.0
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1310720
                                                                                                                                                                                                                      Entropy (8bit):0.4220625361244737
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:JSB2ESB2SSjlK/dvmdMrSU0OrsJzvdYkr3g16T2UPkLk+kTX/Iw4KKCzAkUk1kI6:Jaza/vMUM2Uvz7DO
                                                                                                                                                                                                                      MD5:E3DD0F010A683DAEC0117DC06C43B4E8
                                                                                                                                                                                                                      SHA1:2A4BCE470BF60AB7BC027B194FA786ABD1C48A12
                                                                                                                                                                                                                      SHA-256:AC3AF1AF595A94CE3822F886773BDDCFD0514EE40BEF744EA575B87FFBE9C42F
                                                                                                                                                                                                                      SHA-512:555721ACD6D07B97329FC8821E05D6E4475D831AA7320CF4E3117FF5D60BDE792A269F60B0405FED83E888A2C4E15CFB9A4EF2E4F6A7627067FA1160711276D1
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:0...... .......A.......X\...;...{......................0.!..........{A......|..h.#.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ........;...{...............................................................................................................................................................................................2...{..................................9sU......|..................W..\.....|...........................#......h.#.....................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16384
                                                                                                                                                                                                                      Entropy (8bit):0.07394352606577423
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:svmll/EYeDdp05Cjn13a/Urh/tollcVO/lnlZMxZNQl:sal8zDdak53qIheOewk
                                                                                                                                                                                                                      MD5:796628C5E0185CADD17E9EAE60A43620
                                                                                                                                                                                                                      SHA1:BCF49ECAD42525EE4DE6F612B402E0D6AF572A89
                                                                                                                                                                                                                      SHA-256:87A7A55266C75002B5A615CF42648EF12D2A3806D38FF21971F3EE349C9D3073
                                                                                                                                                                                                                      SHA-512:DB38B512EEA58134BB2B9292569BF7C2CAE7EC76F6E62FA406389A914677778B05E3159CBD3C38790DDE19F4164921375563E4946B62BC75F695BC82F742F6D2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:d..^.....................................;...{.......|.......{A..............{A......{A..........{A]................W..\.....|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GlassWire\GlassWire.lnk

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Mon Aug 12 07:19:56 2024, mtime=Mon Oct 7 15:59:36 2024, atime=Mon Aug 12 07:19:56 2024, length=12010624, window=hide
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1992
                                                                                                                                                                                                                      Entropy (8bit):3.325900357111146
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:88JidOmbfXujYiMEUdvGJPdv3dvmcFvmVm8KyF:8crBgTVm8Ky
                                                                                                                                                                                                                      MD5:4E0751FCB32CB6E079D27B438AC074BC
                                                                                                                                                                                                                      SHA1:A8E3A5C326E9AD9CC9DE7BA99C33ECF1BCD95671
                                                                                                                                                                                                                      SHA-256:ACB3195C3F59E0AD35205C580CD2F55123AD8BE921C9B4F988CB6A1AC5AFBCDE
                                                                                                                                                                                                                      SHA-512:42048182773365183918D225CF9A094608A797FD8F7BB44173AA496FF21A5EE3F5A78F450BB1AEF813511631514D6C39B828039B7C451C257C63995C2317CE01
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:L..................F.@.. ......j.....,.J.......j.....D...........................P.O. .:i.....+00.../C:\.....................1.....GYp...PROGRA~2.........O.IGYp.....................V.....N...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....GYu...GLASSW~1..D......GYp.GYu............................]..G.l.a.s.s.W.i.r.e.....h.2..D...Y|B .GLASSW~1.EXE..L.......Y|BGYs......7........................G.l.a.s.s.W.i.r.e...e.x.e.......]...............-.......\...........Gx.......C:\Program Files (x86)\GlassWire\GlassWire.exe..=.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.l.a.s.s.W.i.r.e.\.G.l.a.s.s.W.i.r.e...e.x.e. .C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.l.a.s.s.W.i.r.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.l.a.s.s.W.i.r.e.\.g.l.a.s.s.w.i.r.e...e.x.e.........%ProgramFiles%\GlassWire\glasswire.exe........................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GlassWire\Uninstall.lnk

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Mon Aug 12 07:20:50 2024, mtime=Mon Oct 7 15:59:38 2024, atime=Mon Aug 12 07:20:50 2024, length=9394760, window=hide
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1992
                                                                                                                                                                                                                      Entropy (8bit):3.3573838960018954
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:8KJidOmbfmPlfjYiBdvOgdv3dvO0vOYoKKyF:8CPlfr6pdYoKKy
                                                                                                                                                                                                                      MD5:0F84D75D1F60B2CFE48CE5500F74D6EE
                                                                                                                                                                                                                      SHA1:6478E71F6CC1191904BA7ABDC353F15FA22EBA41
                                                                                                                                                                                                                      SHA-256:F6A8D4AAE371FE3279352BE34466BD6B59E7FB996EA69C22D79A4FB70C3F64BC
                                                                                                                                                                                                                      SHA-512:723EC68AFE2E342ED97A2093092E2A5F59619ACCB6AE8F9F739F6F48B96B8F4D931170ADB7DF3C02560356F16DFD880FC136DF971DEFA1E092247CD5E1B7954D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:L..................F.@.. .....C.......K......C.....HZ...........................P.O. .:i.....+00.../C:\.....................1.....GYp...PROGRA~2.........O.IGYp.....................V.....N...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....GYu...GLASSW~1..D......GYp.GYu............................]..G.l.a.s.s.W.i.r.e.....h.2.HZ...Y.B .UNINST~1.EXE..L.......Y.BGYt.....u:........................u.n.i.n.s.t.a.l.l...e.x.e.......]...............-.......\...........Gx.......C:\Program Files (x86)\GlassWire\uninstall.exe..=.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.l.a.s.s.W.i.r.e.\.u.n.i.n.s.t.a.l.l...e.x.e. .C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.l.a.s.s.W.i.r.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.l.a.s.s.W.i.r.e.\.u.n.i.n.s.t.a.l.l...e.x.e.........%ProgramFiles%\GlassWire\uninstall.exe........................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\Package Cache\.unverified\cab54A5CABBE7274D8A22EB58060AAB7623 (copy)

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exe
                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 741101 bytes, 10 files, at 0x44 +A "concrt140.dll" +A "msvcp140.dll", flags 0x4, number 1, extra bytes 20 in head, 55 datablocks, 0x1 compression
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):751317
                                                                                                                                                                                                                      Entropy (8bit):7.997626636605057
                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                      SSDEEP:12288:EBv9QZSYUrj5X1crmoI9mjuBnJ/bboSMaxFNxcgsQEoVB52v3rshNFfENxOc:E1YUf/crtIuynJ/bc7ajncCMvbshNFfO
                                                                                                                                                                                                                      MD5:D134ED74DAEC104E48CFA4B67A776C7C
                                                                                                                                                                                                                      SHA1:139AB56A5C69AF96E6A9983D7A09150E5908446D
                                                                                                                                                                                                                      SHA-256:DBEFEB8820F7112D8893822993175E5F822C8F87DAB76A32ED4851C7CE91C3AF
                                                                                                                                                                                                                      SHA-512:7723157F8BD7B3C34787C62AD51390CEEEC558C2E3FD9F581B7B7AD28A205C3C71942BF4F8FD515F83324A9E739892AEC286F797A3A3A9BF01B009103C74D0DF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MSCF.....N......D............................N...'..............7...x..........Sw. .concrt140.dll.x...x......Sx. .msvcp140.dll..S...`.....Sw. .msvcp140_1.dll.x...x......Sx. .msvcp140_2.dll......=.....Sw. .msvcp140_atomic_wait.dll..I..x......Sw. .msvcp140_codecvt_ids.dll.xi...R.....S.. .vcamp140.dll.....p......S.. .vccorlib140.dll..E.........S.. .vcomp140.dll..)..x......S.. .vcruntime140.dll.r#..0..CK.}q|S...IR.h.w[UT6...cA:...B[...J.VZ...P..P\a.Zt.f.':.2.....8...i.Pq.-:6.Q..1.........r...g......=.{....{.......M.......O(.........=...o.//......v.........{Z[...U^......j/Z.....;...S9.=8..O..V...k.%./|...8:.TS}..WSu..WW./.WV.#.....cm.....U.N.+...k..U,D..4q]...-.>w.O|FLD.t*6.V!$$..%....t....Q..lr'....t..$..rT...[..B....>.C61b....&:/.1l... .k.(8.9.f...&.........../.).MT..~.B..4x....j.d.M.z.S....T......?......c..Y........G..} &..t...S....s...:!.!QHr]j.j..n...?....B. ZqY...V.".|...6...#..8....b....#s.RI....$....AB..'..J*B..$HA.Y.o;.......Ep.|. !D...!f...

                                                                                                                                                                                                                      C:\ProgramData\Package Cache\.unverified\cabB3E1576D1FEFBB979E13B1A5379E0B16 (copy)

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exe
                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 5190395 bytes, 14 files, at 0x44 +A "mfc140.dll" +A "mfc140chs.dll", flags 0x4, number 1, extra bytes 20 in head, 326 datablocks, 0x1 compression
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5199531
                                                                                                                                                                                                                      Entropy (8bit):7.998040154478754
                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                      SSDEEP:98304:8Ge4RVS51a9df+phO9erTIt4DNZXDAnWgTSZaEz7OJWI9BKlrUyTfUl6m/80X7R3:8GZgWd2pjTYQNF9gTSZaQFIrUTU6S80V
                                                                                                                                                                                                                      MD5:96A8D83A4459BAE965A4F764017DE36F
                                                                                                                                                                                                                      SHA1:9694A7DEB1153FE9D3A8B560BB2465166AAF09D3
                                                                                                                                                                                                                      SHA-256:8ADDEC5C565DC637402874EFE655B396BFA0C70B892CDED28638663D19E31E13
                                                                                                                                                                                                                      SHA-512:7F2563D262ADA8AE2BF67BCB8FA6E45635267E73F40FF59AB9A4A12946C0221FB19B972E3D96F99D7CABB3B80637587090839C0641F5EDF73683E7C70C527307
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MSCF.....2O.....D............................2O..#..............F.....I........Sx. .mfc140.dll.......I....Sv. .mfc140chs.dll......EJ....Sv. .mfc140cht.dll.......J....Sv. .mfc140deu.dll.x... .K....Sv. .mfc140enu.dll.......L....Sv. .mfc140esn.dll..... .M....Sv. .mfc140fra.dll.x.....N....Sv. .mfc140ita.dll.x.....O....Sv. .mfc140jpn.dll.......P....Sv. .mfc140kor.dll......[Q....Sv. .mfc140rus.dll..;N..VR....Sx. .mfc140u.dll..%..H......Sv. .mfcm140.dll..%........Sv. .mfcm140u.dll.}..Q.4..CK..g...0h.&G.dl..`r#.........E.p.nr.9.09..A$.A...L4A.cp.....s....53..k.yw..v.*.t..o......E......(.'...Y....Y'..i.o...)^...ya..v.m.d..>...^.....>..wJ...w....*..".k..w.7.4S.._9..|..Nk........'.:....}.o.y...|4........p...~...}.0...'\:.q....w........0.#..0...]'.....Q{..v.......F.:.M..z.m...{]4.\SM4....F...../.Eq...j.xL.M..L.}.....5:..]3.w..hR...~..<b\...Q...itU8.I.....*..5......E._..h.l.....([r...,.i..4a.......7~....1.E.+.^'..c........`.~...~E....}.P....x.F..m.........h`.].......\

                                                                                                                                                                                                                      C:\ProgramData\Package Cache\.unverified\vcRuntimeAdditional_x86 (copy)

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2019 X86 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2019 X86 Additional Runtime - 14.29.30139., Template: Intel;1033, Revision Number: {02910D02-C4AB-4DC8-8CDC-AD5C0F55DDF0}, Create Time/Date: Fri Dec 10 22:31:12 2021, Last Saved Time/Date: Fri Dec 10 22:31:12 2021, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.4.4718), Security: 2
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):184320
                                                                                                                                                                                                                      Entropy (8bit):6.377160934619222
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:CviOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJdvW:CvipBaTDo1j//SZh
                                                                                                                                                                                                                      MD5:646FDDAFD57C35DA851B9AE476C32957
                                                                                                                                                                                                                      SHA1:ABC2EA3D74DE00555204D19951A96FAF5EA6F54B
                                                                                                                                                                                                                      SHA-256:E039B37C766848EB4A6012E0A28E0D6ED8CC7D2CDB6FF638FC821BE2B585A071
                                                                                                                                                                                                                      SHA-512:F3C6475E08B408DD166D9C27AB6D9FB22F66BDC24D29F7C2833FBE0EA8E8720321C32F673ABC088BB83D242758F8065A93934E2AE7CE8FE825B9436E99F1D025
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\Package Cache\.unverified\vcRuntimeMinimum_x86 (copy)

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2019 X86 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.29.30139., Template: Intel;1033, Revision Number: {C903B036-1F58-4F43-8CA4-2797FED0F6CC}, Create Time/Date: Fri Dec 10 22:28:10 2021, Last Saved Time/Date: Fri Dec 10 22:28:10 2021, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.4.4718), Security: 2
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):184320
                                                                                                                                                                                                                      Entropy (8bit):6.331822191131053
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:GdviOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJdf:MvipBaTDo1j//SZh
                                                                                                                                                                                                                      MD5:FA1839BB43A4C70969B0FBDC59012A68
                                                                                                                                                                                                                      SHA1:E13B57B6AABBDFB20EB07DB8283E21656EF15C63
                                                                                                                                                                                                                      SHA-256:D6F926690A4A2823C2D507A3682153AF099C8832EE0C700240F28A38625357F8
                                                                                                                                                                                                                      SHA-512:739D5930D7F434CEFAA20AB8396B2497F174789BFA4592EBE6D17BA0DF6ED38437F9F3154100FDE13CBCCC8818CC02BF87622C9EDC2CF43E0DDDCAB4436E20B2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\Package Cache\{1679EF65-55F3-4248-B91E-6B3BE1A69CDF}v14.29.30139\packages\vcRuntimeMinimum_x86\cab1.cab (copy)

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exe
                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 741101 bytes, 10 files, at 0x44 +A "concrt140.dll" +A "msvcp140.dll", flags 0x4, number 1, extra bytes 20 in head, 55 datablocks, 0x1 compression
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):751317
                                                                                                                                                                                                                      Entropy (8bit):7.997626636605057
                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                      SSDEEP:12288:EBv9QZSYUrj5X1crmoI9mjuBnJ/bboSMaxFNxcgsQEoVB52v3rshNFfENxOc:E1YUf/crtIuynJ/bc7ajncCMvbshNFfO
                                                                                                                                                                                                                      MD5:D134ED74DAEC104E48CFA4B67A776C7C
                                                                                                                                                                                                                      SHA1:139AB56A5C69AF96E6A9983D7A09150E5908446D
                                                                                                                                                                                                                      SHA-256:DBEFEB8820F7112D8893822993175E5F822C8F87DAB76A32ED4851C7CE91C3AF
                                                                                                                                                                                                                      SHA-512:7723157F8BD7B3C34787C62AD51390CEEEC558C2E3FD9F581B7B7AD28A205C3C71942BF4F8FD515F83324A9E739892AEC286F797A3A3A9BF01B009103C74D0DF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MSCF.....N......D............................N...'..............7...x..........Sw. .concrt140.dll.x...x......Sx. .msvcp140.dll..S...`.....Sw. .msvcp140_1.dll.x...x......Sx. .msvcp140_2.dll......=.....Sw. .msvcp140_atomic_wait.dll..I..x......Sw. .msvcp140_codecvt_ids.dll.xi...R.....S.. .vcamp140.dll.....p......S.. .vccorlib140.dll..E.........S.. .vcomp140.dll..)..x......S.. .vcruntime140.dll.r#..0..CK.}q|S...IR.h.w[UT6...cA:...B[...J.VZ...P..P\a.Zt.f.':.2.....8...i.Pq.-:6.Q..1.........r...g......=.{....{.......M.......O(.........=...o.//......v.........{Z[...U^......j/Z.....;...S9.=8..O..V...k.%./|...8:.TS}..WSu..WW./.WV.#.....cm.....U.N.+...k..U,D..4q]...-.>w.O|FLD.t*6.V!$$..%....t....Q..lr'....t..$..rT...[..B....>.C61b....&:/.1l... .k.(8.9.f...&.........../.).MT..~.B..4x....j.d.M.z.S....T......?......c..Y........G..} &..t...S....s...:!.!QHr]j.j..n...?....B. ZqY...V.".|...6...#..8....b....#s.RI....$....AB..'..J*B..$HA.Y.o;.......Ep.|. !D...!f...

                                                                                                                                                                                                                      C:\ProgramData\Package Cache\{1679EF65-55F3-4248-B91E-6B3BE1A69CDF}v14.29.30139\packages\vcRuntimeMinimum_x86\vc_runtimeMinimum_x86.msi (copy)

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2019 X86 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.29.30139., Template: Intel;1033, Revision Number: {C903B036-1F58-4F43-8CA4-2797FED0F6CC}, Create Time/Date: Fri Dec 10 22:28:10 2021, Last Saved Time/Date: Fri Dec 10 22:28:10 2021, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.4.4718), Security: 2
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):184320
                                                                                                                                                                                                                      Entropy (8bit):6.331822191131053
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:GdviOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJdf:MvipBaTDo1j//SZh
                                                                                                                                                                                                                      MD5:FA1839BB43A4C70969B0FBDC59012A68
                                                                                                                                                                                                                      SHA1:E13B57B6AABBDFB20EB07DB8283E21656EF15C63
                                                                                                                                                                                                                      SHA-256:D6F926690A4A2823C2D507A3682153AF099C8832EE0C700240F28A38625357F8
                                                                                                                                                                                                                      SHA-512:739D5930D7F434CEFAA20AB8396B2497F174789BFA4592EBE6D17BA0DF6ED38437F9F3154100FDE13CBCCC8818CC02BF87622C9EDC2CF43E0DDDCAB4436E20B2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\Package Cache\{1AEA8854-7597-4CD3-948F-8DE364D94E07}v14.29.30139\packages\vcRuntimeAdditional_x86\cab1.cab (copy)

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exe
                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 5190395 bytes, 14 files, at 0x44 +A "mfc140.dll" +A "mfc140chs.dll", flags 0x4, number 1, extra bytes 20 in head, 326 datablocks, 0x1 compression
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5199531
                                                                                                                                                                                                                      Entropy (8bit):7.998040154478754
                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                      SSDEEP:98304:8Ge4RVS51a9df+phO9erTIt4DNZXDAnWgTSZaEz7OJWI9BKlrUyTfUl6m/80X7R3:8GZgWd2pjTYQNF9gTSZaQFIrUTU6S80V
                                                                                                                                                                                                                      MD5:96A8D83A4459BAE965A4F764017DE36F
                                                                                                                                                                                                                      SHA1:9694A7DEB1153FE9D3A8B560BB2465166AAF09D3
                                                                                                                                                                                                                      SHA-256:8ADDEC5C565DC637402874EFE655B396BFA0C70B892CDED28638663D19E31E13
                                                                                                                                                                                                                      SHA-512:7F2563D262ADA8AE2BF67BCB8FA6E45635267E73F40FF59AB9A4A12946C0221FB19B972E3D96F99D7CABB3B80637587090839C0641F5EDF73683E7C70C527307
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MSCF.....2O.....D............................2O..#..............F.....I........Sx. .mfc140.dll.......I....Sv. .mfc140chs.dll......EJ....Sv. .mfc140cht.dll.......J....Sv. .mfc140deu.dll.x... .K....Sv. .mfc140enu.dll.......L....Sv. .mfc140esn.dll..... .M....Sv. .mfc140fra.dll.x.....N....Sv. .mfc140ita.dll.x.....O....Sv. .mfc140jpn.dll.......P....Sv. .mfc140kor.dll......[Q....Sv. .mfc140rus.dll..;N..VR....Sx. .mfc140u.dll..%..H......Sv. .mfcm140.dll..%........Sv. .mfcm140u.dll.}..Q.4..CK..g...0h.&G.dl..`r#.........E.p.nr.9.09..A$.A...L4A.cp.....s....53..k.yw..v.*.t..o......E......(.'...Y....Y'..i.o...)^...ya..v.m.d..>...^.....>..wJ...w....*..".k..w.7.4S.._9..|..Nk........'.:....}.o.y...|4........p...~...}.0...'\:.q....w........0.#..0...]'.....Q{..v.......F.:.M..z.m...{]4.\SM4....F...../.Eq...j.xL.M..L.}.....5:..]3.w..hR...~..<b\...Q...itU8.I.....*..5......E._..h.l.....([r...,.i..4a.......7~....1.E.+.^'..c........`.~...~E....}.P....x.F..m.........h`.].......\

                                                                                                                                                                                                                      C:\ProgramData\Package Cache\{1AEA8854-7597-4CD3-948F-8DE364D94E07}v14.29.30139\packages\vcRuntimeAdditional_x86\vc_runtimeAdditional_x86.msi (copy)

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2019 X86 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2019 X86 Additional Runtime - 14.29.30139., Template: Intel;1033, Revision Number: {02910D02-C4AB-4DC8-8CDC-AD5C0F55DDF0}, Create Time/Date: Fri Dec 10 22:31:12 2021, Last Saved Time/Date: Fri Dec 10 22:31:12 2021, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.4.4718), Security: 2
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):184320
                                                                                                                                                                                                                      Entropy (8bit):6.377160934619222
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:CviOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJdvW:CvipBaTDo1j//SZh
                                                                                                                                                                                                                      MD5:646FDDAFD57C35DA851B9AE476C32957
                                                                                                                                                                                                                      SHA1:ABC2EA3D74DE00555204D19951A96FAF5EA6F54B
                                                                                                                                                                                                                      SHA-256:E039B37C766848EB4A6012E0A28E0D6ED8CC7D2CDB6FF638FC821BE2B585A071
                                                                                                                                                                                                                      SHA-512:F3C6475E08B408DD166D9C27AB6D9FB22F66BDC24D29F7C2833FBE0EA8E8720321C32F673ABC088BB83D242758F8065A93934E2AE7CE8FE825B9436E99F1D025
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\Package Cache\{8d5fdf81-7022-423f-bd8b-b513a1050ae1}\VC_redist.x86.exe

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exe
                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):647664
                                                                                                                                                                                                                      Entropy (8bit):7.216617738039115
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12288:qnMwHskY7gjcjhVIEhqgM7bWvcsi6aVZPIyBOuJGP9/ztLlFDq2pmV+:kMysZgjS1hqgSC/izZfpJGlbhllBpr
                                                                                                                                                                                                                      MD5:29C7A21BAE42889B08137C25AAE8E55C
                                                                                                                                                                                                                      SHA1:D5CD79CA094C60F64EF7D9069E24270CEE24B4EA
                                                                                                                                                                                                                      SHA-256:82612A2FA05D62929833052CE76788B98701F0C19DCA313923452AFEC44EDEC5
                                                                                                                                                                                                                      SHA-512:484ECDDA526B95D0FD062A2B24BE537DD6C5A5945441DE250CBE2419B98041625505FA51202735CB6054DB444DC1F4BBF0B0E51588500AB89D54D7ADDCA5E2D6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'.u.'.u.'.u.......u.....[.u.....?.u...v.4.u...q.4.u...p...u.....".u....6.u.'.t.v.u...p.l.u....&.u.'..%.u...w.&.u.Rich'.u.........................PE..L......Z.....................v......m.............@..........................p............@..............................................;...............#...0...=.. t..T...................tt......@n..@...................$........................text.............................. ..`.rdata..............................@..@.data...@...........................@....wixburn8...........................@..@.tls................................@....gfids..............................@..@.rsrc....;.......<..................@..@.reloc...=...0...>..................@..B........................................................................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\Package Cache\{8d5fdf81-7022-423f-bd8b-b513a1050ae1}\state.rsm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):956
                                                                                                                                                                                                                      Entropy (8bit):2.6655418033875984
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:7ZK34pgMClGttDa+xU9m4RWYttun2QnRKQ1ApT2un2QnloRKQ1AV:lKUgMClccDRW/9ap5o9a
                                                                                                                                                                                                                      MD5:45CFEF4DCE2A7C705C5AD4414251835E
                                                                                                                                                                                                                      SHA1:D5030CE6BBF6EAE47251D2D5E25692CBDF58234A
                                                                                                                                                                                                                      SHA-256:7F4B3054A8169D43AE20AD506489A42550958DA25C6C32F9AA6FD56FE9BF3AC7
                                                                                                                                                                                                                      SHA-512:A7BB49834967DBA8FF3F19D1532F04ACFC707CC6550D470EA25FD8EBD11754DD8CA4AEE518B607B1E04168252FF67D65F5B86E0D631D62B539E0CC2FF707BBFA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:J...............................................................................................................................................................................................................................................W.i.x.B.u.n.d.l.e.F.o.r.c.e.d.R.e.s.t.a.r.t.P.a.c.k.a.g.e.....................W.i.x.B.u.n.d.l.e.L.a.s.t.U.s.e.d.S.o.u.r.c.e.................................W.i.x.B.u.n.d.l.e.N.a.m.e.....B...M.i.c.r.o.s.o.f.t. .V.i.s.u.a.l. .C.+.+. .2.0.1.5.-.2.0.1.9. .R.e.d.i.s.t.r.i.b.u.t.a.b.l.e. .(.x.8.6.). .-. .1.4...2.9...3.0.1.3.9.............W.i.x.B.u.n.d.l.e.O.r.i.g.i.n.a.l.S.o.u.r.c.e.....?...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.n.s.x.9.6.9.4...t.m.p.\.v.c._.r.e.d.i.s.t...x.8.6...e.x.e.............W.i.x.B.u.n.d.l.e.O.r.i.g.i.n.a.l.S.o.u.r.c.e.F.o.l.d.e.r.........C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.n.s.x.9.6.9.4...t.m.p.\.................................

                                                                                                                                                                                                                      C:\ProgramData\glasswire\service-full\cloud\cloud.db

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
                                                                                                                                                                                                                      File Type:SQLite 3.x database, user version 14, last written using SQLite version 3041002, writer version 2, read version 2, file counter 2, database pages 1, cookie 0, schema 0, unknown 0 encoding, version-valid-for 2
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4096
                                                                                                                                                                                                                      Entropy (8bit):0.09304735440217722
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:lSWFN3l/kl7lBkFll:l9F8
                                                                                                                                                                                                                      MD5:8208771FBCC7A87BB1AC166D67B16BB9
                                                                                                                                                                                                                      SHA1:B746B581900D6571460B76009623FC97AF3D2698
                                                                                                                                                                                                                      SHA-256:54F1CC290C5A9FFB1688FF09705C2434EF880BB3DFA40D0A5FBE56C15CC02BAC
                                                                                                                                                                                                                      SHA-512:24427460F735F491988F663B6BB68A5666600D2CB6615FCF472DA41E21BDAEA160774514A26C033BAF571134246F18D28D5266B87A87BD925C5B2E3C324E6CBA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................f.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\glasswire\service-full\cloud\cloud.db-journal

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
                                                                                                                                                                                                                      File Type:SQLite Rollback Journal
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):512
                                                                                                                                                                                                                      Entropy (8bit):0.27718562076190567
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:7FEG2l/c8FlFll:7+/l/3
                                                                                                                                                                                                                      MD5:8B7C7C32C9455CEB7CEB82492A7CBD81
                                                                                                                                                                                                                      SHA1:A80B1FD2BAC9FB1C882710C91BC25EBAFFEF9E53
                                                                                                                                                                                                                      SHA-256:3C733C0458A7567A217D4E32542B56F46175D3816481390513CEB6BD734D4A3E
                                                                                                                                                                                                                      SHA-512:FDA12182BECE7E5C69556881CC56C3FF74FEA44BBDDCE34DA610BDC3513A621084549D78D80646AB4394448EB270FDC803B40AD637B4D2273DFA76A8F78EC33F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.... .c........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\glasswire\service-full\cloud\cloud.db-shm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):32768
                                                                                                                                                                                                                      Entropy (8bit):0.03615077149675043
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:Gtl8/Yi5QI/VKuD4lltl8/Yi5QI/VKua/l/T89//2lslkl:GtG9Ii4/tG9IJ/T89XCEs
                                                                                                                                                                                                                      MD5:6F88F9F9885A66BDBDC6045EA550F26C
                                                                                                                                                                                                                      SHA1:93DC1A6C84842C0A32216959639003BFCBB95BDD
                                                                                                                                                                                                                      SHA-256:86CFCB3632AF1C8D554119D38870933A4DD4FB95130A8F87418BD8250D73F332
                                                                                                                                                                                                                      SHA-512:BEB076290B28DC305BD62934FF777EB6421DFCA6706A778CAA3E28FA1D5B3160988E50A0EB76CF57331533832C6D20E7CBA36A8A0112BF400AD4354D0C23174D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:..-.....................F.Ed*..s..K...9.o..V....-.....................F.Ed*..s..K...9.o..V..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\glasswire\service-full\cloud\cloud.db-wal

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
                                                                                                                                                                                                                      File Type:SQLite Write-Ahead Log, version 3007000
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4152
                                                                                                                                                                                                                      Entropy (8bit):0.2197746577015545
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:OlH/lIpJIbos6JBgiOYFSWFN3l/kl7lBkFll:KaAUs6YiOo9F8
                                                                                                                                                                                                                      MD5:FEFC063339E3883A33E1DDE552C94A91
                                                                                                                                                                                                                      SHA1:9A63A1069557D5AB0213CBB0E6AFE9AF249B8779
                                                                                                                                                                                                                      SHA-256:D778F031EB3F9A2BD13EF6413BA60BDA31A215E40276F10EEF8F863B68251A4D
                                                                                                                                                                                                                      SHA-512:2CF0DA4317712C4484FD97B98461CCA455460DB7AA57243A1F4BE910EF5A9EA72444985CF380C3C05895EC691404930868E2E75337716AF9806045EFD20A7540
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:7....-............K...9.2...2lL..........K...9dE.Fs..*SQLite format 3......@ ..........................................................................f.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\glasswire\service-full\glasswire.conf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (376), with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1574
                                                                                                                                                                                                                      Entropy (8bit):5.594765187313596
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:WTjDM+HcdLyinQFdQFhiOzI+ALmWLEkuWwTR6ZohajfdqQupjD:KjwtdLyQ+dQFhJz3HWLW2RjMQuV
                                                                                                                                                                                                                      MD5:474E9D352D425F487E123F692A5143D5
                                                                                                                                                                                                                      SHA1:0A0BAC65E73C22EDA730F2F2A51EBCEEF9740CC5
                                                                                                                                                                                                                      SHA-256:FA426DB5230F1F157A79D7D3ED559CB38581E231144DF1156E838C6D67C7627D
                                                                                                                                                                                                                      SHA-512:2267E1F9BCA218FA7987088BD0655C206FD32014420B3D0A34445FAA91EA412678E1E133BB273F49198BDCAA058A4F3767CA98CAB684F3D9BA2D543188E81F8B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:LogDirectory = C:\ProgramData/glasswire/service-full/log..LogLevel = 255..LogEnabled = false..LocalServerPortHigh = 30000..LocalServerPortLow = 20000..LocalServerPort = 20000..PublicServerInterface = 0.0.0.0..PublicServerPortHigh = 8000..PublicServerPortLow = 7000..PublicServerPort = 7010..EnableWhitelist = false..DbPageSize = 4096..DbBusyTimeout = 5000..DbCheckpointThreshold = 500..DbStorageDirectory = C:\ProgramData/glasswire/service-full..NslookupResolversLimit = 5..NslookupEnabled = false..NslookupCacheLifetime = 600..HttpEnableProxy = false..VirusTotalAcceptTos = false..VirusTotalEnableAutoScan = false..VirusTotalApiKey = Base64_ki1gV7jiRcWuvtzUdumbjQ==..IdleModeEnabled = true..IdleModeTimeout = 300..NetworkEnableAutoScan = false..NetworkAutoScanTimeout = 1800..NetworkScanThreadCount = 100..NetworkEnableDhcp = true..NetworkEnableMdns = true..NetworkEnableSnmp = true..NetworkEnableSsdp = true..RemoteAccessEnabled = false..RemoteAccessPassword = Base64_ki1gV7jiRcWuvtzUdumbjQ==..Allo

                                                                                                                                                                                                                      C:\ProgramData\glasswire\service-full\glasswire.db

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
                                                                                                                                                                                                                      File Type:SQLite 3.x database, user version 14, last written using SQLite version 3041002, writer version 2, read version 2, file counter 2, database pages 26, cookie 0x17, schema 4, UTF-8, version-valid-for 2
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):106496
                                                                                                                                                                                                                      Entropy (8bit):0.4800356844668204
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:QpzmxEe0jMPm0LYzF4r3vKZQYBMy7opkE4srkW:gmn0wLYR4r3vKZQWMy7opkE4sr
                                                                                                                                                                                                                      MD5:C36B337AA29178504C71B32DBA3BF085
                                                                                                                                                                                                                      SHA1:F418A61CE6EAB24D5FDC38DD9D7C72FF818F8920
                                                                                                                                                                                                                      SHA-256:7922926CB399A6A0F7B447753F1EEA1C03CE38EAB65727020FF3451F498B5189
                                                                                                                                                                                                                      SHA-512:EBE6F9F4B143CD2C41AD4073D7E2D3F9A2A538F645C86731928DD56881A5347C3D5F94F3F2E11AA77ED865FABD85DE06F6E0DF50891F40E3A5BF354BB38FCB88
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:SQLite format 3......@ ..........................................................................f.......9........C...g.............*.....^.....1.j.........9..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\glasswire\service-full\glasswire.db-journal

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
                                                                                                                                                                                                                      File Type:SQLite Rollback Journal
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):512
                                                                                                                                                                                                                      Entropy (8bit):0.28499812076190567
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:7FEG2l/0cD/ldlFll:7+/l/n
                                                                                                                                                                                                                      MD5:AE704A3499960AC06BBB42EF679A203C
                                                                                                                                                                                                                      SHA1:978BDC88060AACF65336DBDB2D7C633A333ECC51
                                                                                                                                                                                                                      SHA-256:57ACB7982B5D1B1709F299880D35D6C527D7F046E7722178DDFFF6975F5F4E0D
                                                                                                                                                                                                                      SHA-512:ACB79496B334BF5288991B9405546E4293ADA6787CC493AB9979934C6A89CCCEBCF49EA28E62A68DBE05E67ABD883439680060845F4925759162DCD6CDF12772
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.... .c.......g&................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\glasswire\service-full\glasswire.db-shm

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):32768
                                                                                                                                                                                                                      Entropy (8bit):0.09861552257368736
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:vnGWn9jf2EJnt4ASimG4t06UlFnlFlSYR8P:vv9b2ot4emGT33kY
                                                                                                                                                                                                                      MD5:30FDCD30A663EACFECB2CE335461AAA7
                                                                                                                                                                                                                      SHA1:A165682D4B8DC1EFBDA94600F2E489ECD03735EC
                                                                                                                                                                                                                      SHA-256:D55F392A21D103A2F3D03C1FFD578D9219E916C3A462C67D957F41351C17E04B
                                                                                                                                                                                                                      SHA-512:07DABF03A90A48831CE5A71039A8394279A662E1D176278739F21C19D97A2E9C32067DA8B08F6BD503272FC1B88064A71BC8C25E2D5FB557EEC79F1939847723
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:..-...../.......H.......B..:.....J.h....@.(.f...-...../.......H.......B..:.....J.h....@.(.f.H.......H.......................H.......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\glasswire\service-full\glasswire.db-wal

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
                                                                                                                                                                                                                      File Type:SQLite Write-Ahead Log, version 3007000
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):296672
                                                                                                                                                                                                                      Entropy (8bit):1.4706046764937366
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:ujQnZQV3CZQ1r3CZQRdr3CZQ4dr3CZQqdr3CZQrdr3CZQtdr3CZQcdr3CZQfdr3q:q2r0KC
                                                                                                                                                                                                                      MD5:1EF2592E1B798B9EC9C5810758A5E668
                                                                                                                                                                                                                      SHA1:30D8DB3D840D5F0F02F602ACE66E5CB0D10FA382
                                                                                                                                                                                                                      SHA-256:E008C94978E32830C36FAFDA97E7D5BE928D79727CAB1AAF8008CA85BA5C9E0B
                                                                                                                                                                                                                      SHA-512:548DBDDB8C33B4E82EE3801EF0F4622DF263A02A0E21C9AA67EDBF6C55D39D2EE17940F247246D79813822FA66EFD2FECED627372283D6E81D5EAE35A334941B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:7....-...........J.h...~.M....,.........J.h.......l`2SQLite format 3......@ ..........................................................................f.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\ProgramData\glasswire\service-full\log\update\20241007.log

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (527), with CRLF line terminators
                                                                                                                                                                                                                      Category:modified
                                                                                                                                                                                                                      Size (bytes):2966
                                                                                                                                                                                                                      Entropy (8bit):5.518830404605961
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:qSKkLcg6Ydg3iGgcU/zghuPZ83dw3+TO2Sx8rl6i8op1m/83IrGmQKp1gU:/KUTgSGm4yZ83dw3g3SxA5purGmQKXgU
                                                                                                                                                                                                                      MD5:E04E02214A63B66FD3EC35DE70E47B36
                                                                                                                                                                                                                      SHA1:DD5B81173D298845B3A79EC30B46062EF640D3F5
                                                                                                                                                                                                                      SHA-256:0AE6FF8818C8C7ECF6D851CBBA0B0B4FB3E5696CF8D4B8009031562EA22F71B4
                                                                                                                                                                                                                      SHA-512:3353FFC87EBDD1EDBB24FCF59867D3CA88AAB2889D86A5B9C681CCD3745FA91EBD8580C879E855D2B535F9A7E557403D29A37DFDD892E22AEE09B4042022A385
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:2.12:59:09 [EVENT] Setup API initialization: 3.4.694.0.FULL, path: C:\Users\user\Desktop\GlassWireSetup.exe..3.12:59:09 [HINT] IsInstallationAllowed:43: allowed: true..4.12:59:09 [HINT] IsLegacyDriverEnabled:282: status: false..5.12:59:30 [HINT] SetPathAdminPermissions:110: path: C:\Program Files (x86)\GlassWire..6.12:59:30 [HINT] glasswire::libsetup::conversion::DbHandler::GetDbFilepath:57: does not exist: C:\ProgramData/glasswire/service-full/glasswire.conf..7.12:59:30 [HINT] glasswire::win::ReadRegString:24: unable to open type: 3, key: System\GlassWire, name: CloudDeviceId..8.12:59:30 [HINT] glasswire::win::ReadRegString:24: unable to open type: 3, key: System\GlassWire, name: CloudCurrentServer..9.12:59:30 [HINT] glasswire::libsetup::conversion::DbHandler::GetDbFilepath:57: does not exist: C:\ProgramData/glasswire/service-full/glasswire.conf..10.12:59:30 [EVENT] ConversionChain5 check conversion: false..11.12:59:30 [EVENT] Conversion

                                                                                                                                                                                                                      C:\ProgramData\glasswire\share\storage.db

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:SQLite 3.x database, last written using SQLite version 3008011, page size 1024, file counter 1252, database pages 1969, cookie 0x68, schema 4, UTF-16 little endian, version-valid-for 1239
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2999296
                                                                                                                                                                                                                      Entropy (8bit):4.709570795806849
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24576:vtjwDjJ788JTlleY6syNx29qkJR7rSOgwD8:luZPn+n29bRK8g
                                                                                                                                                                                                                      MD5:7F3D766F36C9683A383829027445749B
                                                                                                                                                                                                                      SHA1:C3B1A346F883C3ABE69AB15CA704BFDBD877C137
                                                                                                                                                                                                                      SHA-256:B4E70A2D94A41AD665344064905AE0D65ED5B36BA7B7B43C44580A401236B1FD
                                                                                                                                                                                                                      SHA-512:F312FCC2E8F2EBD8E9E1ED05CE8B73658A6C464762F903E01F85257E33AB4F3DE8ABD90014B1AFF54FEA266647DC406795D7526F8A4E995FA5833F36D781A38E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:SQLite format 3......@ ...................h.....................................................-.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................j..!QQ..5t.a.b.l.e.p.r.o.t.o._.d.e.s.c.r.i.p.t.i.o.n.p.r.o.t.o._.d.e.s.c.r.i.p.t.i.o.n..C.R.E.A.T.E. .T.A.B.L.E. .p.r.o.t.o._.d.e.s.c.r.i.p.t.i.o.n.(. .i.d. .I.N.T.E.G.E.R. .P.R.I.M.A.R.Y. .K.E.Y.,. .d.e.s.c.r.i.p.t.i.o.n. .T.E.X.T. .)..J..!AA...t.a.b.l.e.t.r.a.f.f.i.c._.k.i.n.d.s.t.r.a.f.f.i.c._.k.i.n.d.s..C.R.E.A.T.E. .T.A.B.L.E. .t.r.a.f.f.i.c._.k.i.n.d.s.(. .i.d. .I.N.T.E.G.E.R. .P.R.I.M.A.R.Y. .K.E........J..

                                                                                                                                                                                                                      C:\Users\Public\Desktop\GlassWire.lnk

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Mon Aug 12 07:19:56 2024, mtime=Mon Oct 7 16:00:07 2024, atime=Mon Aug 12 07:19:56 2024, length=12010624, window=hide
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1974
                                                                                                                                                                                                                      Entropy (8bit):3.3228276789858966
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:8HHJidOmbfXujYiMEhdvGJPdv3dvmcFvmVm8KyF:8nrMgTVm8Ky
                                                                                                                                                                                                                      MD5:804A629354A49C7018D36E0DBEDF9AA3
                                                                                                                                                                                                                      SHA1:CFC58E56059C91FACD62C05F526E519596D12A1A
                                                                                                                                                                                                                      SHA-256:53958A24DF3C5860C99A46B7649DD6D431326F4C22232C53AD656728DC437D62
                                                                                                                                                                                                                      SHA-512:D31572483AF096FBD2903287FD9F32DF44EF8AB07BB64F194C190B6DB12E191DF0FAE027A2719AC2E621AED6F0E3FE4337A44D9F45EC92A9714129DD9DEB95DD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:L..................F.@.. ......j.....&.\.......j.....D...........................P.O. .:i.....+00.../C:\.....................1.....GYp...PROGRA~2.........O.IGYp.....................V.....N...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....GYu...GLASSW~1..D......GYp.GYu............................]..G.l.a.s.s.W.i.r.e.....h.2..D...Y|B .GLASSW~1.EXE..L.......Y|BGYs......7........................G.l.a.s.s.W.i.r.e...e.x.e.......]...............-.......\...........Gx.......C:\Program Files (x86)\GlassWire\GlassWire.exe..4.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.l.a.s.s.W.i.r.e.\.G.l.a.s.s.W.i.r.e...e.x.e. .C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.l.a.s.s.W.i.r.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.l.a.s.s.W.i.r.e.\.g.l.a.s.s.w.i.r.e...e.x.e.........%ProgramFiles%\GlassWire\glasswire.exe..........................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\GlassWire\client-full\client.conf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Program Files (x86)\GlassWire\GlassWire.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):10
                                                                                                                                                                                                                      Entropy (8bit):2.6464393446710157
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:JVlF:j
                                                                                                                                                                                                                      MD5:7BE781EF8988358D580EE9ADE78B51A0
                                                                                                                                                                                                                      SHA1:FD3651A53718FD6B015D900C5A882D6567AD062B
                                                                                                                                                                                                                      SHA-256:04A1A6D9A9A53F5C1C0FA01C59AF58C298FCD056622E960A28EAFD5399D877DF
                                                                                                                                                                                                                      SHA-512:B570510E9E03436DA8C90908FA8E6098681A953DE441E9445FBDF0F06DFF6B803DA708059EAED08156E2E3742A95B117267924B3C0D6B0820C15D12321F342EB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.."...p.".

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\GlassWire\client-full\log\20241007.log

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Program Files (x86)\GlassWire\GlassWire.exe
                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:modified
                                                                                                                                                                                                                      Size (bytes):8641
                                                                                                                                                                                                                      Entropy (8bit):5.146825622837323
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:/kkHBK50AfzJgpgByV53t7xGQG68GvG0aGmGJGEcG3VTYRZZ3mXNk6BKEdBfuJhX:wlWbvX1ueaavdsuiNWCzu6
                                                                                                                                                                                                                      MD5:E5A0FD8C99B51F639D2F9F43B928C3BF
                                                                                                                                                                                                                      SHA1:68AA5C8587A166C7698EDE93CAD85F8A005BB754
                                                                                                                                                                                                                      SHA-256:256544345F63FE472C1D8593C0EC11B62EB66635A5E0F35BE9AD3548DCF29206
                                                                                                                                                                                                                      SHA-512:7D601D5CA3BA5E9BB8F1EAB8EED0C776E1F53357A285BCA5FB2F6A0A2F13EAF03C27297DE9AEE61F1738A4F2125013FEDFAAA41B7E3A8EC3590B0060A0F88A6C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:0.13:00:16 [HINT] GlassWire: Loaded font families from ":/Fonts/Oswald-Regular.ttf" : ("Oswald")..1.13:00:16 [HINT] GlassWire: Loaded font families from ":/Fonts/Oswald-Bold.ttf" : ("Oswald")..2.13:00:16 [HINT] GlassWire: Loaded font families from ":/Fonts/Oswald-Light.ttf" : ("Oswald Light")..3.13:00:16 [HINT] GlassWire: Loaded font families from ":/Fonts/OpenSans-CondLight.ttf" : ("Open Sans Condensed Light")..4.13:00:16 [HINT] GlassWire: Loaded font families from ":/Fonts/OpenSans-CondBold.ttf" : ("Open Sans Condensed")..5.13:00:16 [HINT] GlassWire: Loaded font families from ":/Fonts/Roboto-Light.ttf" : ("Roboto Light")..6.13:00:16 [HINT] GlassWire: Loaded font families from ":/Fonts/Roboto-Regular.ttf" : ("Roboto")..7.13:00:16 [HINT] GlassWire: Loaded font families from ":/Fonts/RobotoCondensed-Bold.ttf" : ("Roboto Condensed")..8.13:00:16 [HINT] GlassWire: Loaded font families from ":/Fonts/Roboto-Medium.ttf" : ("Roboto Medium")

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\runonce.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):24576
                                                                                                                                                                                                                      Entropy (8bit):2.094792623310585
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:aJiQSse1o38n3ZgrrJ4q4LALilXAyt3Z3QSZUSDDXufviIsVjNaDt2KIqdLMtC+v:3N
                                                                                                                                                                                                                      MD5:D569C799FA23CEE512F66A8D43EEE1D5
                                                                                                                                                                                                                      SHA1:8F52C56BC0B107F9910187F976775E87AC220899
                                                                                                                                                                                                                      SHA-256:2F5B7B4C0B09C32C608E1EDDE62F26A21AED67530E38BAD454F37AD237588D21
                                                                                                                                                                                                                      SHA-512:4F973B642534F5F3CAEF45006501726687501099865777C8F4056D07EAC33C26CCF590FF5EB0CF6B4200641A2EFA3C7759428DEFABCECA4DE2B7F8B88C619499
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:. .........................................................................................>............. ......eJ......fj.R....Zb..............................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................r..............C..R............E.x.p.l.o.r.e.r.S.t.a.r.t.u.p.L.o.g._.R.u.n.O.n.c.e...C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.M.i.c.r.o.s.o.f.t.\.W.i.n.d.o.w.s.\.E.x.p.l.o.r.e.r.\.E.x.p.l.o.r.e.r.S.t.a.r.t.u.p.L.o.g._.R.u.n.O.n.c.e...e.t.l...........P.P.........l..>............................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\dd_vcredist_x86_20241007125848.log

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:ASCII text, with very long lines (321), with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):16461
                                                                                                                                                                                                                      Entropy (8bit):5.527100732495603
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:BXC1nF1d1j1g1M1T1Z1+1hBp6cmZ2xT2RpmJIC/ulgN9D2pm3Rgq6s:BXqEBp66k6by4BPT
                                                                                                                                                                                                                      MD5:845E4D107946AA187EF83DC935CAD5EC
                                                                                                                                                                                                                      SHA1:08E9705ADB1E0BC9843BABAAA92DE3D9709D7A5C
                                                                                                                                                                                                                      SHA-256:48843F24FA3AC29FDAA2BC73251A8A2522A3F4AB1E714F0B96591C6A62689F33
                                                                                                                                                                                                                      SHA-512:A9A710E5F0A107DAF3EC9C42C63778C54321890045A89F56D5AE1ACF9122BDE5C7AEF93B9BE21AF9A48209757EAEC17A337ACA1CAE5E8B8C617469567ED6263C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:[047C:1318][2024-10-07T12:58:48]i001: Burn v3.10.4.4718, Windows v10.0 (Build 19045: Service Pack 0), path: C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe..[047C:1318][2024-10-07T12:58:48]i009: Command Line: '-burn.clean.room=C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exe -burn.filehandle.attached=524 -burn.filehandle.self=640 /install /quiet /norestart'..[047C:1318][2024-10-07T12:58:48]i000: Setting string variable 'WixBundleOriginalSource' to value 'C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exe'..[047C:1318][2024-10-07T12:58:48]i000: Setting string variable 'WixBundleOriginalSourceFolder' to value 'C:\Users\user\AppData\Local\Temp\nsx9694.tmp\'..[047C:1318][2024-10-07T12:58:48]i000: Setting string variable 'WixBundleLog' to value 'C:\Users\user\AppData\Local\Temp\dd_vcredist_x86_20241007125848.log'..[047C:1318][2024-10-07T12:58:48]i000: Setting string variable 'WixBundleName' to value 'Microsoft Visual C++ 2015-2019 R

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\dd_vcredist_x86_20241007125848_000_vcRuntimeMinimum_x86.log

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (319), with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):138832
                                                                                                                                                                                                                      Entropy (8bit):3.8340458760417078
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:xpAh/3hJL8ec/QVq7QORTRpg5LL4SaK2Jy04qKIIijLoWssssssssjRMXgpP:x1njLoWssssssssjRMXgR
                                                                                                                                                                                                                      MD5:0E7B9368529EBE717BAB06E974288E1C
                                                                                                                                                                                                                      SHA1:34D22A6901FA5FE31DED06472640764629937AA6
                                                                                                                                                                                                                      SHA-256:96F23A2DFA1FC907D110056150F583CE40975BD1150E2A0CBD62B78BA111008F
                                                                                                                                                                                                                      SHA-512:47B0D66911945F8CE149E358B29C48BFB0D0BBB6D2848D03BE488C10595976C85DF87042909EA6F6EC215209EF3D5E072826BF69A8EAB4A11BF7A615D6AC77F0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .0.7./.1.0./.2.0.2.4. . .1.2.:.5.9.:.0.2. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.{.A.3.6.1.2.F.E.9.-.3.C.2.2.-.4.0.9.8.-.9.8.C.3.-.2.C.D.9.1.2.1.8.6.6.6.B.}.\...b.e.\.V.C._.r.e.d.i.s.t...x.8.6...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.0.0.:.0.8.). .[.1.2.:.5.9.:.0.2.:.3.2.2.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.0.0.:.0.8.). .[.1.2.:.5.9.:.0.2.:.3.2.2.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .0.....M.S.I. .(.c.). .(.0.0.:.0.8.). .[.1.2.:.5.9.:.0.2.:.3.2.2.].:. .*.*.*.*.*.*.*. .R.u.n.E.n.g.i.n.e.:..... . . . . . . . . . . .*.*.*.*.*.*.*. .P.r.o.d.u.c.t.:. .C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.P.a.c.k.a.g.e. .C.a.c.h.e.\.{.1.6.7.9.E.F.6.5.-.5.5.F.3.-.4.2.4.8.-.B.9.1.E.-.6.B.3.B.E.1.A.6.9.C.D.F.}.v.1.4...2.9...3.0.1.3.9.\.p.a.c.k.a.g.e.s.\.v.c.R.u.n.t.i.m.e.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\dd_vcredist_x86_20241007125848_001_vcRuntimeAdditional_x86.log

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:Unicode text, UTF-16, little-endian text, with very long lines (411), with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):146532
                                                                                                                                                                                                                      Entropy (8bit):3.829992685235803
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:N1hjejssssssQQQQQQQO7bGPF56htLjqRtsmxV:Jjh
                                                                                                                                                                                                                      MD5:73FB3578927AD7736251225239D75524
                                                                                                                                                                                                                      SHA1:DEA9149D8EACC7DE12D2181ED0A4E91A1A134692
                                                                                                                                                                                                                      SHA-256:9ED718C22F89F31FB38D4EC5AF6F6E3590D536BFC43011367338538A630A40D2
                                                                                                                                                                                                                      SHA-512:A7741060E6ED7903D7E4FCB996FC220666A0DC58EF27BA9B867AEDCE5443D33557EE99480FFC28BA1373AA5E40C45131CA691A994BC419A30334CED86B6F4C37
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:..=.=.=. .V.e.r.b.o.s.e. .l.o.g.g.i.n.g. .s.t.a.r.t.e.d.:. .0.7./.1.0./.2.0.2.4. . .1.2.:.5.9.:.0.4. . .B.u.i.l.d. .t.y.p.e.:. .S.H.I.P. .U.N.I.C.O.D.E. .5...0.0...1.0.0.1.1...0.0. . .C.a.l.l.i.n.g. .p.r.o.c.e.s.s.:. .C.:.\.W.i.n.d.o.w.s.\.T.e.m.p.\.{.A.3.6.1.2.F.E.9.-.3.C.2.2.-.4.0.9.8.-.9.8.C.3.-.2.C.D.9.1.2.1.8.6.6.6.B.}.\...b.e.\.V.C._.r.e.d.i.s.t...x.8.6...e.x.e. .=.=.=.....M.S.I. .(.c.). .(.0.0.:.9.0.). .[.1.2.:.5.9.:.0.4.:.6.5.0.].:. .R.e.s.e.t.t.i.n.g. .c.a.c.h.e.d. .p.o.l.i.c.y. .v.a.l.u.e.s.....M.S.I. .(.c.). .(.0.0.:.9.0.). .[.1.2.:.5.9.:.0.4.:.6.5.0.].:. .M.a.c.h.i.n.e. .p.o.l.i.c.y. .v.a.l.u.e. .'.D.e.b.u.g.'. .i.s. .0.....M.S.I. .(.c.). .(.0.0.:.9.0.). .[.1.2.:.5.9.:.0.4.:.6.5.0.].:. .*.*.*.*.*.*.*. .R.u.n.E.n.g.i.n.e.:..... . . . . . . . . . . .*.*.*.*.*.*.*. .P.r.o.d.u.c.t.:. .C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.P.a.c.k.a.g.e. .C.a.c.h.e.\.{.1.A.E.A.8.8.5.4.-.7.5.9.7.-.4.C.D.3.-.9.4.8.F.-.8.D.E.3.6.4.D.9.4.E.0.7.}.v.1.4...2.9...3.0.1.3.9.\.p.a.c.k.a.g.e.s.\.v.c.R.u.n.t.i.m.e.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exe

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2570352
                                                                                                                                                                                                                      Entropy (8bit):7.946340125492999
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:49152:Rqw7bp+BiEgd1qWIZ1ps+zr8skwNo5vhMnLN6XEWxSQStyO4Dn8YP:kO4vd+hQLYXNxSxtyO4Dn8O
                                                                                                                                                                                                                      MD5:63DC9E4A693261F14924D8692D2EB442
                                                                                                                                                                                                                      SHA1:C21F8937FB695AA31FDB17E265E3D35477E09BD3
                                                                                                                                                                                                                      SHA-256:83861D09519D18D5050B996CF1E7D99577EA0E5D9D34F1BC4AC90CD985DA8969
                                                                                                                                                                                                                      SHA-512:B15E7D01BD94D2E5FF5B8DB2436CE79FC85CCD72C0527B131CA06496F28451540300F583085721AAF56F105DCF7781353A35765AA7DAEB08B380E52988DF9782
                                                                                                                                                                                                                      Malicious:true
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8It.|(.V|(.V|(.VuP.Vv(.V.].W~(.V.].Wo(.V.].Wp(.V.].W}(.V7P.W{(.V|(.VO(.V.].W}(.V.].V}(.V|(.V}(.V.].W}(.VRich|(.V................PE..L...3.f.................:...>......X.?......P....@..........................`f.....A.'...@...........................................................'.p...............8........................................................................... .9.......................... ..` ]....P......................@..@ p....p......................@... $...........................@..@ p...........................@..@ ............................@..@ ............................@..@ ............."..............@..B.debug...............&..............@..@.idata...............(..............@....rsrc................,..............@..@.themida..>..........2..............`....boot.....&...?.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsx9694.tmp\StartMenu.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7680
                                                                                                                                                                                                                      Entropy (8bit):4.64602897905866
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:FxIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/t3lkCTcaqHCI:4hE+A0+sF6piUFkAxlncviI
                                                                                                                                                                                                                      MD5:DC91F181F9CB870FFF0C58BC0EA63EDA
                                                                                                                                                                                                                      SHA1:CC37E24F6071DEA801D0EB59BCC2A9221CF1C74B
                                                                                                                                                                                                                      SHA-256:E74F442771F034A24B77D3A849B343551BDEF69EF151C622CB9FD5F34DCCDA81
                                                                                                                                                                                                                      SHA-512:714605CAD60DCA30DA96172B5CA1A1D8838D27F0A9979AA0DB125D373CD3E015AE6B39C7B7D2B3FC9A4B5433FF1D7D2427CAF3A2B5D1AE321E218D3C8FE8F9A4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........I...(...(...(...(...(..<'...(.......(..8....(.......(..Rich.(..........................PE..L....C.f...........!.........8............... ............................................@..........................$..e.... ..x....`..(....................p..t.................................................... ...............................text............................... ..`.rdata..U.... ......................@..@.data...t*...0......................@....rsrc...(....`......................@..@.reloc..B....p......................@..B................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsx9694.tmp\System.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):12288
                                                                                                                                                                                                                      Entropy (8bit):5.804946284177748
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
                                                                                                                                                                                                                      MD5:192639861E3DC2DC5C08BB8F8C7260D5
                                                                                                                                                                                                                      SHA1:58D30E460609E22FA0098BC27D928B689EF9AF78
                                                                                                                                                                                                                      SHA-256:23D618A0293C78CE00F7C6E6DD8B8923621DA7DD1F63A070163EF4C0EC3033D6
                                                                                                                                                                                                                      SHA-512:6E573D8B2EF6ED719E271FD0B2FD9CD451F61FC9A9459330108D6D7A65A0F64016303318CAD787AA1D5334BA670D8F1C7C13074E1BE550B4A316963ECC465CDC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qr*.5.D.5.D.5.D...J.2.D.5.E.!.D.....2.D.a0t.1.D.V1n.4.D..3@.4.D.Rich5.D.........PE..L....C.f...........!....."...........*.......@...............................p............@..........................B.......@..P............................`.......................................................@..X............................text.... .......".................. ..`.rdata..c....@.......&..............@..@.data...x....P.......*..............@....reloc.......`.......,..............@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsx9694.tmp\eventlog.man

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):20864
                                                                                                                                                                                                                      Entropy (8bit):4.611782568279928
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:4A+vuyN/IVkeCzVptk+gZ0KuApUqnNVBh:4WDD
                                                                                                                                                                                                                      MD5:690FF28D524728616F1ADA1B5071BF13
                                                                                                                                                                                                                      SHA1:2FDF5FE9F8D1BF7A40C88AA6728A5735715AC994
                                                                                                                                                                                                                      SHA-256:909D481F3FBFDFBCC18B9C9743F8C9C00D822671013A8BB521D9F3E7E949FC6D
                                                                                                                                                                                                                      SHA-512:DCC1DEC2AF9B198B1A101C8D47BE0F43693090D9CDB3638B9B68825A158EB514156C4AA033C1B7A5B480DC38181741C5379C99A2B661D4CB8906CF68E8451BBE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="UTF-8"?>..<instrumentationManifest.. xmlns="http://schemas.microsoft.com/win/2004/08/events".. xmlns:trace="http://schemas.microsoft.com/win/2004/08/events/trace".. xmlns:win="http://manifests.microsoft.com/win/2004/08/windows/events".. xmlns:xs="http://www.w3.org/2001/XMLSchema".. xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://schemas.microsoft.com/win/2004/08/events eventman.xsd">.. <instrumentation>.. <events>.. <provider name="GlassWire" guid="{E1A51A95-B1B8-45BD-B370-83748B932E1A}" symbol="GlassWireProviderId" resourceFileName="weventlog.dll" messageFileName="weventlog.dll" message="$(string.GlassWire.Message)">.... <channels>.. <channel name="Alerts" chid="Alerts" symbol="AlertsChannel" type="Operational" enabled="false" message="$(string.Alerts.Message)" />.. </channels>.... <events>.. <event symbol

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsx9694.tmp\modern-header.bmp

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PC bitmap, Windows 3.x format, 150 x 57 x 24, image size 25766, resolution 2834 x 2834 px/m, cbSize 25820, bits offset 54
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):25820
                                                                                                                                                                                                                      Entropy (8bit):1.9158020904286468
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:eHt5llllllllypCx000000000J3pEJa+J7tLoMo0GmSIBlooZm64s+h/ECaO7VEO:eHt6xxERpobIvoooBsWsZOh/
                                                                                                                                                                                                                      MD5:89BE6289EA3EC25315AF4E80E1A10FA7
                                                                                                                                                                                                                      SHA1:C0306FDC801EF6767928DDFFE4F088929C8D1937
                                                                                                                                                                                                                      SHA-256:B7B2F83CAB8F2AAB8B3E7C2A38A745CB56A86C1FABEFF6387A401D0763E6BD44
                                                                                                                                                                                                                      SHA-512:25D7C144034E78AD5284560A3E523135E5367F300DAE99092CDE5C4169606B5D4F9683309A482CEE5FE5035D40A60101CF3F90FDF9A725A223DA927453AF61B5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:BM.d......6...(.......9............d....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................t...................................................................................................................................................................................................................................................................................................................................................................................................................................................................t...........................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsx9694.tmp\modern-wizard.bmp

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PC bitmap, Windows 3.x format, 164 x 314 x 24, image size 154490, resolution 2834 x 2834 px/m, cbSize 154544, bits offset 54
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):154544
                                                                                                                                                                                                                      Entropy (8bit):3.7743452831256343
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:Q+hFuiPuC2vL5555555555555ULDVCOUC7w+WPzT8DFUlxrxRuKT+:FhTxg5555555555555lwq8DFUlxFRy
                                                                                                                                                                                                                      MD5:5ECEC18BA2EAD66BA733E302EC57CF13
                                                                                                                                                                                                                      SHA1:910322900F1360B9CAACEC62A361AFED0ABA825E
                                                                                                                                                                                                                      SHA-256:8A20F1F8C29842153C4A5AD53815EA6DA1FF4780D1FC68C8C4178B6B2B8701C2
                                                                                                                                                                                                                      SHA-512:9F1420EB28E93EA0D12F3CC8CAF1762F69AB30654C81B7F28A604786203A005C6316C954E2131DDFF855DE6FCEC4FCEE2C1D13E03D8669E88CAA236D3F0179D5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:BM.[......6...(.......:...........z[........................o.._..J..;..7..3...~.+}.,}.-~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./}./..................../../../~./|./}./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~./~.;x..............u..W..A..7~.-|.$z.$z.&z.({.){.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*y.*..(..(..(..(..(..(..(..(..)..)..*..*{.*w.*z.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*{.*

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsx9694.tmp\nsDialogs.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):9728
                                                                                                                                                                                                                      Entropy (8bit):5.157714967617029
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
                                                                                                                                                                                                                      MD5:B7D61F3F56ABF7B7FF0D4E7DA3AD783D
                                                                                                                                                                                                                      SHA1:15AB5219C0E77FD9652BC62FF390B8E6846C8E3E
                                                                                                                                                                                                                      SHA-256:89A82C4849C21DFE765052681E1FAD02D2D7B13C8B5075880C52423DCA72A912
                                                                                                                                                                                                                      SHA-512:6467C0DE680FADB8078BDAA0D560D2B228F5A22D4D8358A1C7D564C6EBCEFACE5D377B870EAF8985FBEE727001DA569867554154D568E3B37F674096BBAFAFB8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......|..c8O`08O`08O`08Oa0.O`0.@=05O`0llP0=O`0.If09O`0.od09O`0Rich8O`0........PE..L....C.f...........!.........0......g........0............................................@..........................6..k....0.......p...............................................................................0...............................text............................... ..`.rdata..{....0......................@..@.data...h!...@......................@....rsrc........p....... ..............@..@.reloc..~............"..............@..B................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsx9694.tmp\nsExec.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7168
                                                                                                                                                                                                                      Entropy (8bit):5.295306975422517
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:JgzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHIDQ:JDQHDb2vSuOc41ZfUNQZGdHA
                                                                                                                                                                                                                      MD5:11092C1D3FBB449A60695C44F9F3D183
                                                                                                                                                                                                                      SHA1:B89D614755F2E943DF4D510D87A7FC1A3BCF5A33
                                                                                                                                                                                                                      SHA-256:2CD3A2D4053954DB1196E2526545C36DFC138C6DE9B81F6264632F3132843C77
                                                                                                                                                                                                                      SHA-512:C182E0A1F0044B67B4B9FB66CEF9C4955629F6811D98BBFFA99225B03C43C33B1E85CACABB39F2C45EAD81CD85E98B201D5F9DA4EE0038423B1AD947270C134A
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,.................Rich...........................PE..L....C.f...........!......................... ...............................P............@..........................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..<.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsx9694.tmp\nsihelper.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):6375040
                                                                                                                                                                                                                      Entropy (8bit):7.984354271188515
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:196608:l5l7DoJ/N8rZWqd079q7D+9kb2sMgNlgPAk9o90Ud+dgE/uBeR:3l7DeMWq/7D4ZsMglg4rPNEmAR
                                                                                                                                                                                                                      MD5:E66D698421B463011B570FDF253478FF
                                                                                                                                                                                                                      SHA1:52F2F97E78E2A1389835F24CA6D435768427CD6D
                                                                                                                                                                                                                      SHA-256:03FB90CA99BF6CF9808DA0E473897F7D8DCDDDEBB1CB1515B8BBBB090AEE39CD
                                                                                                                                                                                                                      SHA-512:B08522F9A46E49A2C1A0F26B9D6BE0FCB17D78C880F4C33A70462EACB2618BBE05EDB0F5BF33BE1A2430295B9CF8FBF9C0096A479F0DE6495B81503432EB9118
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 3%
                                                                                                                                                                                                                      Preview:MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$.......f.."..."..."...+.H.4...D.&.%...p...(...p...-...p...$.....&. ...p.......i...#...i...7..."...5.......T..."...@...............#.....$.#...".L.#.......#...Rich"...................PE..L...1.f...........!.....Tn..d......Xp.......pn.............................. ......3.a...@..........................0.......C.......`................a.p............ ..8...................HR..................................`................... .Rn.......(................. ..` {....pn..|... (.............@..@ H....@...B....0.............@... [h............0.............@..@ ..............0.............@... +.............0.............@... ..............0.............@..@ ..............0.............@..@ ._.......t....0.............@..B.debug....... .......b3.............@..@.edata.......0.......d3.............@..@.idata..

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exe

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):13787064
                                                                                                                                                                                                                      Entropy (8bit):7.995236480074008
                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                      SSDEEP:393216:eEHMlptVYmfr7yBG/4u1ma3R9kCX83LHqD:eeApttD7yBG/Fm8Hg2D
                                                                                                                                                                                                                      MD5:DD0232EE751164EAAD2FE0DE7158D77D
                                                                                                                                                                                                                      SHA1:7391663F07CBA7C99F3503929FCD3561F1F6A552
                                                                                                                                                                                                                      SHA-256:4C6C420CF4CBF2C9C9ED476E96580AE92A97B2822C21329A2E49E8439AC5AD30
                                                                                                                                                                                                                      SHA-512:CC82A7A8EAD3C036559109D4DAEE623622EDD4B4B5241545EFA0E36D906C1AF10D4056AD003F8849475F4E1E625EB9F27DE7A9E13B28AC7AB88DA99D5F926C2E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'.u.'.u.'.u.......u.....[.u.....?.u...v.4.u...q.4.u...p...u.....".u....6.u.'.t.v.u...p.l.u....&.u.'..%.u...w.&.u.Rich'.u.........................PE..L......Z.....................v......m.............@..........................p......C_....@..............................................;...........;...$...0...=.. t..T...................tt......@n..@...................$........................text.............................. ..`.rdata..............................@..@.data...@...........................@....wixburn8...........................@..@.tls................................@....gfids..............................@..@.rsrc....;.......<..................@..@.reloc...=...0...>..................@..B........................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{1b9ae675-a69a-784f-a0a3-d898132a09ba}\SET898F.tmp

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):11615
                                                                                                                                                                                                                      Entropy (8bit):7.3868789934614245
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:wOOgvXhARJCUnEwKUNhYCBkyLrp0KBQfX01k9z3AX6USwFVW:xARgUNh3BkyRxB+R9zW7HW
                                                                                                                                                                                                                      MD5:542FCDD371B6C4D2D8689514BD618AF5
                                                                                                                                                                                                                      SHA1:36A4959B6100263D4E0615E981E08E425604FCEC
                                                                                                                                                                                                                      SHA-256:0BA953EDEA4CACC7FFA37275B95B5DAD3BF8410E8649C1B98D9C59336ED01D2E
                                                                                                                                                                                                                      SHA-512:A951AA9AA5729A59C8CF31F65F1EBE1BC2037AC53393EBF5D859B95A66F1701DBCD1E466A49ACD80A56E44039C0D6E4D5CA6247A98EF9D341EF3C4227FFE68FC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:0.-[..*.H........-L0.-H...1.0...`.H.e......0.....+.....7......0...0...+.....7.......5.v.E...R.|....240617150138Z0...+.....7.....0..?0....z..lbX...i##.d>j.t=1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...s.y.s...0.....s..Q.`a..Z....:...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...i.n.f...0.... ...U...;.}A@.K..M..u..K.7..C0!.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ...U...;.}A@.K..M..u..K.7..C0!.0... .KZze..J7......~....*........H.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .KZze..J7......~....*........H.....0...0....+.....7......0.....S.u.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{1b9ae675-a69a-784f-a0a3-d898132a09ba}\SET899F.tmp

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                      File Type:Windows setup INFormation
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2458
                                                                                                                                                                                                                      Entropy (8bit):4.908381744177934
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:McNx2HvlzPtPbdZ0d7OPd/eohC/fr+ypHhqFWi4lTXlfv:McNx2P5hbdyd7O9eYEfFoEDlfv
                                                                                                                                                                                                                      MD5:4ADE9CA0F531877BF4AFA77A0122FE46
                                                                                                                                                                                                                      SHA1:A973FDC751DE606195E4BF5ADEF604863A13111F
                                                                                                                                                                                                                      SHA-256:BE4B5A7A65B0064A37FEE1CAD48385827ED9E50BA22A95E6CCDEF49DD5C248A5
                                                                                                                                                                                                                      SHA-512:EAA5E18E04FF44C1120DD6F951A954BEE85000507F3D1579BF23FB360B9BDEE05FD4BE15154304712A9B4E528CF961EDBD64F112E61A70CF0FBDFCC2AE72E307
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:;..; generic-driver.inf..; .NT$ARCH$....[Version].. Signature = "$WINDOWS NT$".. Class = GlassWire.. ClassGuid = {917D8DAF-DE89-44B7-8907-B422ECB01F53}.. Provider = %ManufacturerName%.. CatalogFile = gwdrv.cat.. DriverVer = 06/17/2024,17.44.6.748.. PnpLockdown = 1....;********************************************..; driver install section..;********************************************....[SourceDisksNames].. 1 = %DiskName%,,,""....[SourceDisksFiles].. gwdrv.sys = 1,,....[DestinationDirs].. DefaultDestDir = 12 ; %windir%\system32\drivers.. GwGeneric.DriverFiles = 12 ; %windir%\system32\drivers....[DefaultInstall.NTamd64].. OptionDesc = %GwGenericDriverDescription%.. CopyFiles = GwGeneric.CopyDriverFiles....[DefaultUninstall.NTamd64].. LegacyUninstall=1.. DelFiles = GwGeneric.DeleteDriverFiles....[GwGeneric.CopyDriverFiles].. gwdrv.sys,,,0x00000040 ; COPYFLG_OVERWRITE_OLDER_ONLY....[GwGeneric.DeleteD

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{1b9ae675-a69a-784f-a0a3-d898132a09ba}\SET89B0.tmp

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):48296
                                                                                                                                                                                                                      Entropy (8bit):6.297840034594717
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:E0v8QOvjN2NGTn77rmisnSENWGvw4emXubnjeW5aYz6lBhJ/4tBH3ZEpw9zYUb0:E0EQOv4NGTn77rmisnSeWGvBaGJ/4tB8
                                                                                                                                                                                                                      MD5:715021B0BC7B2E8E3C13B384CDE5B392
                                                                                                                                                                                                                      SHA1:006275D68C8A2BA58477AED1980835EB58512329
                                                                                                                                                                                                                      SHA-256:42B85F2E37FFE04970D6BB1476978046EAD72DDF57392E396AD54A08B52A4AA0
                                                                                                                                                                                                                      SHA-512:BEBB72A7F11694463DDFD7575E67F078360BF32C75B0630FDEE30BC8A5649E53C2F56BFDF55ADD494CADA9A78C6E58E25FF675AA432E296F5D1CF6AE0595E910
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5...[D..[D..[D..\E..[D..]E..[D..XE..[D.._E..[D..ZE..[D..ZD..[D.`_E..[D.`.D..[D.`YE..[DRich..[D........................PE..d....Kpf.........."....(.n...$......Pl.........@....................................4}.....A................................................0...d.......(.......l........(.......... ...8...............................@............................................text....f.......h.................. ..h.rdata..h............l..............@..H.data...h............~..............@....pdata..l...........................@..HINIT....P........................... ..b.rsrc...(...........................@..B.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{1b9ae675-a69a-784f-a0a3-d898132a09ba}\gwdrv.cat (copy)

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):11615
                                                                                                                                                                                                                      Entropy (8bit):7.3868789934614245
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:wOOgvXhARJCUnEwKUNhYCBkyLrp0KBQfX01k9z3AX6USwFVW:xARgUNh3BkyRxB+R9zW7HW
                                                                                                                                                                                                                      MD5:542FCDD371B6C4D2D8689514BD618AF5
                                                                                                                                                                                                                      SHA1:36A4959B6100263D4E0615E981E08E425604FCEC
                                                                                                                                                                                                                      SHA-256:0BA953EDEA4CACC7FFA37275B95B5DAD3BF8410E8649C1B98D9C59336ED01D2E
                                                                                                                                                                                                                      SHA-512:A951AA9AA5729A59C8CF31F65F1EBE1BC2037AC53393EBF5D859B95A66F1701DBCD1E466A49ACD80A56E44039C0D6E4D5CA6247A98EF9D341EF3C4227FFE68FC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:0.-[..*.H........-L0.-H...1.0...`.H.e......0.....+.....7......0...0...+.....7.......5.v.E...R.|....240617150138Z0...+.....7.....0..?0....z..lbX...i##.d>j.t=1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...s.y.s...0.....s..Q.`a..Z....:...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...i.n.f...0.... ...U...;.}A@.K..M..u..K.7..C0!.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ...U...;.}A@.K..M..u..K.7..C0!.0... .KZze..J7......~....*........H.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .KZze..J7......~....*........H.....0...0....+.....7......0.....S.u.

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{1b9ae675-a69a-784f-a0a3-d898132a09ba}\gwdrv.inf (copy)

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                      File Type:Windows setup INFormation
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2458
                                                                                                                                                                                                                      Entropy (8bit):4.908381744177934
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:McNx2HvlzPtPbdZ0d7OPd/eohC/fr+ypHhqFWi4lTXlfv:McNx2P5hbdyd7O9eYEfFoEDlfv
                                                                                                                                                                                                                      MD5:4ADE9CA0F531877BF4AFA77A0122FE46
                                                                                                                                                                                                                      SHA1:A973FDC751DE606195E4BF5ADEF604863A13111F
                                                                                                                                                                                                                      SHA-256:BE4B5A7A65B0064A37FEE1CAD48385827ED9E50BA22A95E6CCDEF49DD5C248A5
                                                                                                                                                                                                                      SHA-512:EAA5E18E04FF44C1120DD6F951A954BEE85000507F3D1579BF23FB360B9BDEE05FD4BE15154304712A9B4E528CF961EDBD64F112E61A70CF0FBDFCC2AE72E307
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:;..; generic-driver.inf..; .NT$ARCH$....[Version].. Signature = "$WINDOWS NT$".. Class = GlassWire.. ClassGuid = {917D8DAF-DE89-44B7-8907-B422ECB01F53}.. Provider = %ManufacturerName%.. CatalogFile = gwdrv.cat.. DriverVer = 06/17/2024,17.44.6.748.. PnpLockdown = 1....;********************************************..; driver install section..;********************************************....[SourceDisksNames].. 1 = %DiskName%,,,""....[SourceDisksFiles].. gwdrv.sys = 1,,....[DestinationDirs].. DefaultDestDir = 12 ; %windir%\system32\drivers.. GwGeneric.DriverFiles = 12 ; %windir%\system32\drivers....[DefaultInstall.NTamd64].. OptionDesc = %GwGenericDriverDescription%.. CopyFiles = GwGeneric.CopyDriverFiles....[DefaultUninstall.NTamd64].. LegacyUninstall=1.. DelFiles = GwGeneric.DeleteDriverFiles....[GwGeneric.CopyDriverFiles].. gwdrv.sys,,,0x00000040 ; COPYFLG_OVERWRITE_OLDER_ONLY....[GwGeneric.DeleteD

                                                                                                                                                                                                                      C:\Users\user\AppData\Local\Temp\{1b9ae675-a69a-784f-a0a3-d898132a09ba}\gwdrv.sys (copy)

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):48296
                                                                                                                                                                                                                      Entropy (8bit):6.297840034594717
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:E0v8QOvjN2NGTn77rmisnSENWGvw4emXubnjeW5aYz6lBhJ/4tBH3ZEpw9zYUb0:E0EQOv4NGTn77rmisnSeWGvBaGJ/4tB8
                                                                                                                                                                                                                      MD5:715021B0BC7B2E8E3C13B384CDE5B392
                                                                                                                                                                                                                      SHA1:006275D68C8A2BA58477AED1980835EB58512329
                                                                                                                                                                                                                      SHA-256:42B85F2E37FFE04970D6BB1476978046EAD72DDF57392E396AD54A08B52A4AA0
                                                                                                                                                                                                                      SHA-512:BEBB72A7F11694463DDFD7575E67F078360BF32C75B0630FDEE30BC8A5649E53C2F56BFDF55ADD494CADA9A78C6E58E25FF675AA432E296F5D1CF6AE0595E910
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5...[D..[D..[D..\E..[D..]E..[D..XE..[D.._E..[D..ZE..[D..ZD..[D.`_E..[D.`.D..[D.`YE..[DRich..[D........................PE..d....Kpf.........."....(.n...$......Pl.........@....................................4}.....A................................................0...d.......(.......l........(.......... ...8...............................@............................................text....f.......h.................. ..h.rdata..h............l..............@..H.data...h............~..............@....pdata..l...........................@..HINIT....P........................... ..b.rsrc...(...........................@..B.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\GlassWire 3.4.lnk

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=0, Archive, ctime=Mon Aug 12 07:19:56 2024, mtime=Mon Oct 7 16:00:07 2024, atime=Mon Aug 12 07:19:56 2024, length=12010624, window=hide
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1998
                                                                                                                                                                                                                      Entropy (8bit):3.325163670128496
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:8EJidOmbfXujYiME1dvGJPdv3dvmcFvmVm8KyF:80rYgTVm8Ky
                                                                                                                                                                                                                      MD5:092F17217DE316395FC435E9E1C86963
                                                                                                                                                                                                                      SHA1:9A7E04AC40F71BC9F4B2771E5B4849B2FC093967
                                                                                                                                                                                                                      SHA-256:F4E9C0C2ED7F2C0D9ACC5B702388CF7C76611240952BCDE6CEACAE3664664129
                                                                                                                                                                                                                      SHA-512:282A0EA01BE57915F3E16387FDA2C5333A1B557CC531027E76A8219D6BFE66BA1DA20B03A79775F4CD26593A8BB90895391D188ECF12B1318331569F50F719F7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:L..................F.@.. ......j.......\.......j.....D...........................P.O. .:i.....+00.../C:\.....................1.....GYp...PROGRA~2.........O.IGYp.....................V.....N...P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....\.1.....GYu...GLASSW~1..D......GYp.GYu............................]..G.l.a.s.s.W.i.r.e.....h.2..D...Y|B .GLASSW~1.EXE..L.......Y|BGYs......7........................G.l.a.s.s.W.i.r.e...e.x.e.......]...............-.......\...........Gx.......C:\Program Files (x86)\GlassWire\GlassWire.exe..@.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.l.a.s.s.W.i.r.e.\.G.l.a.s.s.W.i.r.e...e.x.e. .C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.l.a.s.s.W.i.r.e...C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.G.l.a.s.s.W.i.r.e.\.g.l.a.s.s.w.i.r.e...e.x.e.........%ProgramFiles%\GlassWire\glasswire.exe..................................................................................................

                                                                                                                                                                                                                      C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\f01b4d95cf55d32a.automaticDestinations-ms

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7680
                                                                                                                                                                                                                      Entropy (8bit):4.259115399776718
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:rDsPwyMQ1VVW0T1MqughNY1IkAKOSuPlQCSuT6OqirdvXkYTCadRlpXJidOmbfOK:hAPJ4Clf6OqiiIdRXW7iBxLFW6W
                                                                                                                                                                                                                      MD5:52146DDE0D08CD9392122CEF641B67D2
                                                                                                                                                                                                                      SHA1:89BBA76CFD12FF3CCF1BE93E2D4F42F9DA44B48C
                                                                                                                                                                                                                      SHA-256:2F665D8B844D7B99244CCD11485D5713F35AAE22F8481B912458A38673C3A89F
                                                                                                                                                                                                                      SHA-512:30A4FCFAE6C9BE9546E7CA24F1529B146BF653E087CC835B851AC4C45F9064BDFB5AEDDEC920E51B02193E5F730F30EEC97A4AB0BE95CD2C9F2A97DBD727D48F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\INF\oem4.inf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\drvinst.exe
                                                                                                                                                                                                                      File Type:Windows setup INFormation
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2458
                                                                                                                                                                                                                      Entropy (8bit):4.908381744177934
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:McNx2HvlzPtPbdZ0d7OPd/eohC/fr+ypHhqFWi4lTXlfv:McNx2P5hbdyd7O9eYEfFoEDlfv
                                                                                                                                                                                                                      MD5:4ADE9CA0F531877BF4AFA77A0122FE46
                                                                                                                                                                                                                      SHA1:A973FDC751DE606195E4BF5ADEF604863A13111F
                                                                                                                                                                                                                      SHA-256:BE4B5A7A65B0064A37FEE1CAD48385827ED9E50BA22A95E6CCDEF49DD5C248A5
                                                                                                                                                                                                                      SHA-512:EAA5E18E04FF44C1120DD6F951A954BEE85000507F3D1579BF23FB360B9BDEE05FD4BE15154304712A9B4E528CF961EDBD64F112E61A70CF0FBDFCC2AE72E307
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:;..; generic-driver.inf..; .NT$ARCH$....[Version].. Signature = "$WINDOWS NT$".. Class = GlassWire.. ClassGuid = {917D8DAF-DE89-44B7-8907-B422ECB01F53}.. Provider = %ManufacturerName%.. CatalogFile = gwdrv.cat.. DriverVer = 06/17/2024,17.44.6.748.. PnpLockdown = 1....;********************************************..; driver install section..;********************************************....[SourceDisksNames].. 1 = %DiskName%,,,""....[SourceDisksFiles].. gwdrv.sys = 1,,....[DestinationDirs].. DefaultDestDir = 12 ; %windir%\system32\drivers.. GwGeneric.DriverFiles = 12 ; %windir%\system32\drivers....[DefaultInstall.NTamd64].. OptionDesc = %GwGenericDriverDescription%.. CopyFiles = GwGeneric.CopyDriverFiles....[DefaultUninstall.NTamd64].. LegacyUninstall=1.. DelFiles = GwGeneric.DeleteDriverFiles....[GwGeneric.CopyDriverFiles].. gwdrv.sys,,,0x00000040 ; COPYFLG_OVERWRITE_OLDER_ONLY....[GwGeneric.DeleteD

                                                                                                                                                                                                                      C:\Windows\INF\setupapi.dev.log

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                      File Type:Generic INItialization configuration [BeginLog]
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):40833
                                                                                                                                                                                                                      Entropy (8bit):5.173430185078416
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:OGdni80C/8g0atRf7yr14ujuNY9AZi3Z/oUtwr05haugafQ/y/5acFc:Own95cdyYloiwQ+wBrm
                                                                                                                                                                                                                      MD5:829AE150D861A595ED01C933B5C924A1
                                                                                                                                                                                                                      SHA1:89F0564AD20D2006A357DCACD7FF3C1077A4DF59
                                                                                                                                                                                                                      SHA-256:4C2B88043830B7EB63622645C60E99F5CB2F2DC718EFC06800C4825DED8632A7
                                                                                                                                                                                                                      SHA-512:37862506BF7B7F6DBF93970D5743F7F8A49658E6DF549E92FE1F08BD689C53104A4EABC5B9B1A5EDFE270B29CB53D7C47AFDD16390595F324D79CBD5E03B56FD
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:[Device Install Log].. OS Version = 10.0.19045.. Service Pack = 0.0.. Suite = 0x0100.. ProductType = 1.. Architecture = amd64....[BeginLog]....[Boot Session: 2023/10/03 09:57:02.288]....>>> [Setup Import Driver Package - C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf]..>>> Section start 2023/10/03 09:57:37.904.. cmd: C:\Windows\System32\spoolsv.exe.. inf: Provider: Microsoft.. inf: Class GUID: {4D36E979-E325-11CE-BFC1-08002BE10318}.. inf: Driver Version: 06/21/2006,10.0.19041.1806.. inf: Catalog File: prnms009.cat.. ump: Import flags: 0x0000000D.. pol: {Driver package policy check} 09:57:37.920.. pol: {Driver package policy check - exit(0x00000000)} 09:57:37.920.. sto: {Stage Driver Package: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf: {Query Configurability: C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf} 09:57:37.920.. inf:

                                                                                                                                                                                                                      C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\concrt140.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):243576
                                                                                                                                                                                                                      Entropy (8bit):6.63219267320993
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:aLy1UNAZHA2nSG5LbEcutDsSaqiOHYb836TLLOeHFQyS9uLms12z/NpJ9yne:2hkH0Yb83KLxmuLmdzoe
                                                                                                                                                                                                                      MD5:9AD549C121108B3B1408A30BEE325D08
                                                                                                                                                                                                                      SHA1:898FFC728087861E619DABABD8E65CC902276D06
                                                                                                                                                                                                                      SHA-256:263975E4F5AFC90E91F9F601080B92C9FBC5E471132F63AD01C6C4F99B33B83A
                                                                                                                                                                                                                      SHA-512:9A9005ACF2AF86D6A0A95773E968D98E90B7E71E8E71D58949FF51AAD49050DCA57D94A19671B1B5026BD74E7B627F31D0C8A50BB66AB740D629022C3A95D579
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......V.3...]X..]X..]X..\Y..]X...X..]X@.\Y..]X..\X..]X@.YY..]X@.^Y..]X@.XYA.]X@.]Y..]X@..X..]X@._Y..]XRich..]X................PE..L...=|.a.........."!.........x......p........0......................................?I....@A........................ ....K..<r..........................x#.......+...;..8............................<..@............p..8............................text............................... ..`.data....4...0...2... ..............@....idata..~....p.......R..............@..@.rsrc................d..............@..@.reloc...+.......,...h..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):436600
                                                                                                                                                                                                                      Entropy (8bit):6.647435576141042
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12288:/gO0BGzePo6+J+4P0xYv7IQgnhUgiW6QR7t5s03Ooc8dHkC2esKcWKe0:701Po6+J+dxYv7IQgk03Ooc8dHkC2ezc
                                                                                                                                                                                                                      MD5:8FF1898897F3F4391803C7253366A87B
                                                                                                                                                                                                                      SHA1:9BDBEED8F75A892B6B630EF9E634667F4C620FA0
                                                                                                                                                                                                                      SHA-256:51398691FEEF7AE0A876B523AEC47C4A06D9A1EE62F1A0AEE27DE6D6191C68AD
                                                                                                                                                                                                                      SHA-512:CB071AD55BEAA541B5BAF1F7D5E145F2C26FBEE53E535E8C31B8F2B8DF4BF7723F7BEF214B670B2C3DE57A4A75711DD204A940A2158939AD72F551E32DA7AB03
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......p.. 4.os4.os4.os..nr6.os=..s".os4.ns..osf.nr7.osf.kr?.osf.lr<.osf.jr..osf.or5.osf.s5.osf.mr5.osRich4.os........................PE..L...>|.a.........."!.........~...............0............................................@A.........................T......<c..........................x#.......6...W..8............................W..@............`..8............................text...b........................... ..`.data...L(...0......................@....idata.......`.......2..............@..@.rsrc................J..............@..@.reloc...6.......8...N..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_1.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):21384
                                                                                                                                                                                                                      Entropy (8bit):6.470094803230791
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:Y32E5mpdhYQjHy3d5Wcs5gWI3KLHRN7QiUJ/AlGstm4s:YmxQSyUyAQX/xEv
                                                                                                                                                                                                                      MD5:C946A9E4170F6B16D25C822DA616DC6A
                                                                                                                                                                                                                      SHA1:F602D23DB756F9C3A058D3B7186D24480E05790F
                                                                                                                                                                                                                      SHA-256:65BDADB5562B9473471740B1DCD8B064459A40D71A1A11FC5AEDAA855FE7635A
                                                                                                                                                                                                                      SHA-512:916CAD8B1E38B2B15AB836844C5CC9D36B212831B2F553198054FE9CB5CD77AECD544CAC8040000337CEFDA9B15BF95E8903F36A9C1BEB7D579CFFF670445617
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......(D.vl%.%l%.%l%.%.U.$n%.%e]/%h%.%>P.$f%.%>P.$m%.%l%.%D%.%>P.$i%.%>P.$x%.%>P.$m%.%>PC%m%.%>P.$m%.%Richl%.%........................PE..L...J|.a.........."!.........................0...............................p......#,....@A.........................*..J....@..x....P...............0...#...`..t...X...8...............................@............@...............................text...J........................... ..`.data...8....0....... ..............@....idata.......@......."..............@..@.rsrc........P.......(..............@..@.reloc..t....`.......,..............@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_2.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):166264
                                                                                                                                                                                                                      Entropy (8bit):6.800892494270331
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:UZqJu0h1iCPZYtIzss2wizpHB7RoSxvQ02bnt56CY2G1zVSdqXCvjC:UZqU0hStIzrQqht567ZSY+jC
                                                                                                                                                                                                                      MD5:06DEEA1786C951D3CC7E24A3E714FF03
                                                                                                                                                                                                                      SHA1:9906803CEDB8600C5E201AE080155BEEBD2902B2
                                                                                                                                                                                                                      SHA-256:EAC4C95CD7B013E110F2CF28C08342126FE1658EF16010541F05B234D23272DD
                                                                                                                                                                                                                      SHA-512:28CAA59DEEC92E417468BB0244DA2E60FAF6482EF608258E99FA47F59D3CD0EDEE69155E913034AC7B5E1AFC88DBF8F6F97058B75F0CBC6E4C045E1EE6EAADA0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%>..a_a.a_a.a_a../`.c_a.h'.m_a.3*e.j_a.3*b.c_a.a_`.._a.3*`.d_a.3*d.r_a.3*a.`_a.3*..`_a.3*c.`_a.Richa_a.................PE..L...J|.a.........."!.....*...<......0........@......................................:.....@A.........................3..@....Q.......`...............f..x#...p..X....\..8............................\..@............P...............................text....).......*.................. ..`.data...(....@......................@....idata..`....P.......6..............@..@.rsrc........`.......D..............@..@.reloc..X....p.......H..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_atomic_wait.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):52104
                                                                                                                                                                                                                      Entropy (8bit):5.1488364199396335
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:ZWlTFwTSloNYcSNXR5cHDIABta/FWFvug0yiT3UN9imfI/NVW0jdT40Fzenw3GDx:GVT9kNWNLTXwwWDpQJs10cM8dAgT7
                                                                                                                                                                                                                      MD5:FFB8C73E6E3769D5D8715E694707C792
                                                                                                                                                                                                                      SHA1:F7D63FA41C34D7B75CD70D72E317DB148F3D50CA
                                                                                                                                                                                                                      SHA-256:1DD7D3417FFFC321A67AAE2CA7E89A7D75203F8A3586CD829C56766F313F7931
                                                                                                                                                                                                                      SHA-512:61E83F71A388FD1176665225CC84C32FAC40663376629ADBE9B47CD9E69DDADC43FEC021B07062585AF80811E8F3E0479314B2277E6CB8617645FD304FAE88AB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Uz.;).;).;)*.:(.;)...).;)..?(.;)..8(.;).:)..;)..:(.;)..>(.;)..;(.;)...).;)..9(.;)Rich.;)........PE..L...J|.a.........."!.....H..........PC.......`............................... ......,@....@A.........................Q..D...............0................#......x.......8...........................0...@............................................text....F.......H.................. ..`.data........`...B...L..............@....idata..............................@..@.rsrc...0...........................@..@.reloc..x...........................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\msvcp140_codecvt_ids.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18816
                                                                                                                                                                                                                      Entropy (8bit):6.421430337596372
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:5DSdV3lIjIjP2dhWiOEWs/KLHRN7kxjlGsgl/Z:5c32jmdmAT7/Z
                                                                                                                                                                                                                      MD5:EF6C5EEB8B36D941E6991E6981CDB88A
                                                                                                                                                                                                                      SHA1:E21989951B745B290F143DD63F94BD4399A74284
                                                                                                                                                                                                                      SHA-256:3859B4A5A5C0A30CEE15C188F678E09D040541C221999D926955B49E8779E675
                                                                                                                                                                                                                      SHA-512:12CB0C4E4DE73600E262B6B6D0448FB050BD4B673D86265B4033B253EA3864DDA4F004F6344AAE5BED7A15D5717531F7B18374E47FF4258E027EE7B896F6F406
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Mt.T.............e.......mv.............[`......[`......[`......[`......[`......[`......[`......Rich....................PE..L...J|.a.........."!................P........0...............................p.......)....@A.........................!../...l@..P....P..0............&...#...`..H...D...8...............................@............@..h............................text............................... ..`.data........0......................@....idata..t....@......................@..@.rsrc...0....P......................@..@.reloc..H....`.......$..............@..B................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\vccorlib140.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):267656
                                                                                                                                                                                                                      Entropy (8bit):6.547035182798101
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:+9WZ4GcvxHdmJOHpxyBIBaQ0I/Quljl1mn48MHnlwgSmiSb:+VFTmJO/BH0IYuljK48ZgS0
                                                                                                                                                                                                                      MD5:2FB4C4168E379F13B15D4E299ECF3429
                                                                                                                                                                                                                      SHA1:4C6702254054F288BEB49ADCDD6317575E83374D
                                                                                                                                                                                                                      SHA-256:8CD7BE490AD502C9980CB47C9A7162AFCCC088D9A2159D3BBBCED23A9BCBDA7F
                                                                                                                                                                                                                      SHA-512:8BC80A720CDC38D58AB742D19317FBE7C36CFB0261BB9B3D5F3B366459B2801B95F8E71FB24D85B79F2C2BC43E7EB135DAB0B81953C7007A5C01494C9F584208
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Hb.:...i...i...i.{.i...i^v.h...i^v.h...i^v.h...i^v.h...i.s.h...i...i...i^v.h...i^v.h...i^v.i...i^v.h...iRich...i................PE..L....~.a.........."!.........................0............................... ......Gp....@A........................@....=...............................#......TX..\J..8............................J..@............................................text...[........................... ..`.data....o...0...l..................@....idata..............................@..@.rsrc...............................@..@.reloc..TX.......Z..................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Installer\$PatchCache$\Managed\56FE97613F5584249BE1B6B31E6AC9FD\14.29.30139\vcruntime140.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):76168
                                                                                                                                                                                                                      Entropy (8bit):6.765544990184352
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:zHHuqvERNjBwySXtVaSvrgOFw9RxKMn5ecbCKnIY7:zHHZMRNjKySdLcOiH5ecbCKnN
                                                                                                                                                                                                                      MD5:1A84957B6E681FCA057160CD04E26B27
                                                                                                                                                                                                                      SHA1:8D7E4C98D1EC858DB26A3540BAAAA9BBF96B5BFE
                                                                                                                                                                                                                      SHA-256:9FAEAA45E8CC986AF56F28350B38238B03C01C355E9564B849604B8D690919C5
                                                                                                                                                                                                                      SHA-512:5F54C9E87F2510C56F3CF2CEEB5B5AD7711ABD9F85A1FF84E74DD82D15181505E7E5428EAE6FF823F1190964EB0A82A569273A4562EC4131CECFA00A9D0D02AA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................{.........i.............................................................Rich....................PE..L...>|.a.........."!.........................................................@......{.....@A......................................... ...................#...0.......#..8............................#..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Installer\3bd8bd.msi

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2019 X86 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.29.30139., Template: Intel;1033, Revision Number: {C903B036-1F58-4F43-8CA4-2797FED0F6CC}, Create Time/Date: Fri Dec 10 22:28:10 2021, Last Saved Time/Date: Fri Dec 10 22:28:10 2021, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.4.4718), Security: 2
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):184320
                                                                                                                                                                                                                      Entropy (8bit):6.331822191131053
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:GdviOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJdf:MvipBaTDo1j//SZh
                                                                                                                                                                                                                      MD5:FA1839BB43A4C70969B0FBDC59012A68
                                                                                                                                                                                                                      SHA1:E13B57B6AABBDFB20EB07DB8283E21656EF15C63
                                                                                                                                                                                                                      SHA-256:D6F926690A4A2823C2D507A3682153AF099C8832EE0C700240F28A38625357F8
                                                                                                                                                                                                                      SHA-512:739D5930D7F434CEFAA20AB8396B2497F174789BFA4592EBE6D17BA0DF6ED38437F9F3154100FDE13CBCCC8818CC02BF87622C9EDC2CF43E0DDDCAB4436E20B2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Installer\3bd8c1.msi

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2019 X86 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.29.30139., Template: Intel;1033, Revision Number: {C903B036-1F58-4F43-8CA4-2797FED0F6CC}, Create Time/Date: Fri Dec 10 22:28:10 2021, Last Saved Time/Date: Fri Dec 10 22:28:10 2021, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.4.4718), Security: 2
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):184320
                                                                                                                                                                                                                      Entropy (8bit):6.331822191131053
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:GdviOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJdf:MvipBaTDo1j//SZh
                                                                                                                                                                                                                      MD5:FA1839BB43A4C70969B0FBDC59012A68
                                                                                                                                                                                                                      SHA1:E13B57B6AABBDFB20EB07DB8283E21656EF15C63
                                                                                                                                                                                                                      SHA-256:D6F926690A4A2823C2D507A3682153AF099C8832EE0C700240F28A38625357F8
                                                                                                                                                                                                                      SHA-512:739D5930D7F434CEFAA20AB8396B2497F174789BFA4592EBE6D17BA0DF6ED38437F9F3154100FDE13CBCCC8818CC02BF87622C9EDC2CF43E0DDDCAB4436E20B2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Installer\3bd8c2.msi

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2019 X86 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2019 X86 Additional Runtime - 14.29.30139., Template: Intel;1033, Revision Number: {02910D02-C4AB-4DC8-8CDC-AD5C0F55DDF0}, Create Time/Date: Fri Dec 10 22:31:12 2021, Last Saved Time/Date: Fri Dec 10 22:31:12 2021, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.4.4718), Security: 2
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):184320
                                                                                                                                                                                                                      Entropy (8bit):6.377160934619222
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:CviOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJdvW:CvipBaTDo1j//SZh
                                                                                                                                                                                                                      MD5:646FDDAFD57C35DA851B9AE476C32957
                                                                                                                                                                                                                      SHA1:ABC2EA3D74DE00555204D19951A96FAF5EA6F54B
                                                                                                                                                                                                                      SHA-256:E039B37C766848EB4A6012E0A28E0D6ED8CC7D2CDB6FF638FC821BE2B585A071
                                                                                                                                                                                                                      SHA-512:F3C6475E08B408DD166D9C27AB6D9FB22F66BDC24D29F7C2833FBE0EA8E8720321C32F673ABC088BB83D242758F8065A93934E2AE7CE8FE825B9436E99F1D025
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Installer\3bd8c9.msi

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2019 X86 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2019 X86 Additional Runtime - 14.29.30139., Template: Intel;1033, Revision Number: {02910D02-C4AB-4DC8-8CDC-AD5C0F55DDF0}, Create Time/Date: Fri Dec 10 22:31:12 2021, Last Saved Time/Date: Fri Dec 10 22:31:12 2021, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.4.4718), Security: 2
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):184320
                                                                                                                                                                                                                      Entropy (8bit):6.377160934619222
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:CviOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJdvW:CvipBaTDo1j//SZh
                                                                                                                                                                                                                      MD5:646FDDAFD57C35DA851B9AE476C32957
                                                                                                                                                                                                                      SHA1:ABC2EA3D74DE00555204D19951A96FAF5EA6F54B
                                                                                                                                                                                                                      SHA-256:E039B37C766848EB4A6012E0A28E0D6ED8CC7D2CDB6FF638FC821BE2B585A071
                                                                                                                                                                                                                      SHA-512:F3C6475E08B408DD166D9C27AB6D9FB22F66BDC24D29F7C2833FBE0EA8E8720321C32F673ABC088BB83D242758F8065A93934E2AE7CE8FE825B9436E99F1D025
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Installer\MSIDD41.tmp

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):7924
                                                                                                                                                                                                                      Entropy (8bit):5.618474405070075
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:KyrDph/vDpz8KrUkFEdogLNy5J5J5J5J5J5J5J5J5J5A45uvKIFKYYH+RftH78mH:Ky2zLVCIFKHMfLDieAONdnGYWnoUB+
                                                                                                                                                                                                                      MD5:07237F1C01C6338638B4CC85A731BB6B
                                                                                                                                                                                                                      SHA1:5C7075FE5A39A634EE759F9ED670E62E4D25E778
                                                                                                                                                                                                                      SHA-256:5C25897C38A3107C68C729FFE2C484D270227E3F919023B89A3ECD20C5C24E7D
                                                                                                                                                                                                                      SHA-512:A40330301F0B2D15B02A93BE70B87AE6DEE3A4AAF660FE59B5ACB5C8162B057E0E04FC2573D333FC7BF1F56BC35C117D517C561DFB8739E3153571223F7995A5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:...@IXOS.@.....@bgGY.@.....@.....@.....@.....@.....@......&.{1679EF65-55F3-4248-B91E-6B3BE1A69CDF};.Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.29.30139..vc_runtimeMinimum_x86.msi.@.....@.u...@.....@........&.{C903B036-1F58-4F43-8CA4-2797FED0F6CC}.....@.....@.....@.....@.......@.....@.....@.......@....;.Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.29.30139......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E3819B64-3C56-3DD7-921D-00B011AD31DE}@.02:\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X86\Version.@.......@.....@.....@......&.{E8E39D3B-4F35-36D8-B892-4B28336FE041}$.C:\Windows\SysWOW64\vcruntime140.dll.@.......@.....@.....@......&.{A2AA960C-FD3C-3A6D-BD6F-14933011AFB3} .C:\Windows\SysWOW64\msvcp140.dll.@.......@.....@.....@......&.{A2E7203F-60C2-3D7E-8A46-DB3D381A2CE6}".C:\Windows\SysWOW64\msvcp140_1.dll.@.......@.....@.....@...

                                                                                                                                                                                                                      C:\Windows\Installer\MSIE2B1.tmp

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):9668
                                                                                                                                                                                                                      Entropy (8bit):5.636538857355706
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:JEvmH5xSSSLuyAV2YO89iVkCameAmh3LsLNWrh:JEvmH5xSSguyA0YOsVBQZWrh
                                                                                                                                                                                                                      MD5:C1ADFD68FF2CB9B4E6B73E35395E8B5F
                                                                                                                                                                                                                      SHA1:C1074EB249B957FD85925B11A8D2C032C693754D
                                                                                                                                                                                                                      SHA-256:A8195BC0E0D0F73CDBE3A4B0730310489743B8EC00F097CC5020AB0683CF620A
                                                                                                                                                                                                                      SHA-512:9655C78202392990F7C6F88E2E5C1DC1186096CD64F6D851C6E76428D5E6BA65106C698045B8C73729A60D347EFAEA99359D0E0D3F045A48BC613DDD64F46B1F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:...@IXOS.@.....@cgGY.@.....@.....@.....@.....@.....@......&.{1AEA8854-7597-4CD3-948F-8DE364D94E07}>.Microsoft Visual C++ 2019 X86 Additional Runtime - 14.29.30139..vc_runtimeAdditional_x86.msi.@.....@.u...@.....@........&.{02910D02-C4AB-4DC8-8CDC-AD5C0F55DDF0}.....@.....@.....@.....@.......@.....@.....@.......@....>.Microsoft Visual C++ 2019 X86 Additional Runtime - 14.29.30139......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{E3819B64-3C56-3DD7-921D-00B011AD31DE}@.02:\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\X86\Version.@.......@.....@.....@......&.{4FD4AB8C-C57F-3782-9230-9CCA22153AD3}..C:\Windows\SysWOW64\mfc140.dll.@.......@.....@.....@......&.{46A1EA6B-3D81-3399-8991-127F7F7AE76A}..C:\Windows\SysWOW64\mfc140u.dll.@.......@.....@.....@......&.{C94DDE19-CC70-3B9A-A6AF-5CA7340B9B9A}..C:\Windows\SysWOW64\mfcm140.dll.@.......@.....@.....@....

                                                                                                                                                                                                                      C:\Windows\Installer\SourceHash{1679EF65-55F3-4248-B91E-6B3BE1A69CDF}

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):20480
                                                                                                                                                                                                                      Entropy (8bit):1.2062384665004098
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:JSbX72FjZvXAlfLIlHuRpZhG7777777777777777777777777ZDHFh1IUswQqDrD:JPUIwECUswQ5cF
                                                                                                                                                                                                                      MD5:FA8108B6F9DDB4B06E0015263B40663C
                                                                                                                                                                                                                      SHA1:66B2150EBAA34D46B19349B7BB5E186E54758EA5
                                                                                                                                                                                                                      SHA-256:C52016BD7A6BE2BAEB51A99908A208971D73000D4502F23CE9B3778214D2E2A5
                                                                                                                                                                                                                      SHA-512:5EC37BBB8729E53BED1F653FFAA0886D77D4B40070D76EEDA345B977CB91457EB85B4B544E469267BEEF15D68ED97DCF78121B3DFC571A43CCD814B8D2E0E1FB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Installer\SourceHash{1AEA8854-7597-4CD3-948F-8DE364D94E07}

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):20480
                                                                                                                                                                                                                      Entropy (8bit):1.2075993307710515
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12:JSbX72FjDXAlfLIlHuRpWBhG7777777777777777777777777ZDHFhpw2RHegNmp:JtUIwUi7pTHegZcF
                                                                                                                                                                                                                      MD5:4C3B631780A705229F26A1415204B00B
                                                                                                                                                                                                                      SHA1:2DF1FDDBCED19E1EFDD86E1EE0D7113D84A0F714
                                                                                                                                                                                                                      SHA-256:F0FB076700B38BBFCA64A07E1297445C35CB7C3819997F9F43F7BE46A62ADA8F
                                                                                                                                                                                                                      SHA-512:D946154BE7E49FE816767424E4A090D54AE271B4F86A489D55C2C8359F5664C5AAAA7510B1DE3953D0B994CBC913270AD151A75C7CF68FD01542F74599844EC0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Installer\inprogressinstallinfo.ipi

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):20480
                                                                                                                                                                                                                      Entropy (8bit):1.5331134226160483
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:438PhfuRc06WXi/nT5Spdk96RLBL7XPWSmRSo9al3SIV8ZQco:42hf1RnT08aLBL7XeVRiJ8ZQc
                                                                                                                                                                                                                      MD5:A67AD08F1ACF0F11A152DAFE8A10682D
                                                                                                                                                                                                                      SHA1:719076EAED37A1C5E20DD208638B43EBEA1D2371
                                                                                                                                                                                                                      SHA-256:D6D50173C856DC8CE7E63FBE88DA01D3CD9BA116A83EDF7BB00FDB5ED62C4D2E
                                                                                                                                                                                                                      SHA-512:A5729C8542ABFF450B2C45B247878BF9EF0112EEF0EF04D4B0E9862054A0D157359949B7F157D5931C46D4022C79F2E23F8E246E6A6E975B40B4875AE6C6E2EE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):432221
                                                                                                                                                                                                                      Entropy (8bit):5.3751647516200345
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26Kgaud:zTtbmkExhMJCIpErE
                                                                                                                                                                                                                      MD5:0B5C2FD4E643CEA74C0DAC1669E6425A
                                                                                                                                                                                                                      SHA1:83E6AE18D42C2CDEEED7F54BC27FCE8C8E5C3FE9
                                                                                                                                                                                                                      SHA-256:D6737C41989FDAB54ADA62941D8A0DD4528AC3085C9E40CECF8F51100E551C8D
                                                                                                                                                                                                                      SHA-512:0AD151ADA4221CA49C65495D520EDF49D6DB09CF5CE5A02804B77EB9EB08E995A00F8ECC7E0FC98A85BDA5A8D4FE0A4B3A76C182E2CA70E28E84A71661292B36
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

                                                                                                                                                                                                                      C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                      File Type:JSON data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):55
                                                                                                                                                                                                                      Entropy (8bit):4.306461250274409
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
                                                                                                                                                                                                                      MD5:DCA83F08D448911A14C22EBCACC5AD57
                                                                                                                                                                                                                      SHA1:91270525521B7FE0D986DB19747F47D34B6318AD
                                                                                                                                                                                                                      SHA-256:2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
                                                                                                                                                                                                                      SHA-512:96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

                                                                                                                                                                                                                      C:\Windows\SysWOW64\mfc140.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4827528
                                                                                                                                                                                                                      Entropy (8bit):7.034823816178361
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:98304:TijXcKQ6Mp4MFQ7956Xk00ChS9M4qZTd159S2ygpdhCV/FLOAkGkzdnEVomFHKn2:O7cKJsFQ7EAklLZT5c2ygpdhChFLOyom
                                                                                                                                                                                                                      MD5:DE1DBEBFBEAD286054F0D9921D2AB59C
                                                                                                                                                                                                                      SHA1:CBC3133813FF3003CDFAA5FAE5A03877BF2C3940
                                                                                                                                                                                                                      SHA-256:CDE83F3B384C3AF0C3E929D56A027B2C1DDEEE05CD6E14002861DE943B76461F
                                                                                                                                                                                                                      SHA-512:14F0A023EB7B22E293FF8F83E43195F037B18942DABC088F7A3ACCB5657421C05C85C95770BCD84E5869822FC2C7F05CC6B4B88D7D0A01D0D5A701C73BD276AC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........'..vt..vt..vti.su..vti.qu..vti.ru..vt...t..vt.wu..vt.ru..vt.uu..vti.wu..vt..wt..vt.su..vt..u..vt.vu..vt..t..vt.tu..vtRich..vt................PE..L....~.a.........."!.....R/..l.......*......p/...............................J.......I...@A.........................~.......]0.......0...............I..#...`F.....l@..8...........................@4..@............P0......p.......................text....P/......R/................. ..`.data........p/......V/.............@....idata...T...P0..V..../.............@..@.didat........0......N0.............@....rsrc.........0......R0.............@..@.reloc.......`F.......E.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\SysWOW64\mfc140chs.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):39816
                                                                                                                                                                                                                      Entropy (8bit):5.7532379847355175
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:wA5dBlsNKvsX5WZdWXYbMktLiBr8uuPgldyevyBb7DVLN1eKLHRN7ojlGsgl:JdzvsXkD9tLkr8yTby97DVLyAR7
                                                                                                                                                                                                                      MD5:D5BD2986CB53154D638989E7A6803724
                                                                                                                                                                                                                      SHA1:BD89A8CA2455630B6418FBF4AF4BB514E627F3C1
                                                                                                                                                                                                                      SHA-256:ED7F444EE03387FD0E40F416F2C6A8B7A65E9892726262D42EC3FDCDEE69838C
                                                                                                                                                                                                                      SHA-512:103A15D0DAA9A7EBFC08F955CD6BD5EE380E577A17D5A5CD6B160E6CC3CC8411A592EF9EA7A7328B1F6B983CAF81425DCB5912A514570383AA61FD63102A5BEE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-h=.i.S.i.S.i.S.;|..h.S.;|Q.h.S.Richi.S.................PE..L....~.a.........."!.........v......................................................C.....@.......................................... ..8s...........x...#..............8............................................................................text...............................@..@.rsrc...8s... ...t..................@..@.....~.a........X...8...8........~.a........T...........RSDS..l..%x@............d:\a01\_work\11\s\\binaries\x86ret\bin\i386\\MFC140CHS.i386.pdb.........8....rdata..8........rdata$zzzdbg.... ..p....rsrc$01....p1...a...rsrc$02........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\SysWOW64\mfc140cht.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):39816
                                                                                                                                                                                                                      Entropy (8bit):5.8065312316417055
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:HhffucVI4aV7kYw4JUM3i/EhW/Sw11zji:xucVI4aV4YJUM3XhWKwPji
                                                                                                                                                                                                                      MD5:0320AE8212F9DD89F0FC18518227DD21
                                                                                                                                                                                                                      SHA1:84095865893E2B94BCD19AFCDD0FAC4C0267A659
                                                                                                                                                                                                                      SHA-256:5E6EA92252B8EBED5D6288E96364C760D0F8AD2A6D64406A0845C7938062EA79
                                                                                                                                                                                                                      SHA-512:2312C7E17BBD302FF2809A80614BE8AB22D744025CAB230A6B9743090B157BEB147366AACE429EC2F1C50DBB28DC5ED3E2EBD4DDACFDCF52016E3B1C12BDE2B8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-h=.i.S.i.S.i.S.;|..h.S.;|Q.h.S.Richi.S.................PE..L....~.a.........."!.........v.......................................................d....@.......................................... ..`s...........x...#..............8............................................................................text...............................@..@.rsrc...`s... ...t..................@..@.....~.a........X...8...8........~.a........T...........RSDSx|z...8B......+|....d:\a01\_work\11\s\\binaries\x86ret\bin\i386\\MFC140CHT.i386.pdb.........8....rdata..8........rdata$zzzdbg.... ..p....rsrc$01....p1...a...rsrc$02........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\SysWOW64\mfc140deu.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):68488
                                                                                                                                                                                                                      Entropy (8bit):4.327977392113376
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:1536:vVPidQr0UZqnn0BDnePS6VFaGCWKZ+e0petNSaBhp0vcsjsr8gWb8C1dCuf9quq:vVidQr0UZqnnSnePS6VFaGCWKZX0Whpm
                                                                                                                                                                                                                      MD5:2CE28846E93EE24FB7D0E3BD8B63BD91
                                                                                                                                                                                                                      SHA1:1E26CC057C2C8EAD5600FA78247235D0FC65F166
                                                                                                                                                                                                                      SHA-256:28828849F13443B351604D8CDDC735426A91004995138E7F74A4EEAC8B24511C
                                                                                                                                                                                                                      SHA-512:04D983702DAC3024C5449401B2E202C5A2E0269C7095BD5C22FBFECCD91CAE0421DBC35219DFDA8C868EFBE764D2FE9978405315809C397ADA7F2C5432201DB0
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-h=.i.S.i.S.i.S.;|..h.S.;|Q.h.S.Richi.S.................PE..L....~.a.........."!......................................................................@.......................................... ..X................#..............8............................................................................text...............................@..@.rsrc...X.... ......................@..@.....~.a........X...8...8........~.a........T...........RSDS[G.JL.E.;.t.^.z....d:\a01\_work\11\s\\binaries\x86ret\bin\i386\\MFC140DEU.i386.pdb.........8....rdata..8........rdata$zzzdbg.... ..p....rsrc$01....p1.......rsrc$02........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\SysWOW64\mfc140enu.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):58744
                                                                                                                                                                                                                      Entropy (8bit):4.438147273322492
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:+VmijcBEhCgyC0Au1HLPLNqyf/nWHBNhdBU2fd57SwJ6/:+VdzfyC0AuhPLNXf/nWHNfdEwM
                                                                                                                                                                                                                      MD5:72E43E172A774904215389FF2A9483F1
                                                                                                                                                                                                                      SHA1:7208EB928DCB3CD0B3C7271DB1B17519CDAE786E
                                                                                                                                                                                                                      SHA-256:840ADE1B352587C974975DE02C5AB6E3353938A79C747F19584031CD972726ED
                                                                                                                                                                                                                      SHA-512:EAAAE2FBD8D0D158C3B81783A7F7AE82E517875E1264BA7F346D826078D7B2DB505260924A3FB0350B4954AD1247E8021685A84DCB20EB368D3ECAA715B81094
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-h=.i.S.i.S.i.S.;|..h.S.;|Q.h.S.Richi.S.................PE..L....~.a.........."!.................................................................%....@.......................................... .................x#..............8............................................................................text...............................@..@.rsrc....... ......................@..@.....~.a........X...8...8........~.a........T...........RSDS.7.F...B..}W8.......d:\a01\_work\11\s\\binaries\x86ret\bin\i386\\MFC140ENU.i386.pdb.........8....rdata..8........rdata$zzzdbg.... ..p....rsrc$01....p1..X....rsrc$02........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\SysWOW64\mfc140esn.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):67464
                                                                                                                                                                                                                      Entropy (8bit):4.294573018633418
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:wK0KnBU6IO6qg/iKuCOCF3OKWRElMRZ/IvpNAe:kwq6IO6B/iKuFm3OKWxRZ/IUe
                                                                                                                                                                                                                      MD5:23AA81E24A0F125922A4526ACCE249CE
                                                                                                                                                                                                                      SHA1:85BD4F5E0B04DAB549FC6DEC41005C9B37678F45
                                                                                                                                                                                                                      SHA-256:F92267D25B96947DEB575644E0E492F4266EE4D0A6D7FFE522EB635F71106E10
                                                                                                                                                                                                                      SHA-512:4C4D6C1C6BB241E9CA7DB35727107C4D186F7130EABB91D116990FACEF7A7F2A76C1F87844EC5DC32B9E0AC9881155837F83F5E963D61CACD9193D54171F88E6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-h=.i.S.i.S.i.S.;|..h.S.;|Q.h.S.Richi.S.................PE..L....~.a.........."!.....................................................................@.......................................... ...................#..............8............................................................................text...............................@..@.rsrc........ ......................@..@.....~.a........X...8...8........~.a........T...........RSDS}..L.~.K.....M......d:\a01\_work\11\s\\binaries\x86ret\bin\i386\\MFC140ESN.i386.pdb.........8....rdata..8........rdata$zzzdbg.... ..p....rsrc$01....p1.......rsrc$02........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\SysWOW64\mfc140fra.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):68480
                                                                                                                                                                                                                      Entropy (8bit):4.312133669104578
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:G26iNYajZEL21YFmNRYxAaTafCp5eQYZmZUjyyyyyyyyyyyyyyyUGQFUbWTVNe9F:GNuqL216A2SCHu0jqwT/t
                                                                                                                                                                                                                      MD5:6BC9BC66BF245B796AB929B386DA85AF
                                                                                                                                                                                                                      SHA1:9FDAAC9FAD8B76D24D4421862D089BE381D3C58D
                                                                                                                                                                                                                      SHA-256:81444E2425728F609B3BCB14B2227ACE8E68FD811321AA71DBC24F3A41ABEDB1
                                                                                                                                                                                                                      SHA-512:437D81EACCDEF7613A7EC2789C74FB55EADDF896438323371828AD11E91CB71C7997D0A10ABC2D7F30927C772D73D9AD9CD1BCE9908EE59611A70F5048DCD07D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-h=.i.S.i.S.i.S.;|..h.S.;|Q.h.S.Richi.S.................PE..L....~.a.........."!.....................................................................@.......................................... ...................#..............8............................................................................text...............................@..@.rsrc........ ......................@..@.....~.a........X...8...8........~.a........T...........RSDS.@y.I..A....g.X.....d:\a01\_work\11\s\\binaries\x86ret\bin\i386\\MFC140FRA.i386.pdb.........8....rdata..8........rdata$zzzdbg.... ..p....rsrc$01....p1..0....rsrc$02........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\SysWOW64\mfc140ita.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):66424
                                                                                                                                                                                                                      Entropy (8bit):4.2978120729838745
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:lQE6XaCyqbK15MUWwgDGxNIlW3jSCQQQjeqS1hDDg1UWTVbSw4V:lQass5MUWwgSxNIlW3GoiTYwO
                                                                                                                                                                                                                      MD5:26ED3202C56B62561A540F18194817AA
                                                                                                                                                                                                                      SHA1:2515ABEF7E0111AF06F1A8EA45FAE99045A6011B
                                                                                                                                                                                                                      SHA-256:3D3F8F397973F0F0009A5FCFF8E0E1AD96B70306E37CBD4CFE3B86FFDD6AE047
                                                                                                                                                                                                                      SHA-512:C14B6ACC3FEC0D9D616036BCE7AF7AE0ECDC3B455E0A57545864A7C9E26ECBCC57B0AB765335BB5A747BC75F007A219F55314936F55C2CAC2CEA48628120FF25
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-h=.i.S.i.S.i.S.;|..h.S.;|Q.h.S.Richi.S.................PE..L....~.a.........."!.................................................................*....@.......................................... ..................x#..............8............................................................................text...............................@..@.rsrc........ ......................@..@.....~.a........X...8...8........~.a........T...........RSDS...=...C.....+K....d:\a01\_work\11\s\\binaries\x86ret\bin\i386\\MFC140ITA.i386.pdb.........8....rdata..8........rdata$zzzdbg.... ..p....rsrc$01....p1.......rsrc$02........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\SysWOW64\mfc140jpn.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):47992
                                                                                                                                                                                                                      Entropy (8bit):5.582914308519201
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:oXEuxNo7CLeERKVxrazs/4W9hW/fJxQbLr10/eu9HdTH2pgepZ1/fq/tQ0HRN7Mk:qpxanVn/7kfJxsr10/eu9RHreISwMfP0
                                                                                                                                                                                                                      MD5:7F7A7028849FB24D6A2A35866EED8F6F
                                                                                                                                                                                                                      SHA1:866FFC74EFCCE33BC2227C36EFBBF6ABEF07AD03
                                                                                                                                                                                                                      SHA-256:4E1E12CDD18EDD13A6643E040B3BF03521A01998EDDA4BE8569AC3EF6C5204D4
                                                                                                                                                                                                                      SHA-512:D1C44A049F7F125E353B04924E5B84FECE4B052CD2DE99CC4BA045697860D9888A1043395264A05FD512494EF6885C77B2EF964710F4F4472A114A88EDD98EFB
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-h=.i.S.i.S.i.S.;|..h.S.;|Q.h.S.Richi.S.................PE..L....~.a.........."!................................................................-5....@.......................................... ..................x#..............8............................................................................text...............................@..@.rsrc........ ......................@..@.....~.a........X...8...8........~.a........T...........RSDS..i.n.{N.u.+.hDJ....d:\a01\_work\11\s\\binaries\x86ret\bin\i386\\MFC140JPN.i386.pdb.........8....rdata..8........rdata$zzzdbg.... ..p....rsrc$01....p1.......rsrc$02........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\SysWOW64\mfc140kor.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):46976
                                                                                                                                                                                                                      Entropy (8bit):5.73683347993458
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:NjVQO54LQTN1lUaHqNA3B2I7CvqBARpLi:NjZ51TN1vqNAx2I7CvqWRE
                                                                                                                                                                                                                      MD5:F71F4BCE06D1C59C5D289D73E429D27B
                                                                                                                                                                                                                      SHA1:93276415001E65A61FDE6056E327734E859EA660
                                                                                                                                                                                                                      SHA-256:4A48AC40E304D9CDD66AB61EAA86436049B7A7B61B3EF118ECDA90D14FDE63D5
                                                                                                                                                                                                                      SHA-512:C9EF375CC79081DC6C31178969A0D1C52906AD3C97E84BD7A04824D0955A6DD610FFCCC65CEA855AC8030EAC997258B87557082EC839D26E3D8F7EBA517EB99D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-h=.i.S.i.S.i.S.;|..h.S.;|Q.h.S.Richi.S.................PE..L....~.a.........."!......................................................................@.......................................... ...................#..............8............................................................................text...............................@..@.rsrc........ ......................@..@.....~.a........X...8...8........~.a........T...........RSDS.K:..".L...<..V.....d:\a01\_work\11\s\\binaries\x86ret\bin\i386\\MFC140KOR.i386.pdb.........8....rdata..8........rdata$zzzdbg.... ..p....rsrc$01....p1..@~...rsrc$02........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\SysWOW64\mfc140rus.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):64392
                                                                                                                                                                                                                      Entropy (8bit):4.898526397291684
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:CCdAv1x9zsFPEd4RXO9NFWV5W5tUqNTaTaFRhVhtZ+zydVmp+dBE7DVCyHCfSXKp:7Av/gFXOvsciqNWTMHVhtZgFckD9XA9
                                                                                                                                                                                                                      MD5:EA2DDC9AD72E7B8E230945B6B5265CDB
                                                                                                                                                                                                                      SHA1:E58DF439506F4C265B4DBFF41B0DFE7F7C6DCFC4
                                                                                                                                                                                                                      SHA-256:02F670F9DDDA28AD5A1F29629C78217F24FA17B18E3499A6D5FD719B90084129
                                                                                                                                                                                                                      SHA-512:9D3349EA8ADD4044C7F34B724A14BC14AB559BFE6F086FA578FD3C266DC3C543B4F867A65D7F5A858C7E49A0522EE057DD98F7014255F89E87333F5C34EB77EE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......-h=.i.S.i.S.i.S.;|..h.S.;|Q.h.S.Richi.S.................PE..L....~.a.........."!.....................................................................@.......................................... ...................#..............8............................................................................text...............................@..@.rsrc........ ......................@..@.....~.a........X...8...8........~.a........T...........RSDS...g .K..`........d:\a01\_work\11\s\\binaries\x86ret\bin\i386\\MFC140RUS.i386.pdb.........8....rdata..8........rdata$zzzdbg.... ..p....rsrc$01....p1..H....rsrc$02........................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\SysWOW64\mfc140u.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5127088
                                                                                                                                                                                                                      Entropy (8bit):6.861766335751532
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:98304:bJZczGW8ke6KllNHsyBqGeQVrrNW2XkGMWrGFLOAkGkzdnEVomFHKnPUUdMG:XczGRGKLBZ/YGkGMWKFLOyomFHKnPr1
                                                                                                                                                                                                                      MD5:E76B52D11DB435D36453D26C8B446A8F
                                                                                                                                                                                                                      SHA1:6E20C17ED973E38D4A3F26CFC020AF05FF9A6EEA
                                                                                                                                                                                                                      SHA-256:E422C9366A53536A35E307EF301F08661C28C29B7FCDA1B454333C6A41C6BB21
                                                                                                                                                                                                                      SHA-512:486BE0145D5E439D3D9F5191A4A49EA3685619796557CD7A361117C25A279EE7B94A9FF70C4D73ADBE839A6CE508AB15692DDD8FD6EABC3DBEF18B68D6B0C67F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........8'..Vt..Vt..VtI.Su..VtI.Qu..VtI.Ru..Vt...t..Vt..Wu..Vt..Ru..Vt..Uu..VtI.Wu..Vt..WtX.Vt..Su..Vt.._u7.Vt..Vu..Vt...t..Vt..Tu..VtRich..Vt................PE..L......a.........."!......3..r......`L......../..............................`N.....M.N...@A............................L.....4...... 5...............N..'....J.|...p.3.8............................a..@.............4.......3......................text.....3.......3................. ..`.data...H.....3.......3.............@....idata..DS....4..T....4.............@..@.didat........5.......4.............@....rsrc........ 5.......4.............@..@.reloc..|.....J......tJ.............@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\SysWOW64\mfcm140.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):75144
                                                                                                                                                                                                                      Entropy (8bit):6.3113139700554575
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:FVkyQTCvV3XRVd4Sb30CMhqMQC2OX1y3BVO5nc/lcwsZGqlyQI3nP20c9LHAiIsy:9QsVn3b3bMhqMXk/SwsZGHpclr7gph
                                                                                                                                                                                                                      MD5:F6ECEEFE01D0049C8AF1462B61B09FB5
                                                                                                                                                                                                                      SHA1:A91F0643EDA6EDF26AEA79E40262485D30673453
                                                                                                                                                                                                                      SHA-256:C833B4835B4364E9F285778023C16FC17258F4FA79201F89A9D85705AC79AFC6
                                                                                                                                                                                                                      SHA-512:7588137A670ADB0642EC4C66152F05EA0860B2056B726CA12D0C37899C65AC499DC3BF11BD76B6705B217E96C355D6486F0C1F407AA816685836B5935208B58D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........U............Q........,............................,.....Q..............................@............Rich............................PE..L....~.a.........."!.....@..........MN.......P...............................0......7.....@.........................`....... ............................#... ..L...lU..8............................T..@............P..(............R..H............text....>.......@.................. ..`.rdata..T....P.......D..............@..@.data...............................@....rsrc...............................@..@.reloc..L.... ......................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\SysWOW64\mfcm140u.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):75144
                                                                                                                                                                                                                      Entropy (8bit):6.31364801660595
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:GDCAxICoV3XRI5MSNe+TgFCnzPA93BVO5n4nfOwsZGwlyQM7busGttL+ae3uEOVW:OxMVnaNtTgQAxnGwsZGdxIseEXH
                                                                                                                                                                                                                      MD5:48EB0B4031C5E12E267091A0B7A744B5
                                                                                                                                                                                                                      SHA1:19ADE2F28D14257667AC37CBB5DBF65851FA825F
                                                                                                                                                                                                                      SHA-256:B1C4C7265E13B256265DE07DAA92BC6B33A9EEE667B5696781C9D7C1C427DFF1
                                                                                                                                                                                                                      SHA-512:AE9E7EC5699DF35ADC6163C5427C5B03EDB859E623088A91DF748565693E7A82756A6500C5B4D07AD31B2852275414F12F00E84ABC9DD120E133BDE8CA3B313D
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........U............Q........,............................,.....Q..............................@............Rich............................PE..L....~.a.........."!.....@..........MN.......P...............................0......_~....@.........................`....... ............................#... ..L...lU..8............................T..@............P..(............R..H............text....>.......@.................. ..`.rdata..T....P.......D..............@..@.data...............................@....rsrc...............................@..@.reloc..L.... ......................@..B........................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\SysWOW64\vcamp140.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):354680
                                                                                                                                                                                                                      Entropy (8bit):6.434289803691807
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6144:cCdVgZ0uNXvM8YTenZepABfJ4cyZDguVZVZMafsqAiHSOCEY:Bg6uZY07J4cyZ8uzMarHSOCEY
                                                                                                                                                                                                                      MD5:BD7654F48D80112EBCB0A33EC01886A3
                                                                                                                                                                                                                      SHA1:3AD6252FAA1DA0B338A13F69FF8E7B9C60AD3AF2
                                                                                                                                                                                                                      SHA-256:D3EDEEF76025CF847EEFBC6E87D6B73E052DFAC9F17E097D556871927A33493B
                                                                                                                                                                                                                      SHA-512:DBC24DCD9D1024DA3630566D9390E73BF3A40B9D833511A30C5F96F4B153565FDC661E67A0DC4D778CF707DE24DDEF5D73118A6FDB7FA51DA487848A4B1F4CDC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........8...V...V...V.......V......V..W...V..S...V..R...V..U...V.(.W...V...W.X.V.._...V..V...V......V.......V..T...V.Rich..V.........................PE..L....~.a.........."!................@-.......................................p.......!....@A........................0t..47......@.......8$...........F..x#...0...>...g..8....................h.......g..@............................................text...d........................... ..`.data....*.......(..................@....idata..............................@..@.rsrc...8$.......&..................@..@.reloc...>...0...@..................@..B................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\SysWOW64\vcomp140.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):148864
                                                                                                                                                                                                                      Entropy (8bit):6.623619304977769
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:bCgW5wW7E0JJbNRiQJ/dtSoxV6dzHacl9IzscYPG/jGt+:yuUVBxVS6cLS3/jGt
                                                                                                                                                                                                                      MD5:1B4F15CC7C242E15E2042B7AB60F0A60
                                                                                                                                                                                                                      SHA1:66A8347A980C62A9F6EFEC559D1ACF80C082E43E
                                                                                                                                                                                                                      SHA-256:E848D39DA54B1816644F8DE1F620E6633E6BCA2B2A9F937A6FBCB246D841E211
                                                                                                                                                                                                                      SHA-512:FC6477AED270A2D7EB7C12D4A289B0B764CE1F36457999FFC7ADC3E13587133985BC6168A60F431D8F96E5998D50C45756CFB3ADEBA291A3B1D144829129E9B4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............L..L..L...M..L...M...L...M...L..M...L..M..L..M..L0.M..L..L...L..M..L..M..L..vL..L..M..LRich..L........PE..L....~.a.........."!.........L......0........................................p............@.................................X!..(....0..............."...#...P..`...po..8............................o..@............ ..T............................text...E........................... ..`.data...(...........................@....idata....... ......................@..@.rsrc........0......................@..@.reloc..`....P......................@..B........................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\System32\DriverStore\Temp\{1b774c08-0e2d-f04a-affb-563599d0a20e}\SET8C1F.tmp

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\drvinst.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):11615
                                                                                                                                                                                                                      Entropy (8bit):7.3868789934614245
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:wOOgvXhARJCUnEwKUNhYCBkyLrp0KBQfX01k9z3AX6USwFVW:xARgUNh3BkyRxB+R9zW7HW
                                                                                                                                                                                                                      MD5:542FCDD371B6C4D2D8689514BD618AF5
                                                                                                                                                                                                                      SHA1:36A4959B6100263D4E0615E981E08E425604FCEC
                                                                                                                                                                                                                      SHA-256:0BA953EDEA4CACC7FFA37275B95B5DAD3BF8410E8649C1B98D9C59336ED01D2E
                                                                                                                                                                                                                      SHA-512:A951AA9AA5729A59C8CF31F65F1EBE1BC2037AC53393EBF5D859B95A66F1701DBCD1E466A49ACD80A56E44039C0D6E4D5CA6247A98EF9D341EF3C4227FFE68FC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:0.-[..*.H........-L0.-H...1.0...`.H.e......0.....+.....7......0...0...+.....7.......5.v.E...R.|....240617150138Z0...+.....7.....0..?0....z..lbX...i##.d>j.t=1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...s.y.s...0.....s..Q.`a..Z....:...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...i.n.f...0.... ...U...;.}A@.K..M..u..K.7..C0!.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ...U...;.}A@.K..M..u..K.7..C0!.0... .KZze..J7......~....*........H.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .KZze..J7......~....*........H.....0...0....+.....7......0.....S.u.

                                                                                                                                                                                                                      C:\Windows\System32\DriverStore\Temp\{1b774c08-0e2d-f04a-affb-563599d0a20e}\SET8C3F.tmp

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\drvinst.exe
                                                                                                                                                                                                                      File Type:Windows setup INFormation
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2458
                                                                                                                                                                                                                      Entropy (8bit):4.908381744177934
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:McNx2HvlzPtPbdZ0d7OPd/eohC/fr+ypHhqFWi4lTXlfv:McNx2P5hbdyd7O9eYEfFoEDlfv
                                                                                                                                                                                                                      MD5:4ADE9CA0F531877BF4AFA77A0122FE46
                                                                                                                                                                                                                      SHA1:A973FDC751DE606195E4BF5ADEF604863A13111F
                                                                                                                                                                                                                      SHA-256:BE4B5A7A65B0064A37FEE1CAD48385827ED9E50BA22A95E6CCDEF49DD5C248A5
                                                                                                                                                                                                                      SHA-512:EAA5E18E04FF44C1120DD6F951A954BEE85000507F3D1579BF23FB360B9BDEE05FD4BE15154304712A9B4E528CF961EDBD64F112E61A70CF0FBDFCC2AE72E307
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:;..; generic-driver.inf..; .NT$ARCH$....[Version].. Signature = "$WINDOWS NT$".. Class = GlassWire.. ClassGuid = {917D8DAF-DE89-44B7-8907-B422ECB01F53}.. Provider = %ManufacturerName%.. CatalogFile = gwdrv.cat.. DriverVer = 06/17/2024,17.44.6.748.. PnpLockdown = 1....;********************************************..; driver install section..;********************************************....[SourceDisksNames].. 1 = %DiskName%,,,""....[SourceDisksFiles].. gwdrv.sys = 1,,....[DestinationDirs].. DefaultDestDir = 12 ; %windir%\system32\drivers.. GwGeneric.DriverFiles = 12 ; %windir%\system32\drivers....[DefaultInstall.NTamd64].. OptionDesc = %GwGenericDriverDescription%.. CopyFiles = GwGeneric.CopyDriverFiles....[DefaultUninstall.NTamd64].. LegacyUninstall=1.. DelFiles = GwGeneric.DeleteDriverFiles....[GwGeneric.CopyDriverFiles].. gwdrv.sys,,,0x00000040 ; COPYFLG_OVERWRITE_OLDER_ONLY....[GwGeneric.DeleteD

                                                                                                                                                                                                                      C:\Windows\System32\DriverStore\Temp\{1b774c08-0e2d-f04a-affb-563599d0a20e}\SET8C50.tmp

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\drvinst.exe
                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):48296
                                                                                                                                                                                                                      Entropy (8bit):6.297840034594717
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:E0v8QOvjN2NGTn77rmisnSENWGvw4emXubnjeW5aYz6lBhJ/4tBH3ZEpw9zYUb0:E0EQOv4NGTn77rmisnSeWGvBaGJ/4tB8
                                                                                                                                                                                                                      MD5:715021B0BC7B2E8E3C13B384CDE5B392
                                                                                                                                                                                                                      SHA1:006275D68C8A2BA58477AED1980835EB58512329
                                                                                                                                                                                                                      SHA-256:42B85F2E37FFE04970D6BB1476978046EAD72DDF57392E396AD54A08B52A4AA0
                                                                                                                                                                                                                      SHA-512:BEBB72A7F11694463DDFD7575E67F078360BF32C75B0630FDEE30BC8A5649E53C2F56BFDF55ADD494CADA9A78C6E58E25FF675AA432E296F5D1CF6AE0595E910
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5...[D..[D..[D..\E..[D..]E..[D..XE..[D.._E..[D..ZE..[D..ZD..[D.`_E..[D.`.D..[D.`YE..[DRich..[D........................PE..d....Kpf.........."....(.n...$......Pl.........@....................................4}.....A................................................0...d.......(.......l........(.......... ...8...............................@............................................text....f.......h.................. ..h.rdata..h............l..............@..H.data...h............~..............@....pdata..l...........................@..HINIT....P........................... ..b.rsrc...(...........................@..B.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\System32\DriverStore\Temp\{1b774c08-0e2d-f04a-affb-563599d0a20e}\gwdrv.cat (copy)

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\drvinst.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):11615
                                                                                                                                                                                                                      Entropy (8bit):7.3868789934614245
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:wOOgvXhARJCUnEwKUNhYCBkyLrp0KBQfX01k9z3AX6USwFVW:xARgUNh3BkyRxB+R9zW7HW
                                                                                                                                                                                                                      MD5:542FCDD371B6C4D2D8689514BD618AF5
                                                                                                                                                                                                                      SHA1:36A4959B6100263D4E0615E981E08E425604FCEC
                                                                                                                                                                                                                      SHA-256:0BA953EDEA4CACC7FFA37275B95B5DAD3BF8410E8649C1B98D9C59336ED01D2E
                                                                                                                                                                                                                      SHA-512:A951AA9AA5729A59C8CF31F65F1EBE1BC2037AC53393EBF5D859B95A66F1701DBCD1E466A49ACD80A56E44039C0D6E4D5CA6247A98EF9D341EF3C4227FFE68FC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:0.-[..*.H........-L0.-H...1.0...`.H.e......0.....+.....7......0...0...+.....7.......5.v.E...R.|....240617150138Z0...+.....7.....0..?0....z..lbX...i##.d>j.t=1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...s.y.s...0.....s..Q.`a..Z....:...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...i.n.f...0.... ...U...;.}A@.K..M..u..K.7..C0!.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ...U...;.}A@.K..M..u..K.7..C0!.0... .KZze..J7......~....*........H.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .KZze..J7......~....*........H.....0...0....+.....7......0.....S.u.

                                                                                                                                                                                                                      C:\Windows\System32\DriverStore\Temp\{1b774c08-0e2d-f04a-affb-563599d0a20e}\gwdrv.inf (copy)

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\drvinst.exe
                                                                                                                                                                                                                      File Type:Windows setup INFormation
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2458
                                                                                                                                                                                                                      Entropy (8bit):4.908381744177934
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:McNx2HvlzPtPbdZ0d7OPd/eohC/fr+ypHhqFWi4lTXlfv:McNx2P5hbdyd7O9eYEfFoEDlfv
                                                                                                                                                                                                                      MD5:4ADE9CA0F531877BF4AFA77A0122FE46
                                                                                                                                                                                                                      SHA1:A973FDC751DE606195E4BF5ADEF604863A13111F
                                                                                                                                                                                                                      SHA-256:BE4B5A7A65B0064A37FEE1CAD48385827ED9E50BA22A95E6CCDEF49DD5C248A5
                                                                                                                                                                                                                      SHA-512:EAA5E18E04FF44C1120DD6F951A954BEE85000507F3D1579BF23FB360B9BDEE05FD4BE15154304712A9B4E528CF961EDBD64F112E61A70CF0FBDFCC2AE72E307
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:;..; generic-driver.inf..; .NT$ARCH$....[Version].. Signature = "$WINDOWS NT$".. Class = GlassWire.. ClassGuid = {917D8DAF-DE89-44B7-8907-B422ECB01F53}.. Provider = %ManufacturerName%.. CatalogFile = gwdrv.cat.. DriverVer = 06/17/2024,17.44.6.748.. PnpLockdown = 1....;********************************************..; driver install section..;********************************************....[SourceDisksNames].. 1 = %DiskName%,,,""....[SourceDisksFiles].. gwdrv.sys = 1,,....[DestinationDirs].. DefaultDestDir = 12 ; %windir%\system32\drivers.. GwGeneric.DriverFiles = 12 ; %windir%\system32\drivers....[DefaultInstall.NTamd64].. OptionDesc = %GwGenericDriverDescription%.. CopyFiles = GwGeneric.CopyDriverFiles....[DefaultUninstall.NTamd64].. LegacyUninstall=1.. DelFiles = GwGeneric.DeleteDriverFiles....[GwGeneric.CopyDriverFiles].. gwdrv.sys,,,0x00000040 ; COPYFLG_OVERWRITE_OLDER_ONLY....[GwGeneric.DeleteD

                                                                                                                                                                                                                      C:\Windows\System32\DriverStore\Temp\{1b774c08-0e2d-f04a-affb-563599d0a20e}\gwdrv.sys (copy)

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\drvinst.exe
                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):48296
                                                                                                                                                                                                                      Entropy (8bit):6.297840034594717
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:E0v8QOvjN2NGTn77rmisnSENWGvw4emXubnjeW5aYz6lBhJ/4tBH3ZEpw9zYUb0:E0EQOv4NGTn77rmisnSeWGvBaGJ/4tB8
                                                                                                                                                                                                                      MD5:715021B0BC7B2E8E3C13B384CDE5B392
                                                                                                                                                                                                                      SHA1:006275D68C8A2BA58477AED1980835EB58512329
                                                                                                                                                                                                                      SHA-256:42B85F2E37FFE04970D6BB1476978046EAD72DDF57392E396AD54A08B52A4AA0
                                                                                                                                                                                                                      SHA-512:BEBB72A7F11694463DDFD7575E67F078360BF32C75B0630FDEE30BC8A5649E53C2F56BFDF55ADD494CADA9A78C6E58E25FF675AA432E296F5D1CF6AE0595E910
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5...[D..[D..[D..\E..[D..]E..[D..XE..[D.._E..[D..ZE..[D..ZD..[D.`_E..[D.`.D..[D.`YE..[DRich..[D........................PE..d....Kpf.........."....(.n...$......Pl.........@....................................4}.....A................................................0...d.......(.......l........(.......... ...8...............................@............................................text....f.......h.................. ..h.rdata..h............l..............@..H.data...h............~..............@....pdata..l...........................@..HINIT....P........................... ..b.rsrc...(...........................@..B.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\System32\catroot2\dberr.txt

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\drvinst.exe
                                                                                                                                                                                                                      File Type:ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:modified
                                                                                                                                                                                                                      Size (bytes):4404
                                                                                                                                                                                                                      Entropy (8bit):5.390330239687194
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:QO00eO00erMwUgWUg0B1kE3ZhpJp8ZpkRepk3hpTpbCpEpDk+psNVpsLz:QO00eO00erMwmkB1kAIrN4X
                                                                                                                                                                                                                      MD5:133D7FD76B42C5823A47BF21ECA6E6EC
                                                                                                                                                                                                                      SHA1:E358D4C9B5659C2D4AD261ED8ACEB9E5A9F4BD35
                                                                                                                                                                                                                      SHA-256:36FAE3AF76D630C561140B977C5CBC9E0ABFA602279B26F976416D07E862FB78
                                                                                                                                                                                                                      SHA-512:E3E7BC0A8FECF524A97496D4175F0C9D1B9882DCEF7A214CF1CE216586EFAF332338C966E14A0CA07D776D96D537950A0D17F38CC200FD7AC65714ED6A550646
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6041 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #6699 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #4398 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2083 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #2459 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: SyncAllDBs Corruption or Schema Change..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #891 encountered JET error -1409..CatalogDB: 08:57:12 03/10/2023: catdbsvc.cpp at line #1307 encountered JET error -1601..CatalogDB: 08:57:12 03/10/2023: SyncDB:: Sync sta

                                                                                                                                                                                                                      C:\Windows\System32\drivers\gwdrv.cat

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):11615
                                                                                                                                                                                                                      Entropy (8bit):7.3868789934614245
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:wOOgvXhARJCUnEwKUNhYCBkyLrp0KBQfX01k9z3AX6USwFVW:xARgUNh3BkyRxB+R9zW7HW
                                                                                                                                                                                                                      MD5:542FCDD371B6C4D2D8689514BD618AF5
                                                                                                                                                                                                                      SHA1:36A4959B6100263D4E0615E981E08E425604FCEC
                                                                                                                                                                                                                      SHA-256:0BA953EDEA4CACC7FFA37275B95B5DAD3BF8410E8649C1B98D9C59336ED01D2E
                                                                                                                                                                                                                      SHA-512:A951AA9AA5729A59C8CF31F65F1EBE1BC2037AC53393EBF5D859B95A66F1701DBCD1E466A49ACD80A56E44039C0D6E4D5CA6247A98EF9D341EF3C4227FFE68FC
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:0.-[..*.H........-L0.-H...1.0...`.H.e......0.....+.....7......0...0...+.....7.......5.v.E...R.|....240617150138Z0...+.....7.....0..?0....z..lbX...i##.d>j.t=1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...s.y.s...0.....s..Q.`a..Z....:...1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...i.n.f...0.... ...U...;.}A@.K..M..u..K.7..C0!.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...s.y.s...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... ...U...;.}A@.K..M..u..K.7..C0!.0... .KZze..J7......~....*........H.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...06..+.....7...1(0&...F.i.l.e........g.w.d.r.v...i.n.f...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .KZze..J7......~....*........H.....0...0....+.....7......0.....S.u.

                                                                                                                                                                                                                      C:\Windows\System32\drivers\gwdrv.inf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:Windows setup INFormation
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2458
                                                                                                                                                                                                                      Entropy (8bit):4.908381744177934
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:McNx2HvlzPtPbdZ0d7OPd/eohC/fr+ypHhqFWi4lTXlfv:McNx2P5hbdyd7O9eYEfFoEDlfv
                                                                                                                                                                                                                      MD5:4ADE9CA0F531877BF4AFA77A0122FE46
                                                                                                                                                                                                                      SHA1:A973FDC751DE606195E4BF5ADEF604863A13111F
                                                                                                                                                                                                                      SHA-256:BE4B5A7A65B0064A37FEE1CAD48385827ED9E50BA22A95E6CCDEF49DD5C248A5
                                                                                                                                                                                                                      SHA-512:EAA5E18E04FF44C1120DD6F951A954BEE85000507F3D1579BF23FB360B9BDEE05FD4BE15154304712A9B4E528CF961EDBD64F112E61A70CF0FBDFCC2AE72E307
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:;..; generic-driver.inf..; .NT$ARCH$....[Version].. Signature = "$WINDOWS NT$".. Class = GlassWire.. ClassGuid = {917D8DAF-DE89-44B7-8907-B422ECB01F53}.. Provider = %ManufacturerName%.. CatalogFile = gwdrv.cat.. DriverVer = 06/17/2024,17.44.6.748.. PnpLockdown = 1....;********************************************..; driver install section..;********************************************....[SourceDisksNames].. 1 = %DiskName%,,,""....[SourceDisksFiles].. gwdrv.sys = 1,,....[DestinationDirs].. DefaultDestDir = 12 ; %windir%\system32\drivers.. GwGeneric.DriverFiles = 12 ; %windir%\system32\drivers....[DefaultInstall.NTamd64].. OptionDesc = %GwGenericDriverDescription%.. CopyFiles = GwGeneric.CopyDriverFiles....[DefaultUninstall.NTamd64].. LegacyUninstall=1.. DelFiles = GwGeneric.DeleteDriverFiles....[GwGeneric.CopyDriverFiles].. gwdrv.sys,,,0x00000040 ; COPYFLG_OVERWRITE_OLDER_ONLY....[GwGeneric.DeleteD

                                                                                                                                                                                                                      C:\Windows\System32\drivers\gwdrv.sys

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):48296
                                                                                                                                                                                                                      Entropy (8bit):6.297840034594717
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:E0v8QOvjN2NGTn77rmisnSENWGvw4emXubnjeW5aYz6lBhJ/4tBH3ZEpw9zYUb0:E0EQOv4NGTn77rmisnSeWGvBaGJ/4tB8
                                                                                                                                                                                                                      MD5:715021B0BC7B2E8E3C13B384CDE5B392
                                                                                                                                                                                                                      SHA1:006275D68C8A2BA58477AED1980835EB58512329
                                                                                                                                                                                                                      SHA-256:42B85F2E37FFE04970D6BB1476978046EAD72DDF57392E396AD54A08B52A4AA0
                                                                                                                                                                                                                      SHA-512:BEBB72A7F11694463DDFD7575E67F078360BF32C75B0630FDEE30BC8A5649E53C2F56BFDF55ADD494CADA9A78C6E58E25FF675AA432E296F5D1CF6AE0595E910
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5...[D..[D..[D..\E..[D..]E..[D..XE..[D.._E..[D..ZE..[D..ZD..[D.`_E..[D.`.D..[D.`YE..[DRich..[D........................PE..d....Kpf.........."....(.n...$......Pl.........@....................................4}.....A................................................0...d.......(.......l........(.......... ...8...............................@............................................text....f.......h.................. ..h.rdata..h............l..............@..H.data...h............~..............@....pdata..l...........................@..HINIT....P........................... ..b.rsrc...(...........................@..B.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\OLD945C.tmp

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\drvinst.exe
                                                                                                                                                                                                                      File Type:PE32+ executable (native) x86-64, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):48296
                                                                                                                                                                                                                      Entropy (8bit):6.297840034594717
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:768:E0v8QOvjN2NGTn77rmisnSENWGvw4emXubnjeW5aYz6lBhJ/4tBH3ZEpw9zYUb0:E0EQOv4NGTn77rmisnSeWGvBaGJ/4tB8
                                                                                                                                                                                                                      MD5:715021B0BC7B2E8E3C13B384CDE5B392
                                                                                                                                                                                                                      SHA1:006275D68C8A2BA58477AED1980835EB58512329
                                                                                                                                                                                                                      SHA-256:42B85F2E37FFE04970D6BB1476978046EAD72DDF57392E396AD54A08B52A4AA0
                                                                                                                                                                                                                      SHA-512:BEBB72A7F11694463DDFD7575E67F078360BF32C75B0630FDEE30BC8A5649E53C2F56BFDF55ADD494CADA9A78C6E58E25FF675AA432E296F5D1CF6AE0595E910
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Antivirus:
                                                                                                                                                                                                                      • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........5...[D..[D..[D..\E..[D..]E..[D..XE..[D.._E..[D..ZE..[D..ZD..[D.`_E..[D.`.D..[D.`YE..[DRich..[D........................PE..d....Kpf.........."....(.n...$......Pl.........@....................................4}.....A................................................0...d.......(.......l........(.......... ...8...............................@............................................text....f.......h.................. ..h.rdata..h............l..............@..H.data...h............~..............@....pdata..l...........................@..HINIT....P........................... ..b.rsrc...(...........................@..B.reloc..............................@..B................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1028\license.rtf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):18127
                                                                                                                                                                                                                      Entropy (8bit):4.036737741619669
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:xaz+aCQbjdBCLCgfvtfLEmmVxJzLKLIW7cBFCoSM0fvJ93eyryH1MqG1xcRY/c5f:seh/IMHexG4q2
                                                                                                                                                                                                                      MD5:B7F65A3A169484D21FA075CCA79083ED
                                                                                                                                                                                                                      SHA1:5DBFA18928529A798FF84C14FD333CB08B3377C0
                                                                                                                                                                                                                      SHA-256:32585B93E69272B6D42DAC718E04D954769FE31AC9217C6431510E9EEAD78C49
                                                                                                                                                                                                                      SHA-512:EDA2F946C2E35464E4272B1C3E4A8DC5F17093C05DAB9A685DBEFD5A870B9D872D8A1645ED6F5B9A72BBB2A59D22DFA58FBF420F6440278CCBE07B6D0555C283
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset134 SimSun;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT \f1\'dc\'9b\'f3\'77\'ca\'da\'99\'e0\'97\'6c\'bf\'ee\f0\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0\f1\'b1\'be\'ca\'da\'99\'e0\'97\'6c\'bf\'ee\'ca\'c7\'d9\'46\'d3\'c3\'91\'f4\'c5\'63\f0 Microsoft Corporation (\f1\'bb\'f2\'c6\'e4\'ea\'50\'82\'53\'c6\'f3\'98\'49\'a3\'ac\'d2\'95\'d9\'46\'d3\'c3\'91\'f4\'cb\'f9\'be\'d3\'d7\'a1\'b5\'c4\'b5\'d8\'fc\'63\'b6\'f8\'b6\'a8\f0 ) \f1\'d6\'ae\'e9\'67\'b3\'c9\'c1\'a2\'b5\'c4\'ba\'cf\'bc\'73\'a1\'a3\'cb\'fb\'82\'83\'df\'6d\'d3\'c3\'ec\'b6\'c9\'cf\'ca\'f6\'dc\'9b\'f3\'77\'a3\'ac\'b1\'be\'ca\'da\'99\'e0\'97\'6c\'bf\'ee\'d2\'e0\'df\'6d\'d3\'c3\'ec\'b6\'c8\'ce\'ba\'ce\f0 Microsoft \f1\'b7\'fe\'84\'d5\'bb\'f2\'b1\'be\'dc\'9b\'f3\'77\'d6\'ae\'b8\'fc\'d0\'c2\'a3

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1028\thm.wxl

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2980
                                                                                                                                                                                                                      Entropy (8bit):6.163758160900388
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:c5DiTlOtMes9T/JhDXsA9EHSniarRFeOrw8N3mZNNTN2N08CEjMUWFPmDlTKJKy2:uDiTlFrDDsA9tfHP8+8nhM0WamzqDFqD
                                                                                                                                                                                                                      MD5:472ABBEDCBAD24DBA5B5F5E8D02C340F
                                                                                                                                                                                                                      SHA1:974F62B5C2E149C3879DD16E5A9DBB9406C3DB85
                                                                                                                                                                                                                      SHA-256:8E2E660DFB66CB453E17F1B6991799678B1C8B350A55F9EBE2BA0028018A15AD
                                                                                                                                                                                                                      SHA-512:676E29378AAED25DE6008D213EFA10D1F5AAD107833E218D71F697E728B7B5B57DE42E7A910F121948D7B1B47AB4F7AE63F71196C747E8AE2B4827F754FC2699
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">....</String>.. <String Id="HelpText">/install | /repair | /uninstall | /layout [directory] - ................. ......................../passive | /quiet - .... UI ........... UI.... ........... UI ........../norestart - ................UI ............./log log.txt - .........

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1029\license.rtf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):13053
                                                                                                                                                                                                                      Entropy (8bit):5.125552901367032
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:TKwfs7OUpXLa5HEXQwNCNvZSjotXxiwH++3kamdEj6ZDbugDHgbGNlv6NbrYGY9x:Lfs7c5DRH0aHmJGpafU0AliwGra2
                                                                                                                                                                                                                      MD5:B408556A89FCE3B47CD61302ECA64AC9
                                                                                                                                                                                                                      SHA1:AAC1CDAF085162EFF5EAABF562452C93B73370CB
                                                                                                                                                                                                                      SHA-256:21DDCBB0B0860E15FF9294CBB3C4E25B1FE48619210B8A1FDEC90BDCDC8C04BC
                                                                                                                                                                                                                      SHA-512:BDE33918E68388C60750C964CDC213EC069CE1F6430C2AA7CF1626E6785C7C865094E59420D00026918E04B9B8D19FA22AC440F851ADC360759977676F8891E7
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset238 Tahoma;}{\f2\fnil\fcharset0 Garamond;}{\f3\fnil Tahoma;}{\f4\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 LICEN\f1\'c8N\f0\'cd PODM\'cdNKY PRO SOFTWARE SPOLE\f1\'c8NOSTI MICROSOFT\par..\f0 MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 Tyto licen\f1\'e8n\f0\'ed podm\'ednky p\f1\'f8edstavuj\f0\'ed smlouvu mezi spole\f1\'e8nost\f0\'ed Microsoft Corporation (nebo n\f1\'eckterou z\~jej\f0\'edch afilac\'ed v\~z\'e1vislosti na tom, kde bydl\'edte) a\~v\'e1mi. Vztahuj\'ed se na v\'fd\f1\'9ae uveden\f0\'fd software. Podm\'ednky se rovn\f1\'ec\'9e vztahuj\f0\'ed na jak\'e9koli slu\f1\'9eby Microsoft nebo aktualizace pro software, pokud se na slu\'9eby nebo aktualizace nevztahuj\f0\'ed odli\f1\'9an\f0\'e9 podm\'ednky.\par..\b DODR\f1\'8e\f0\'cdTE-LI TYTO

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1029\thm.wxl

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3333
                                                                                                                                                                                                                      Entropy (8bit):5.370651462060085
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:c5DiTlOtesM6H2hDdxHOjZxsaIIy3Iy5sDMN3mkNFN7NwcfiPc3hKPnWZLF0hKqZ:uDiTlVxxHOy/9xXfpZJYnL8xK2S
                                                                                                                                                                                                                      MD5:16343005D29EC431891B02F048C7F581
                                                                                                                                                                                                                      SHA1:85A14C40C482D9351271F6119D272D19407C3CE9
                                                                                                                                                                                                                      SHA-256:07FB3EC174F25DFBE532D9D739234D9DFDA8E9D34F01FE660C5B4D56989FA779
                                                                                                                                                                                                                      SHA-512:FF1AE9C21DCFB018DD4EC82A6D43362CB8C591E21F45DD1C25955D83D328B57C8D454BBE33FBC73A70DADF1DFB3AE27502C9B3A8A3FF2DA97085CA0D9A68AB03
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instala.n. program [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Opravdu chcete akci zru.it?</String>.. <String Id="HelpHeader">N.pov.da nastaven.</String>.. <String Id="HelpText">/install | /repair | /uninstall | /layout [adres..] . Nainstaluje, oprav., odinstaluje nebo.. vytvo.. .plnou m.stn. kopii svazku v adres..i. V.choz. mo.nost. je instalace...../passive | /quiet . Zobraz. minim.ln. u.ivatelsk. rozhran. bez v.zev nebo nezobraz. ..dn. u.ivatelsk. rozhran. a.. ..dn. v.zvy. V.choz. mo.nost. je zobrazen. u.ivatelsk.ho rozhran. a v.ech v.zev...../noresta

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1031\license.rtf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):11936
                                                                                                                                                                                                                      Entropy (8bit):5.194264396634094
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:+XkOmRUOl6WBsl4kA+sn+mvtI0qHl4qj+iPqk6kVV9iX9GzYNvQ8yOejIpRMrhC2:DDHMFPCeV3i4zOHyOejIpkC2
                                                                                                                                                                                                                      MD5:C2CFA4CE43DFF1FCD200EDD2B1212F0A
                                                                                                                                                                                                                      SHA1:E8286E843192802E5EBF1BE67AE30BCAD75AC4BB
                                                                                                                                                                                                                      SHA-256:F861DB23B972FAAA54520558810387D742878947057CF853DC74E5F6432E6A1B
                                                                                                                                                                                                                      SHA-512:6FDF02A2DC9EF10DD52404F19C300429E7EA40469F00A43CA627F3B7F3868D1724450F99C65B70B9B7B1F2E1FA9D62B8BE1833A8C5AA3CD31C940459F359F30B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil Tahoma;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT-SOFTWARE-LIZENZBESTIMMUNGEN\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 Diese Lizenzbestimmungen sind ein Vertrag zwischen Ihnen und der Microsoft Corporation (bzw. abh\'e4ngig von Ihrem Wohnsitz einem mit Microsoft verbundenen Unternehmen). Sie gelten f\'fcr die oben angef\'fchrte Software. Die Bestimmungen gelten ebenso f\'fcr jegliche von Microsoft angebotenen Dienste oder Updates f\'fcr die Software, sofern diesen keine anderen Bestimmungen beiliegen.\par..\b SOFERN SIE DIESE LIZENZBESTIMMUNGEN EINHALTEN, SIND SIE ZU FOLGENDEM BERECHTIGT:\par....\pard{\pntext\f2\'B7\tab}{\*\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\fi-357\li357\sb120\sa120\sl240\slmult1\tx360 RECHTE ZUR INSTALLATION UND NUTZUNG. \

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1031\thm.wxl

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3379
                                                                                                                                                                                                                      Entropy (8bit):5.094097800535488
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:c5DiTlOZuesXJhDEVTORNxSMoZN3mteNSiNGNsZuiAXEqicMwhPXbhu9KwKlK8Kq:uDiTl3N7xSbu0N8+AhSNnm
                                                                                                                                                                                                                      MD5:561F3F32DB2453647D1992D4D932E872
                                                                                                                                                                                                                      SHA1:109548642FB7C5CC0159BEDDBCF7752B12B264C0
                                                                                                                                                                                                                      SHA-256:8E0DCA6E085744BFCBFF46F7DCBCFA6FBD722DFA52013EE8CEEAF682D7509581
                                                                                                                                                                                                                      SHA-512:CEF8C80BEF8F88208E0751305DF519C3D2F1C84351A71098DC73392EC06CB61A4ACA35182A0822CF6934E8EE42196E2BCFE810CC859965A9F6F393858A1242DF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] - Setup</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">M.chten Sie den Vorgang wirklich abbrechen?</String>.. <String Id="HelpHeader">Setup-Hilfe</String>.. <String Id="HelpText">/install | /repair | /uninstall | /layout [Verzeichnis] - installiert, repariert, deinstalliert oder.. erstellt eine vollst.ndige lokale Kopie des Bundles im Verzeichnis. Installieren ist die Standardeinstellung...../passive | /quiet - zeigt eine minimale Benutzeroberfl.che ohne Eingabeaufforderungen oder keine.. Benutzeroberfl.che und keine Eingabeaufforderungen an. Standardm..ig werden die Benutzeroberfl.che und alle Eingab

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1036\license.rtf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):11593
                                                                                                                                                                                                                      Entropy (8bit):5.106817099949188
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:aRAbNYjVk+z5GUSLse5GgALEXmAWL+/3FEShP9sJgi8+Ra8woh+89EQdhwQPely6:K4yrPqm9LcVEg9sVp2ohHVdKoXJXci9a
                                                                                                                                                                                                                      MD5:F0FF747B85B1088A317399B0E11D2101
                                                                                                                                                                                                                      SHA1:F13902A39CEAE703A4713AC883D55CFEE5F1876C
                                                                                                                                                                                                                      SHA-256:4D9B7F06BE847E9E135AB3373F381ED7A841E51631E3C2D16E5C40B535DA3BCF
                                                                                                                                                                                                                      SHA-512:AA850F05571FFC361A764A14CA9C1A465E2646A8307DEEE0589852E6ACC61AF145AEF26B502835724D7245900F9F0D441451DD8C055404788CE64415F5B79506
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 TERMES DU CONTRAT DE LICENCE LOGICIEL MICROSOFT\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 Les pr\'e9sents termes du contrat de licence constituent un contrat entre Microsoft Corporation (ou, en fonction de votre lieu de r\'e9sidence, l\rquote un de ses affili\'e9s) et vous. Ils s\rquote appliquent au logiciel vis\'e9 ci-dessus. Les termes s\rquote appliquent \'e9galement \'e0 tout service et \'e0 toute mise \'e0 jour Microsoft pour ce logiciel, \'e0 moins que d\rquote autres termes n\rquote accompagnent ces \'e9l\'e9ments.\par..\b SI VOUS VOUS CONFORMEZ AUX PR\'c9SENTS TERMES DU CONTRAT DE LICENCE, VOUS AVEZ LES DROITS CI-DESSOUS.\par....\pard{\pntext\f1\'B7\tab}{\*\pn\pnlvlblt\pnf1\pnindent360{\pntxtb\'B7}}\fi-357\li357\sb120\s

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1036\thm.wxl

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3366
                                                                                                                                                                                                                      Entropy (8bit):5.0912204406356905
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:c5DiTlO1BesgKLhD1K8cocDSN3m4NlN2ZfNmXL8ePZFcZkLPqUf9fQKRLKeKqZfj:uDiTlABzH1/qt4qgcXY
                                                                                                                                                                                                                      MD5:7B46AE8698459830A0F9116BC27DE7DF
                                                                                                                                                                                                                      SHA1:D9BB14D483B88996A591392AE03E245CAE19C6C3
                                                                                                                                                                                                                      SHA-256:704DDF2E60C1F292BE95C7C79EE48FE8BA8534CEB7CCF9A9EA68B1AD788AE9D4
                                                                                                                                                                                                                      SHA-512:FC536DFADBCD81B42F611AC996059A6264E36ECF72A4AEE7D1E37B87AEFED290CC5251C09B68ED0C8719F655B163AD0782ACD8CE6332ED4AB4046C12D8E6DBF6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Installation de [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Voulez-vous vraiment annuler.?</String>.. <String Id="HelpHeader">Aide du programme d'installation</String>.. <String Id="HelpText">/install | /repair | /uninstall | /layout [directory] - installe, r.pare, d.sinstalle ou.. cr.e une copie locale compl.te du groupe dans le r.pertoire. Install est l'option par d.faut...../passive | /quiet - affiche une interface minimale, sans invite, ou n'affiche ni interface.. ni invite. Par d.faut, l'interface et toutes les invites sont affich.es...../norestart - supprime toutes les tentatives de red.

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1040\license.rtf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):11281
                                                                                                                                                                                                                      Entropy (8bit):5.046489958240229
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:WBGNX6UXR2+5SmgS/ChMErYkQvowHVw6zdgkycEGCDLQ+n3YJ2d8XSiej+T4Ma8f:gAzSVARBR5jEPLQY3YJpSjTP2
                                                                                                                                                                                                                      MD5:9D98044BAC59684489C4CF66C3B34C85
                                                                                                                                                                                                                      SHA1:36AAE7F10A19D336C725CAFC8583B26D1F5E2325
                                                                                                                                                                                                                      SHA-256:A3F745C01DEA84CE746BA630814E68C7C592B965B048DDC4B1BBE1D6E533BE22
                                                                                                                                                                                                                      SHA-512:D849BBB6C87C182CC98C4E2314C0829BB48BAD483D0CD97BF409E75457C3695049C3A8ADFE865E1ECBC989A910096D2C1CDF333705AAC4D22025DF91B355278E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 CONTRATTO DI LICENZA PER IL SOFTWARE MICROSOFT\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 Le presenti condizioni di licenza costituiscono il contratto tra Microsoft Corporation (o, in base al luogo di residenza del licenziatario, una delle sue consociate) e il licenziatario, Tali condizioni si applicano al software Microsoft di cui sopra. Le condizioni si applicano inoltre a qualsiasi servizio o aggiornamento di Microsoft relativo al software, a meno che questo non sia accompagnato da condizioni differenti.\par..\b QUALORA IL LICENZIATARIO SI ATTENGA ALLE PRESENTI CONDIZIONI DI LICENZA, DISPORR\'c0 DEI DIRITTI INDICATI DI SEGUITO.\par....\pard{\pntext\f2\'B7\tab}{\*\pn\pnlvlblt\p

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1040\thm.wxl

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3319
                                                                                                                                                                                                                      Entropy (8bit):5.019774955491369
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:c5DiTlO1eesy+hD9BOtBFv5Vo8BbQhMNDJN3msNlNohNNz+wcPclM+PAoYKp+K/u:uDiTlfQvo8WutJ/s9FHNOJp
                                                                                                                                                                                                                      MD5:D90BC60FA15299925986A52861B8E5D5
                                                                                                                                                                                                                      SHA1:FADFCA9AB91B1AB4BD7F76132F712357BD6DB760
                                                                                                                                                                                                                      SHA-256:0C57F40CC2091554307AA8A7C35DD38E4596E9513E9EFAE00AC30498EF4E9BC2
                                                                                                                                                                                                                      SHA-512:11764D0E9F286B5AA7B1A9601170833E462A93A1E569A032FCBA9879174305582BD42794D4131B83FBCFBF1CF868A8D5382B11A4BD21F0F7D9B2E87E3C708C3F
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Installazione di [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Annullare?</String>.. <String Id="HelpHeader">Guida alla configurazione</String>.. <String Id="HelpText">/install | /repair | /uninstall | /layout [directory] - installa, ripara, disinstalla o.. crea una copia locale completa del bundle nella directory. L'opzione predefinita . Install...../passive | /quiet - visualizza un'interfaccia utente minima senza prompt oppure non visualizza alcuna interfaccia utente.. n. prompt. Per impostazione predefinita viene visualizzata l'intera interfaccia utente e tutti i prompt...../norestart - annulla quals

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1041\license.rtf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):28232
                                                                                                                                                                                                                      Entropy (8bit):3.7669201853275722
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:Qkb65jNkzrUJVbpEiTskXHH1AZWoJxfnVnkDYUqfQFXBue6hX2JSfR7q05kWZxhY:epCD3y/ybox2yrk2
                                                                                                                                                                                                                      MD5:8C49936EC4CF0F64CA2398191C462698
                                                                                                                                                                                                                      SHA1:CC069FE8F8BC3B6EE2085A4EACF40DB26C842BAC
                                                                                                                                                                                                                      SHA-256:7355367B7C48F1BBACC66DFFE1D4BF016C16156D020D4156F288C2B2207ED1C2
                                                                                                                                                                                                                      SHA-512:4381147FF6707C3D31C5AE591F68BC61897811112CB507831EFF5E71DD281009400EDA3300E7D3EFDE3545B89BCB71F2036F776C6FDFC73B6B2B2B8FBC084499
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset128 MS Gothic;}{\f1\fnil\fcharset0 MS Gothic;}{\f2\fnil\fcharset134 SimSun;}{\f3\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9\'83\'7d\'83\'43\'83\'4e\'83\'8d\'83\'5c\'83\'74\'83\'67 \'83\'5c\'83\'74\'83\'67\'83\'45\'83\'46\'83\'41 \'83\'89\'83\'43\'83\'5a\'83\'93\'83\'58\'8f\'f0\'8d\'80\par..\f1 MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0\f0\'96\'7b\'83\'89\'83\'43\'83\'5a\'83\'93\'83\'58\'8f\'f0\'8d\'80\'82\'cd\f2\'a1\'a2\f1 Microsoft Corporation (\f0\'82\'dc\'82\'bd\'82\'cd\'82\'a8\'8b\'71\'97\'6c\'82\'cc\'8f\'8a\'8d\'dd\'92\'6e\'82\'c9\'89\'9e\'82\'b6\'82\'c4\'82\'cd\'82\'bb\'82\'cc\'8a\'d6\'98\'41\'89\'ef\'8e\'d0) \'82\'c6\'82\'a8\'8b\'71\'97\'6c\'82\'c6\'82\'cc\'8c\'5f\'96\'f1\'82\'f0\'8d\'5c\'90\'ac\'82\'b5\'82\'dc\'82\'b7\'81\'42\'96\'7b\'83\'89\'83\'43\'83\'5a\'83\'93\'83\'58\'8f\'f0\'8

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1041\thm.wxl

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3959
                                                                                                                                                                                                                      Entropy (8bit):5.955167044943003
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:uDiTlDuB1n+RNmvFo6bnpojeTPk0R/vueX5OA17IHdGWz:5uB1+gD1DU4EdGE
                                                                                                                                                                                                                      MD5:DC81ED54FD28FC6DB6F139C8DA1BDED6
                                                                                                                                                                                                                      SHA1:9C719C32844F78AAE523ADB8EE42A54D019C2B05
                                                                                                                                                                                                                      SHA-256:6B9BBF90D75CFA7D943F036C01602945FE2FA786C6173E22ACB7AFE18375C7EA
                                                                                                                                                                                                                      SHA-512:FD759C42C7740EE9B42EA910D66B0FA3F813600FD29D074BB592E5E12F5EC09DB6B529680E54F7943821CEFE84CE155A151B89A355D99C25A920BF8F254AA008
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.. <Control Control="InstallButton" X="275" Y="237" Width="110" Height="23"/>.. <Control Control="UninstallButton" X="270" Y="237" Width="120" Height="23"/>.. <Control Control="RepairButton" X="187" Y="237" Width="80" Height="23"/>.. .. <String Id="Caption">[WixBundleName] .......</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">..........</String>.. <String Id="HelpText">/install | /repair | /uninstall | /layout [directory] - ............ ......... .........................

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1042\license.rtf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):27936
                                                                                                                                                                                                                      Entropy (8bit):3.871317037004171
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:kKIgbA2uBsarNG/HxPvCL1ewjxsXmEw4C7C7R4jAeqCBO968y7yNRylBSFfQv9yH:d3ar8Xa/XAeqoc0wfBB4qN
                                                                                                                                                                                                                      MD5:184D94082717E684EAF081CEC3CBA4B1
                                                                                                                                                                                                                      SHA1:960B9DA48F4CDDF29E78BBAE995B52204B26D51B
                                                                                                                                                                                                                      SHA-256:A4C25DA9E3FBCED47464152C10538F16EE06D8E06BC62E1CF4808D293AA1AFA2
                                                                                                                                                                                                                      SHA-512:E4016C0CA348299B5EF761F456E3B5AD9B99E5E100C07ACAB1369DFEC214E75AA88E9AD2A0952C0CC1B707E2732779E6E3810B3DA6C839F0181DC81E3560CBDA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset129 Malgun Gothic;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 Microsoft \f1\'bc\'d2\'c7\'c1\'c6\'ae\'bf\'fe\'be\'ee\f0 \f1\'bb\'e7\'bf\'eb\'b1\'c7\f0 \f1\'b0\'e8\'be\'e0\'bc\'ad\f0\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0\f1\'ba\'bb\f0 \f1\'bb\'e7\'bf\'eb\'b1\'c7\f0 \f1\'b0\'e8\'be\'e0\'c0\'ba\f0 Microsoft Corporation(\f1\'b6\'c7\'b4\'c2\f0 \f1\'b0\'c5\'c1\'d6\f0 \f1\'c1\'f6\'bf\'aa\'bf\'a1\f0 \f1\'b5\'fb\'b6\'f3\f0 \f1\'b0\'e8\'bf\'ad\'bb\'e7\f0 \f1\'c1\'df\f0 \f1\'c7\'cf\'b3\'aa\f0 )\f1\'b0\'fa\f0 \f1\'b1\'cd\'c7\'cf\f0 \f1\'b0\'a3\'bf\'a1\f0 \f1\'c3\'bc\'b0\'e1\'b5\'c7\'b4\'c2\f0 \f1\'b0\'e8\'be\'e0\'c0\'d4\'b4\'cf\'b4\'d9\f0 . \f1\'ba\'bb\f0 \f1\'c1\'b6\'b0\'c7\'c0\'ba\f0 \f1\'c0\'a7\'bf\'a1\f0 \f1\'b8\'ed\'bd\'c3\'b5\'c8\f0 \f1

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1042\thm.wxl

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3249
                                                                                                                                                                                                                      Entropy (8bit):5.985100495461761
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:c5DiTlO4TesKOwhDNJCkt1NhEN3m/NFNkbKNdExpVgUnqx6IPaRc0KoUK9TKz0KR:uDiTlUJJCsgqf6YVoz4uU5vI54U5TY
                                                                                                                                                                                                                      MD5:B3399648C2F30930487F20B50378CEC1
                                                                                                                                                                                                                      SHA1:CA7BDAB3BFEF89F6FA3C4AAF39A165D14069FC3D
                                                                                                                                                                                                                      SHA-256:AD7608B87A7135F408ABF54A897A0F0920080F76013314B00D301D6264AE90B2
                                                                                                                                                                                                                      SHA-512:C5B0ECF11F6DADF2E68BC3AA29CC8B24C0158DAE61FE488042D1105341773166C9EBABE43B2AF691AD4D4B458BF4A4BF9689C5722C536439CA3CDC84C0825965
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] .. ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="HelpHeader">.. ...</String>.. <String Id="HelpText">/install | /repair | /uninstall | /layout [directory] - ..... ... .. .. .... .., .., .. .... ...... ... .........../passive | /quiet - .... .. .. UI. ..... UI ... ..... .... ..... ..... UI. .. ..... ........../norestart - .. .... .. .... ...

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1045\license.rtf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):13265
                                                                                                                                                                                                                      Entropy (8bit):5.358483628484379
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:TKpWRd0NE41Y/od7V/sHFos7YLQY9DbLM5D+Vw1VAOb0P4/sHLS7VHwHMPw95a+Q:uy0CG9KZ7qQCw1VAOZ/sHOJfcY2wf6p2
                                                                                                                                                                                                                      MD5:5B9DF97FC98938BF2936437430E31ECA
                                                                                                                                                                                                                      SHA1:AB1DA8FECDF85CF487709774033F5B4B79DFF8DE
                                                                                                                                                                                                                      SHA-256:8CB5EB330AA07ACCD6D1C8961F715F66A4F3D69FB291765F8D9F1850105AF617
                                                                                                                                                                                                                      SHA-512:4EF61A484DF85C487BE326AB4F95870813B9D0644DF788CE22D3BEB6E062CDF80732CB0B77FCDA5D4C951A0D67AECF8F5DCD94EA6FA028CFCA11D85AA97714E3
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset238 Tahoma;}{\f2\fnil\fcharset0 Garamond;}{\f3\fnil Tahoma;}{\f4\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 POSTANOWIENIA LICENCYJNE DOTYCZ\f1\'a5CE OPROGRAMOWANIA\par..\f0 MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 Niniejsze postanowienia licencyjne stanowi\f1\'b9 umow\'ea mi\'eadzy Microsoft Corporation (lub, w\~zale\'bfno\'9cci od miejsca zamieszkania Licencjobiorcy, jednym z\~podmiot\f0\'f3w stowarzyszonych Microsoft Corporation) a\~Licencjobiorc\f1\'b9. Maj\'b9 one zastosowanie do wskazanego powy\'bfej oprogramowania. Niniejsze postanowienia maj\'b9 r\f0\'f3wnie\f1\'bf zastosowanie do wszelkich us\'b3ug i aktualizacji Microsoft dla niniejszego oprogramowania, z wyj\'b9tkiem tych, kt\f0\'f3rym towarzysz\f1\'b9 inne postanowienia.\par..\b\

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1045\thm.wxl

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3212
                                                                                                                                                                                                                      Entropy (8bit):5.268378763359481
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:c5DiTlOPesar4hDo7zGriQjDCN3mDNN0NrsNGl3vxkIP2hUdKLK0KbK4n6W0sfNM:uDiTlusPGriQw8n2rOij4JsU
                                                                                                                                                                                                                      MD5:15172EAF5C2C2E2B008DE04A250A62A1
                                                                                                                                                                                                                      SHA1:ED60F870C473EE87DF39D1584880D964796E6888
                                                                                                                                                                                                                      SHA-256:440B309FCDF61FFC03B269FE3815C60CB52C6AE3FC6ACAD14EAC04D057B6D6EA
                                                                                                                                                                                                                      SHA-512:48AA89CF4A0B64FF4DCB82E372A01DFF423C12111D35A4D27B6D8DD793FFDE130E0037AB5E4477818A0939F61F7DB25295E4271B8B03F209D8F498169B1F9BAE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instalator [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Czy na pewno chcesz anulowa.?</String>.. <String Id="HelpHeader">Instalator . Pomoc</String>.. <String Id="HelpText">/install | /repair | /uninstall | /layout [katalog] - Instaluje, naprawia, odinstalowuje.. lub tworzy pe.n. lokaln. kopi. pakietu w katalogu. Domy.lnie jest u.ywany prze..cznik install...../passive | /quiet - Wy.wietla ograniczony interfejs u.ytkownika bez monit.w albo nie wy.wietla ani interfejsu u.ytkownika,.. ani monit.w. Domy.lnie jest wy.wietlany interfejs u.ytkownika oraz wszystkie monity...../norestart - Pom

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1046\license.rtf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):10656
                                                                                                                                                                                                                      Entropy (8bit):5.092962528947159
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:WIPAufWXXF0+YkR6E0/CiTS0CsGlHIMqf29H7KxLY/aYzApT3anawLXCBX2:VPAufb+YSSCYrCb5BmW4UDaTqzLwX2
                                                                                                                                                                                                                      MD5:360FC4A7FFCDB915A7CF440221AFAD36
                                                                                                                                                                                                                      SHA1:009F36BBDAD5B9972E8069E53855FC656EA05800
                                                                                                                                                                                                                      SHA-256:9BF79B54F4D62BE501FF53EEDEB18683052A4AE38FF411750A764B3A59077F52
                                                                                                                                                                                                                      SHA-512:9550A99641F194BB504A76DE011D07C1183EE1D83371EE49782FC3D05BF779415630450174DD0C03CB182A5575F6515012337B899E2D084203717D9F110A6FFE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 TERMOS DE LICEN\'c7A PARA SOFTWARE MICROSOFT\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 Estes termos de licen\'e7a formam um contrato firmado entre a Microsoft Corporation (ou com base no seu pa\'eds de resid\'eancia, uma de suas afiliadas) e voc\'ea. Eles se aplicam ao software indicado acima. Os termos tamb\'e9m se aplicam a quaisquer servi\'e7os ou atualiza\'e7\'f5es da Microsoft para o software, exceto at\'e9 a extens\'e3o de que eles tenham termos diferentes.\par..\b SE VOC\'ca CONCORDAR COM ESTES TERMOS DE LICEN\'c7A, TER\'c1 OS DIREITOS INDICADOS ABAIXO.\par....\pard{\pntext\f2\'B7\tab}{\*\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\fi-357\li357\sb120\sa120\sl240\slmult1\t

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1046\thm.wxl

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3095
                                                                                                                                                                                                                      Entropy (8bit):5.150868216959352
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:c5DiTlO5es/4ThDzmU6lDj4N3mBl0N+NWNP4hHCc9skPDXeKKeK9KfKt4eJ2RQdg:uDiTlJhJGl2UsZMLe6
                                                                                                                                                                                                                      MD5:BE27B98E086D2B8068B16DBF43E18D50
                                                                                                                                                                                                                      SHA1:6FAF34A36C8D9DE55650D0466563852552927603
                                                                                                                                                                                                                      SHA-256:F52B54A0E0D0E8F12CBA9823D88E9FD6822B669074DD1DC69DAD6553F7CB8913
                                                                                                                                                                                                                      SHA-512:3B7C773EF72D40A8B123FDB8FC11C4F354A3B152CF6D247F02E494B0770C28483392C76F3C222E3719CF500FE98F535014192ACDDD2ED9EF971718EA3EC0A73E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] Instala..o</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Tem certeza de que deseja cancelar?</String>.. <String Id="HelpHeader">Ajuda da Instala..o</String>.. <String Id="HelpText">/install | /repair | /uninstall | /layout [diret.rio - instala, repara, desinstala ou.. cria uma c.pia local completa do pacote no diret.rio. Install . o padr.o..../passive | /quiet - exibe a IU m.nima sem nenhum prompt ou n.o exibe nenhuma IU e.. nenhum prompt. Por padr.o, a IU e todos os prompts s.o exibidos...../norestart - suprime qualquer tentativa de reiniciar. Por padr.o, a IU perguntar. antes de reiniciar

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1049\license.rtf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):31915
                                                                                                                                                                                                                      Entropy (8bit):3.6440775919653996
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:384:ntaMxngQEqQUaAEJxkSjjujcme51oVwuZOFsrnkGxunWxGc9wtvVYgCzkSxN1S2:npgnmWWNEvVYgCzxD
                                                                                                                                                                                                                      MD5:A59C893E2C2B4063AE821E42519F9812
                                                                                                                                                                                                                      SHA1:C00D0B11F6B25246357053F6620E57D990EFC698
                                                                                                                                                                                                                      SHA-256:0EC8368E87B3DFC92141885A2930BDD99371526E09FC52B84B764C91C5FC47B8
                                                                                                                                                                                                                      SHA-512:B9AD8223DDA2208EC2068DBB85742A03BE0291942E60D4498E3DAB4DDF559AA6DCF9879952F5819223CFC5F4CB71D4E06E4103E129727AACFB8EFE48403A04FA
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset204 Tahoma;}{\f1\fnil\fcharset0 Tahoma;}{\f2\fnil\fcharset204 Garamond;}{\f3\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang1049\'d3\'d1\'cb\'ce\'c2\'c8\'df \'cb\'c8\'d6\'c5\'cd\'c7\'c8\'c8 \'cd\'c0 \'cf\'d0\'ce\'c3\'d0\'c0\'cc\'cc\'cd\'ce\'c5 \'ce\'c1\'c5\'d1\'cf\'c5\'d7\'c5\'cd\'c8\'c5 MICROSOFT\par..\f1\lang9 MICROSOFT VISUAL C++ 2019 RUNTIME\par..\b0\f0\lang1049\'cd\'e0\'f1\'f2\'ee\'ff\'f9\'e8\'e5 \'f3\'f1\'eb\'ee\'e2\'e8\'ff \'eb\'e8\'f6\'e5\'ed\'e7\'e8\'e8 \'ff\'e2\'eb\'ff\'fe\'f2\'f1\'ff \'f1\'ee\'e3\'eb\'e0\'f8\'e5\'ed\'e8\'e5\'ec \'ec\'e5\'e6\'e4\'f3 \'ea\'ee\'f0\'ef\'ee\'f0\'e0\'f6\'e8\'e5\'e9 Microsoft (\'e8\'eb\'e8, \'e2 \'e7\'e0\'e2\'e8\'f1\'e8\'ec\'ee\'f1\'f2\'e8 \'ee\'f2 \'ec\'e5\'f1\'f2\'e0 \'e2\'e0\'f8\'e5\'e3\'ee \'ef\'f0\'ee\'e6\'e8\'e2\'e0\'ed\'e8\'ff, \'ee\

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1049\thm.wxl

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):4150
                                                                                                                                                                                                                      Entropy (8bit):5.444436038992627
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:c5DiTlDhQt9esbrohDTWJt49kAr7DHN3m5GNDCNvNLIkflhrWncPingGdZwK1Kqp:uDiTlDYVgmt4xJ88k193ipzjvL
                                                                                                                                                                                                                      MD5:17C652452E5EE930A7F1E5E312C17324
                                                                                                                                                                                                                      SHA1:59F3308B87143D8EA0EA319A1F1A1F5DA5759DD3
                                                                                                                                                                                                                      SHA-256:7333BC8E52548821D82B53DBD7D7C4AA1703C85155480CB83CEFD78380C95661
                                                                                                                                                                                                                      SHA-512:53FD207B96D6BCF0A442E2D90B92E26CBB3ECC6ED71B753A416730E8067E831E9EB32981A9E9368C4CCA16AFBCB2051483FDCFC474EA8F0D652FCA934634FBE8
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.. <Control Control="InstallButton" X="275" Y="237" Width="110" Height="23"/>.... <String Id="Caption">......... ......... [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">........?</String>.. <String Id="HelpHeader">....... .. .........</String>.. <String Id="HelpText">/install | /repair | /uninstall | /layout [.......] - ........., .............., ........ ..... ........ ...... ......... ..... ...... . ......... .. ......... - ............../passive | /quiet - ........... ....

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1055\license.rtf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):13379
                                                                                                                                                                                                                      Entropy (8bit):5.214715951393874
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:1fGkc01jIjZTUDUTvXt2QpfC5VAlCPpDwuOfH7df3YwnnbZIWG2XjQeoO9uBO8CA:Iiqx4Uh2QpMVA8haDdv9nbZzG6oQR2
                                                                                                                                                                                                                      MD5:BD2DC15DFEE66076BBA6D15A527089E7
                                                                                                                                                                                                                      SHA1:8768518F2318F1B8A3F8908A056213042A377CC4
                                                                                                                                                                                                                      SHA-256:62A07232017702A32F4B6E43E9C6F063B67098A1483EEDDB31D7C73EAF80A6AF
                                                                                                                                                                                                                      SHA-512:9C9467A2F2D0886FF4302A44AEA89734FCEFBD3CBE04D895BCEACBA1586AB746E62391800E07B6228E054014BE51F14FF63BA71237268F94019063C8C8B7EF74
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset238 Tahoma;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT YAZILIMI L\f1\u304?SANS KO\'aaULLARI\par..\f0 MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 Bu lisans ko\f1\'baullar\u305?, Microsoft Corporation (veya ya\'baad\u305?\u287?\u305?n\u305?z yere g\f0\'f6re bir ba\f1\u287?l\u305? \'bairketi) ile sizin aran\u305?zda yap\u305?lan anla\'bamay\u305? olu\'baturur. Bu ko\'baullar, yukar\u305?da ad\u305? ge\f0\'e7en yaz\f1\u305?l\u305?m i\f0\'e7in ge\'e7erlidir. \f1\'aaartlar, yaz\u305?l\u305?m i\f0\'e7in t\'fcm Microsoft hizmetleri veya g\'fcncelle\f1\'batirmeleri i\f0\'e7in, beraberlerinde farkl\f1\u305? \'baartlar bulunmad\u305?\u287?\u305? s\f0\'fcrece ge\'e7erlidir.\par..\b BU L\f1\u304?SANS \'aaARTLARINA UYDU\u286?UNUZ TAKD\u304?RDE A\'aaA\u286?IDAK\u3

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\1055\thm.wxl

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3221
                                                                                                                                                                                                                      Entropy (8bit):5.280530692056262
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:c5DiTlOaesHEqhDTHV4zVy6oBzdp0DYK2GP2ZmN3majyNXNoNKQXVvChcPc+WKb0:uDiTl3PHcIflKNTPgdi12xgg
                                                                                                                                                                                                                      MD5:DEFBEA001DC4EB66553630AC7CE47CCA
                                                                                                                                                                                                                      SHA1:90CED64EC7C861F03484B5D5616FDBCDA8F64788
                                                                                                                                                                                                                      SHA-256:E5ABE3CB3BF84207DAC4E6F5BBA1E693341D01AEA076DD2D91EAA21C6A6CB925
                                                                                                                                                                                                                      SHA-512:B3B7A22D0CDADA21A977F1DCEAF2D73212A4CDDBD298532B1AC97575F36113D45E8D71C60A6D8F8CC2E9DBF18EE1000167CFBF0B2E7ED6F05462D77E0BCA0E90
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] Kurulumu</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.ptal etmek istedi.inizden emin misiniz?</String>.. <String Id="HelpHeader">Kurulum Yard.m.</String>.. <String Id="HelpText">/install | /repair | /uninstall | /layout [dizin] - y.kler, onar.r, kald.r.r ya da.. dizindeki paketin tam bir yerel kopyas.n. olu.turur. Varsay.lan install de.eridir...../passive | /quiet - en az d.zeyde istemsiz UI g.sterir ya da hi. UI g.stermez ve.. istem yoktur. Varsay.lan olarak UI ve t.m istemler g.r.nt.lenir...../norestart - yeniden ba.lama denemelerini engeller. Varsay.lan olarak UI yeniden ba.l

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\2052\license.rtf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):17863
                                                                                                                                                                                                                      Entropy (8bit):3.9617786349452775
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:BxoqPyOj+/8Tk5VigWgijAlk5xWvSCI5lgios0EhGXxGMLVGW+uUoqyLZDvAJxMx:vbIeaE7q3KGgzD2
                                                                                                                                                                                                                      MD5:3CF16377C0D1B2E16FFD6E32BF139AC5
                                                                                                                                                                                                                      SHA1:D1A8C3730231D51C7BB85A7A15B948794E99BDCE
                                                                                                                                                                                                                      SHA-256:E95CA64C326A0EF7EF3CED6CDAB072509096356C15D1761646E3C7FDA744D0E0
                                                                                                                                                                                                                      SHA-512:E9862FD0E8EC2B2C2180183D06535A16A527756F6907E6A1D2DB85092636F72C497508E793EE8F2CC8E0D1A5E090C6CCF465F78BC1FA8E68DAF7C68815A0EE16
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset134 SimSun;}{\f1\fnil\fcharset0 Tahoma;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9\'ce\'a2\'c8\'ed\'c8\'ed\'bc\'fe\'d0\'ed\'bf\'c9\'cc\'f5\'bf\'ee\f1\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0\f0\'d5\'e2\'d0\'a9\'d0\'ed\'bf\'c9\'cc\'f5\'bf\'ee\'ca\'c7\f1 Microsoft Corporation\f0\'a3\'a8\'bb\'f2\'c4\'fa\'cb\'f9\'d4\'da\'b5\'d8\'b5\'c4\f1 Microsoft \f0\'b9\'d8\'c1\'aa\'b9\'ab\'cb\'be\'a3\'a9\'d3\'eb\'c4\'fa\'d6\'ae\'bc\'e4\'b4\'ef\'b3\'c9\'b5\'c4\'d0\'ad\'d2\'e9\'a1\'a3\'d5\'e2\'d0\'a9\'cc\'f5\'bf\'ee\'ca\'ca\'d3\'c3\'d3\'da\'c9\'cf\'ca\'f6\'c8\'ed\'bc\'fe\'a1\'a3\'d5\'e2\'d0\'a9\'cc\'f5\'bf\'ee\'d2\'b2\'ca\'ca\'d3\'c3\'d3\'da\'d5\'eb\'b6\'d4\'b8\'c3\'c8\'ed\'bc\'fe\'b5\'c4\'c8\'ce\'ba\'ce\'ce\'a2\'c8\'ed\'b7\'fe\'ce\'f1\'bb\'f2\'b8\'fc\'d0\'c2\'a3\'ac\'b5\'ab\'d3\'d0\'b2\'bb\'cd\

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\2052\thm.wxl

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2978
                                                                                                                                                                                                                      Entropy (8bit):6.135205733555905
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:c5DiTlOtKesi+hDtkQf7lz+W0gopN3m5+3cNONeN1ra8vWqPtlTKxKUTKlKXRoR+:uDiTlV5kQR9GLeE0ZxV6gIV
                                                                                                                                                                                                                      MD5:3D1E15DEEACE801322E222969A574F17
                                                                                                                                                                                                                      SHA1:58074C83775E1A884FED6679ACF9AC78ABB8A169
                                                                                                                                                                                                                      SHA-256:2AC8B7C19A5189662DE36A0581C90DBAD96DF259EC00A28F609B644C3F39F9CA
                                                                                                                                                                                                                      SHA-512:10797919845C57C5831234E866D730EBD13255E5BF8BA8087D53F1D0FC5D72DC6D5F6945DBEBEE69ACC6A2E20378750C4B78083AE0390632743C184532358E10
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">[WixBundleName] ....</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.......?</String>.. <String Id="HelpHeader">......</String>.. <String Id="HelpText">/install | /repair | /uninstall | /layout [..] - .......... ..................Install ........../passive | /quiet - ..... UI ......... UI ... ........ UI ........../norestart - ..................... UI.../log log.txt - ............. %TEMP% ...

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\3082\license.rtf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):10714
                                                                                                                                                                                                                      Entropy (8bit):5.122578090102117
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:WthGE/9wd8eQF/hJOmQeNrXT77uOlQ+v3AqHqc3wpXGYdjvsk2cwBb2:mhGuhj+ed388Bb2
                                                                                                                                                                                                                      MD5:FBF293EE95AFEF818EAF07BB088A1596
                                                                                                                                                                                                                      SHA1:BBA1991BA6459C9F19B235C43A9B781A24324606
                                                                                                                                                                                                                      SHA-256:1FEC058E374C20CB213F53EB3C44392DDFB2CAA1E04B7120FFD3FA7A296C83E2
                                                                                                                                                                                                                      SHA-512:6971F20964EF74B19077EE81F953342DC6D2895A8640EC84855CECCEA5AEB581E6A628BCD3BA97A5D3ACB6CBE7971FDF84EF670BDDF901857C3CD28855212019
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 T\'c9RMINOS DE LA LICENCIA DE SOFTWARE DE MICROSOFT\par..MICROSOFT VISUAL C++ 2019 RUNTIME\par..\b0 Estos t\'e9rminos de licencia constituyen un contrato entre Microsoft Corporation (o, en funci\'f3n de donde resida, una de sus filiales) y usted. Se aplican al software antes mencionado. Los t\'e9rminos tambi\'e9n se aplican a cualquier servicio o actualizaci\'f3n de Microsoft para el software, excepto en la medida que tengan t\'e9rminos diferentes.\par..\b SI USTED CUMPLE CON LOS PRESENTES T\'c9RMINOS DE ESTA LICENCIA, DISPONDR\'c1 DE LOS DERECHOS QUE SE DESCRIBEN A CONTINUACI\'d3N.\par....\pard{\pntext\f2\'B7\tab}{\*\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\fi-357\li357\sb120\sa120\

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\3082\thm.wxl

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-8 text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):3265
                                                                                                                                                                                                                      Entropy (8bit):5.0491645049584655
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:c5DiTlO/esS6VGhDv4tiUiyRUqzC4U+aD6N3m7xNh1NWNGbPz+9o3PWeKK9K9KfT:uDiTlxouUTiySqyIwz9sgxqvjIk8
                                                                                                                                                                                                                      MD5:47F9F8D342C9C22D0C9636BC7362FA8F
                                                                                                                                                                                                                      SHA1:3922D1589E284CE76AB39800E2B064F71123C1C5
                                                                                                                                                                                                                      SHA-256:9CBB2B312C100B309A1B1495E84E2228B937612885F7A642FBBD67969B632C3A
                                                                                                                                                                                                                      SHA-512:E458DF875E9B0622AEBE3C1449868AA6A2826A1F851DB71165A872B2897CF870CCF85046944FF51FFC13BB15E54E9D9424EC36CAF5A2F38CE8B7D6DC0E9B2363
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29"/>.... <String Id="Caption">Instalaci.n de [WixBundleName]</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">.Est. seguro de que desea cancelar la operaci.n?</String>.. <String Id="HelpHeader">Ayuda de configuraci.n</String>.. <String Id="HelpText">/install | /repair | /uninstall | /layout [directory] - instala, repara, desinstala o.. crea una copia local completa del paquete en el directorio. La opci.n predeterminada es la instalaci.n...../passive | /quiet - muestra una IU m.nima sin solicitudes o no muestra ninguna IU ni.. solicitud. De forma predeterminada, se muestran la IU y todas las solicitudes...../norestart - elimina cualquier intento

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\BootstrapperApplicationData.xml

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:XML 1.0 document, Unicode text, UTF-16, little-endian text, with very long lines (558), with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):13116
                                                                                                                                                                                                                      Entropy (8bit):3.7313306743098185
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:X0sg3nH5zHqQHG0Hd8Hz7HE06HA0rH3FCFxxLo33zLa0LFnOBx7z8NkzzkvQokBd:X0sQdLbmnoNC0j16potVob
                                                                                                                                                                                                                      MD5:697970611890F5B3C7605C45E7455798
                                                                                                                                                                                                                      SHA1:B803F97F174F9F42C3743903DD96B9F3533F0DF3
                                                                                                                                                                                                                      SHA-256:E9F7BE9B0FFDC8E9A1D09558B2E57610EE6447286BF865C0BCC1C93A5B472DB8
                                                                                                                                                                                                                      SHA-512:F2ED213FFC4CD2F6738DFC7B24B7D15ED4C9013E24F2A29AEF2605653A54CE82D18E3FFF40F4811D1200A16CBB8D7459F0A5118EEB2074A76BBF8DAE38CF097B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".u.t.f.-.1.6.".?.>.....<.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a. .x.m.l.n.s.=.".h.t.t.p.:././.s.c.h.e.m.a.s...m.i.c.r.o.s.o.f.t...c.o.m./.w.i.x./.2.0.1.0./.B.o.o.t.s.t.r.a.p.p.e.r.A.p.p.l.i.c.a.t.i.o.n.D.a.t.a.".>..... . .<.W.i.x.B.a.l.C.o.n.d.i.t.i.o.n. .C.o.n.d.i.t.i.o.n.=.".V.e.r.s.i.o.n.N.T. .&.g.t.;.=. .v.6...0. .O.R. .(.V.e.r.s.i.o.n.N.T. .=. .v.5...1. .A.N.D. .S.e.r.v.i.c.e.P.a.c.k.L.e.v.e.l. .&.g.t.;.=. .2.). .O.R. .(.V.e.r.s.i.o.n.N.T. .=. .v.5...2. .A.N.D. .S.e.r.v.i.c.e.P.a.c.k.L.e.v.e.l. .&.g.t.;.=. .1.).". .M.e.s.s.a.g.e.=.".[.W.i.x.B.u.n.d.l.e.N.a.m.e.]. .c.a.n. .o.n.l.y. .b.e. .i.n.s.t.a.l.l.e.d. .o.n. .W.i.n.d.o.w.s. .X.P. .S.P.2. .a.n.d. .n.e.w.e.r. .p.l.a.t.f.o.r.m.s...". ./.>..... . .<.W.i.x.B.u.n.d.l.e.P.r.o.p.e.r.t.i.e.s. .D.i.s.p.l.a.y.N.a.m.e.=.".M.i.c.r.o.s.o.f.t. .V.i.s.u.a.l. .C.+.+. .2.0.1.5.-.2.0.1.9. .R.e.d.i.s.t.r.i.b.u.t.a.b.l.e. .(.x.8.6.). .-. .1.4...2.9...3.0.1.3.9.". .L.o.g.P.

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\license.rtf

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:Rich Text Format data, version 1, ANSI, code page 1252, default language ID 1033
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):9046
                                                                                                                                                                                                                      Entropy (8bit):5.157073875669985
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:192:W8lZ1UVDWkgWZTIsvPhghtQ1Qf4lCfnEtHixEGx736wHqItfSpOy2:9T15WZMgAYlOnjt5HLoL2
                                                                                                                                                                                                                      MD5:2EABBB391ACB89942396DF5C1CA2BAD8
                                                                                                                                                                                                                      SHA1:182A6F93703549290BCDE92920D37BC1DEC712BB
                                                                                                                                                                                                                      SHA-256:E3156D170014CED8D17A02B3C4FF63237615E5C2A8983B100A78CB1F881D6F38
                                                                                                                                                                                                                      SHA-512:20D656A123A220CD3CA3CCBF61CC58E924B44F1F0A74E70D6850F39CECD101A69BCE73C5ED14018456E022E85B62958F046AA4BD1398AA27303C2E86407C3899
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:{\rtf1\ansi\ansicpg1252\deff0\nouicompat\deflang1033{\fonttbl{\f0\fnil\fcharset0 Tahoma;}{\f1\fnil\fcharset0 Garamond;}{\f2\fnil\fcharset2 Symbol;}}..{\colortbl ;\red0\green32\blue96;\red0\green0\blue255;}..{\*\generator Riched20 10.0.17763}\viewkind4\uc1 ..\pard\sb120\sa120\sl240\slmult1\b\f0\fs20\lang9 MICROSOFT SOFTWARE LICENSE TERMS\par..MICROSOFT VISUAL C++ 2019 RUNTIME \par..\b0 These license terms are an agreement between Microsoft Corporation (or based on where you live, one of its affiliates) and you. They apply to the software named above. The terms also apply to any Microsoft services or updates for the software, except to the extent those have different terms.\par..\b IF YOU COMPLY WITH THESE LICENSE TERMS, YOU HAVE THE RIGHTS BELOW.\par....\pard{\pntext\f2\'B7\tab}{\*\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\fi-357\li357\sb120\sa120\sl240\slmult1\tx360 INSTALLATION AND USE RIGHTS. \b0\par....\pard{\pntext\f2\'B7\tab}{\*\pn\pnlvlblt\pnf2\pnindent360{\pntxtb\'B7}}\fi-363\

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\logo.png

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:PNG image data, 64 x 64, 8-bit colormap, non-interlaced
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):1861
                                                                                                                                                                                                                      Entropy (8bit):6.868587546770907
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:q36cnTKM/3kTIQiBmYKHeQWalGt1Sj9kYIt1uZ+bYOQe0IChR95aW:qqiTKMPuUBm7eQJGtYJM1uZCVszaW
                                                                                                                                                                                                                      MD5:D6BD210F227442B3362493D046CEA233
                                                                                                                                                                                                                      SHA1:FF286AC8370FC655AEA0EF35E9CF0BFCB6D698DE
                                                                                                                                                                                                                      SHA-256:335A256D4779EC5DCF283D007FB56FD8211BBCAF47DCD70FE60DED6A112744EF
                                                                                                                                                                                                                      SHA-512:464AAAB9E08DE610AD34B97D4076E92DC04C2CDC6669F60BFC50F0F9CE5D71C31B8943BD84CEE1A04FB9AB5BBED3442BD41D9CB21A0DD170EA97C463E1CE2B5B
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:.PNG........IHDR...@...@.............sRGB.........gAMA......a.....PLTE].q^.r_.r_.s`.s`.s`.ta.ta.ub.ub.vc.vd.vd.vd.we.we.xe.xg.yg yg zh zh"zi"{j#|i${j$|n*~n*.n,.o,.p..q0.r2.s3.t5.x;.x<.y>.z?.|B.~C.}E..F..F..H..I..J..L..O..P..W..Y..^..a..c..g..i..q..r..}.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................S......pHYs..%...%....^.....tEXtSoftware.Paint.NET v3.5.100.r.....IDATXG..iW.@...EJ.$M...`AEpG..7TpWT@\.."....(..(.._;...di:9.c>q..g....T...._...-....F..+..w.

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\thm.wxl

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):2952
                                                                                                                                                                                                                      Entropy (8bit):5.052095286906672
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:c5DiTl/+desK19hDUNKwsqq8+JIDxN3mt7NlN1NVvAdMcgLPDHVXK8KTKjKnSnYF:uDiTl/BbTxmup/vrxATd
                                                                                                                                                                                                                      MD5:FBFCBC4DACC566A3C426F43CE10907B6
                                                                                                                                                                                                                      SHA1:63C45F9A771161740E100FAF710F30EED017D723
                                                                                                                                                                                                                      SHA-256:70400F181D00E1769774FF36BCD8B1AB5FBC431418067D31B876D18CC04EF4CE
                                                                                                                                                                                                                      SHA-512:063FB6685EE8D2FA57863A74D66A83C819FE848BA3072B6E7D1B4FE397A9B24A1037183BB2FDA776033C0936BE83888A6456AAE947E240521E2AB75D984EE35E
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>.. .. Copyright (c) Microsoft Corporation. All rights reserved...-->..<WixLocalization Culture="en-us" xmlns="http://schemas.microsoft.com/wix/2006/localization">.. <Control Control="EulaAcceptCheckbox" X="11" Y="-41" Width="-11" Height="29" />.... <String Id="Caption">[WixBundleName] Setup</String>.. <String Id="Title">[WixBundleName]</String>.. <String Id="ConfirmCancelMessage">Are you sure you want to cancel?</String>.. <String Id="HelpHeader">Setup Help</String>.. <String Id="HelpText">/install | /repair | /uninstall | /layout [directory] - installs, repairs, uninstalls or.. creates a complete local copy of the bundle in directory. Install is the default...../passive | /quiet - displays minimal UI with no prompts or displays no UI and.. no prompts. By default UI and all prompts are displayed...../norestart - suppress any attempts to restart. By default UI will prompt before restart.../log log.txt - logs to a specific file. B

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\thm.xml

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:XML 1.0 document, ASCII text, with CRLF line terminators
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):8332
                                                                                                                                                                                                                      Entropy (8bit):5.184632608060528
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:96:8L2HdQG+3VzHfz96zYFGaPSWXdhRAmImlqFQKFBiUxn7Ke5A82rkO/pWk3nswP:ZHAzZ/3
                                                                                                                                                                                                                      MD5:F62729C6D2540015E072514226C121C7
                                                                                                                                                                                                                      SHA1:C1E189D693F41AC2EAFCC363F7890FC0FEA6979C
                                                                                                                                                                                                                      SHA-256:F13BAE0EC08C91B4A315BB2D86EE48FADE597E7A5440DCE6F751F98A3A4D6916
                                                                                                                                                                                                                      SHA-512:CBBFBFA7E013A2B85B78D71D32FDF65323534816978E7544CA6CEA5286A0F6E8E7E5FFC4C538200211F11B94373D5658732D5D8AA1D01F9CCFDBF20F154F1471
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:<?xml version="1.0" encoding="utf-8"?>.. Copyright (c) .NET Foundation and contributors. All rights reserved. Licensed under the Microsoft Reciprocal License. See LICENSE.TXT file in the project root for full license information. -->......<Theme xmlns="http://wixtoolset.org/schemas/thmutil/2010">.. <Window Width="485" Height="300" HexStyle="100a0000" FontId="0">#(loc.Caption)</Window>.. <Font Id="0" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="1" Height="-24" Weight="500" Foreground="000000">Segoe UI</Font>.. <Font Id="2" Height="-22" Weight="500" Foreground="666666">Segoe UI</Font>.. <Font Id="3" Height="-12" Weight="500" Foreground="000000" Background="FFFFFF">Segoe UI</Font>.. <Font Id="4" Height="-12" Weight="500" Foreground="ff0000" Background="FFFFFF" Underline="yes">Segoe UI</Font>.... <Image X="11" Y="11" Width="64" Height="64" ImageFile="logo.png" Visible="yes"/>.. <Text X="80" Y="11" Width="-11" Heig

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.ba\wixstdba.dll

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):195600
                                                                                                                                                                                                                      Entropy (8bit):6.682530937585544
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:OXoiFK6b0k77I+QfaIl191rSJHvlalB+8BHkY6v53EfcUzN0m6I+WxBlnKzeZuqt:OXoQNb++gDrSJdr8BHkPh3wIgnK/IU1a
                                                                                                                                                                                                                      MD5:EAB9CAF4277829ABDF6223EC1EFA0EDD
                                                                                                                                                                                                                      SHA1:74862ECF349A9BEDD32699F2A7A4E00B4727543D
                                                                                                                                                                                                                      SHA-256:A4EFBDB2CE55788FFE92A244CB775EFD475526EF5B61AD78DE2BCDFADDAC7041
                                                                                                                                                                                                                      SHA-512:45B15ADE68E0A90EA7300AEB6DCA9BC9E347A63DBA5CE72A635957564D1BDF0B1584A5E34191916498850FC7B3B7ECFBCBFCB246B39DBF59D47F66BC825C6FD2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3..R...R...R..h.N..R..h.L.R..h.M..R.......R.......R.......R...*<..R...*,..R...R...S..K....R..K....R..N.@..R...R(..R..K....R..Rich.R..................PE..L......Z...........!................d.....................................................@..............................................................D......,.......T...............................@...............X............................text............................... ..`.rdata.............................@..@.data...............................@....gfids..............................@..@.rsrc...............................@..@.reloc..,...........................@..B........................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exe

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):647664
                                                                                                                                                                                                                      Entropy (8bit):7.216617738039115
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12288:qnMwHskY7gjcjhVIEhqgM7bWvcsi6aVZPIyBOuJGP9/ztLlFDq2pmV+:kMysZgjS1hqgSC/izZfpJGlbhllBpr
                                                                                                                                                                                                                      MD5:29C7A21BAE42889B08137C25AAE8E55C
                                                                                                                                                                                                                      SHA1:D5CD79CA094C60F64EF7D9069E24270CEE24B4EA
                                                                                                                                                                                                                      SHA-256:82612A2FA05D62929833052CE76788B98701F0C19DCA313923452AFEC44EDEC5
                                                                                                                                                                                                                      SHA-512:484ECDDA526B95D0FD062A2B24BE537DD6C5A5945441DE250CBE2419B98041625505FA51202735CB6054DB444DC1F4BBF0B0E51588500AB89D54D7ADDCA5E2D6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'.u.'.u.'.u.......u.....[.u.....?.u...v.4.u...q.4.u...p...u.....".u....6.u.'.t.v.u...p.l.u....&.u.'..%.u...w.&.u.Rich'.u.........................PE..L......Z.....................v......m.............@..........................p............@..............................................;...............#...0...=.. t..T...................tt......@n..@...................$........................text.............................. ..`.rdata..............................@..@.data...@...........................@....wixburn8...........................@..@.tls................................@....gfids..............................@..@.rsrc....;.......<..................@..@.reloc...=...0...>..................@..B........................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\cab54A5CABBE7274D8A22EB58060AAB7623

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 741101 bytes, 10 files, at 0x44 +A "concrt140.dll" +A "msvcp140.dll", flags 0x4, number 1, extra bytes 20 in head, 55 datablocks, 0x1 compression
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):751317
                                                                                                                                                                                                                      Entropy (8bit):7.997626636605057
                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                      SSDEEP:12288:EBv9QZSYUrj5X1crmoI9mjuBnJ/bboSMaxFNxcgsQEoVB52v3rshNFfENxOc:E1YUf/crtIuynJ/bc7ajncCMvbshNFfO
                                                                                                                                                                                                                      MD5:D134ED74DAEC104E48CFA4B67A776C7C
                                                                                                                                                                                                                      SHA1:139AB56A5C69AF96E6A9983D7A09150E5908446D
                                                                                                                                                                                                                      SHA-256:DBEFEB8820F7112D8893822993175E5F822C8F87DAB76A32ED4851C7CE91C3AF
                                                                                                                                                                                                                      SHA-512:7723157F8BD7B3C34787C62AD51390CEEEC558C2E3FD9F581B7B7AD28A205C3C71942BF4F8FD515F83324A9E739892AEC286F797A3A3A9BF01B009103C74D0DF
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MSCF.....N......D............................N...'..............7...x..........Sw. .concrt140.dll.x...x......Sx. .msvcp140.dll..S...`.....Sw. .msvcp140_1.dll.x...x......Sx. .msvcp140_2.dll......=.....Sw. .msvcp140_atomic_wait.dll..I..x......Sw. .msvcp140_codecvt_ids.dll.xi...R.....S.. .vcamp140.dll.....p......S.. .vccorlib140.dll..E.........S.. .vcomp140.dll..)..x......S.. .vcruntime140.dll.r#..0..CK.}q|S...IR.h.w[UT6...cA:...B[...J.VZ...P..P\a.Zt.f.':.2.....8...i.Pq.-:6.Q..1.........r...g......=.{....{.......M.......O(.........=...o.//......v.........{Z[...U^......j/Z.....;...S9.=8..O..V...k.%./|...8:.TS}..WSu..WW./.WV.#.....cm.....U.N.+...k..U,D..4q]...-.>w.O|FLD.t*6.V!$$..%....t....Q..lr'....t..$..rT...[..B....>.C61b....&:/.1l... .k.(8.9.f...&.........../.).MT..~.B..4x....j.d.M.z.S....T......?......c..Y........G..} &..t...S....s...:!.!QHr]j.j..n...?....B. ZqY...V.".|...6...#..8....b....#s.RI....$....AB..'..J*B..$HA.Y.o;.......Ep.|. !D...!f...

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\cabB3E1576D1FEFBB979E13B1A5379E0B16

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:Microsoft Cabinet archive data, many, 5190395 bytes, 14 files, at 0x44 +A "mfc140.dll" +A "mfc140chs.dll", flags 0x4, number 1, extra bytes 20 in head, 326 datablocks, 0x1 compression
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):5199531
                                                                                                                                                                                                                      Entropy (8bit):7.998040154478754
                                                                                                                                                                                                                      Encrypted:true
                                                                                                                                                                                                                      SSDEEP:98304:8Ge4RVS51a9df+phO9erTIt4DNZXDAnWgTSZaEz7OJWI9BKlrUyTfUl6m/80X7R3:8GZgWd2pjTYQNF9gTSZaQFIrUTU6S80V
                                                                                                                                                                                                                      MD5:96A8D83A4459BAE965A4F764017DE36F
                                                                                                                                                                                                                      SHA1:9694A7DEB1153FE9D3A8B560BB2465166AAF09D3
                                                                                                                                                                                                                      SHA-256:8ADDEC5C565DC637402874EFE655B396BFA0C70B892CDED28638663D19E31E13
                                                                                                                                                                                                                      SHA-512:7F2563D262ADA8AE2BF67BCB8FA6E45635267E73F40FF59AB9A4A12946C0221FB19B972E3D96F99D7CABB3B80637587090839C0641F5EDF73683E7C70C527307
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MSCF.....2O.....D............................2O..#..............F.....I........Sx. .mfc140.dll.......I....Sv. .mfc140chs.dll......EJ....Sv. .mfc140cht.dll.......J....Sv. .mfc140deu.dll.x... .K....Sv. .mfc140enu.dll.......L....Sv. .mfc140esn.dll..... .M....Sv. .mfc140fra.dll.x.....N....Sv. .mfc140ita.dll.x.....O....Sv. .mfc140jpn.dll.......P....Sv. .mfc140kor.dll......[Q....Sv. .mfc140rus.dll..;N..VR....Sx. .mfc140u.dll..%..H......Sv. .mfcm140.dll..%........Sv. .mfcm140u.dll.}..Q.4..CK..g...0h.&G.dl..`r#.........E.p.nr.9.09..A$.A...L4A.cp.....s....53..k.yw..v.*.t..o......E......(.'...Y....Y'..i.o...)^...ya..v.m.d..>...^.....>..wJ...w....*..".k..w.7.4S.._9..|..Nk........'.:....}.o.y...|4........p...~...}.0...'\:.q....w........0.#..0...]'.....Q{..v.......F.:.M..z.m...{]4.\SM4....F...../.Eq...j.xL.M..L.}.....5:..]3.w..hR...~..<b\...Q...itU8.I.....*..5......E._..h.l.....([r...,.i..4a.......7~....1.E.+.^'..c........`.~...~E....}.P....x.F..m.........h`.].......\

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\vcRuntimeAdditional_x86

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2019 X86 Additional Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2019 X86 Additional Runtime - 14.29.30139., Template: Intel;1033, Revision Number: {02910D02-C4AB-4DC8-8CDC-AD5C0F55DDF0}, Create Time/Date: Fri Dec 10 22:31:12 2021, Last Saved Time/Date: Fri Dec 10 22:31:12 2021, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.4.4718), Security: 2
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):184320
                                                                                                                                                                                                                      Entropy (8bit):6.377160934619222
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:CviOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJdvW:CvipBaTDo1j//SZh
                                                                                                                                                                                                                      MD5:646FDDAFD57C35DA851B9AE476C32957
                                                                                                                                                                                                                      SHA1:ABC2EA3D74DE00555204D19951A96FAF5EA6F54B
                                                                                                                                                                                                                      SHA-256:E039B37C766848EB4A6012E0A28E0D6ED8CC7D2CDB6FF638FC821BE2B585A071
                                                                                                                                                                                                                      SHA-512:F3C6475E08B408DD166D9C27AB6D9FB22F66BDC24D29F7C2833FBE0EA8E8720321C32F673ABC088BB83D242758F8065A93934E2AE7CE8FE825B9436E99F1D025
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\vcRuntimeMinimum_x86

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, MSI Installer, Code page: 1252, Title: Installation Database, Subject: Visual C++ 2019 X86 Minimum Runtime, Author: Microsoft Corporation, Keywords: Installer, Comments: This installer database contains the logic and data required to install Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.29.30139., Template: Intel;1033, Revision Number: {C903B036-1F58-4F43-8CA4-2797FED0F6CC}, Create Time/Date: Fri Dec 10 22:28:10 2021, Last Saved Time/Date: Fri Dec 10 22:28:10 2021, Number of Pages: 301, Number of Words: 2, Name of Creating Application: Windows Installer XML Toolset (3.10.4.4718), Security: 2
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):184320
                                                                                                                                                                                                                      Entropy (8bit):6.331822191131053
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3072:GdviOApBgbxkK3zoGCK4Kr1kNM+BxWy2bDZRJdf:MvipBaTDo1j//SZh
                                                                                                                                                                                                                      MD5:FA1839BB43A4C70969B0FBDC59012A68
                                                                                                                                                                                                                      SHA1:E13B57B6AABBDFB20EB07DB8283E21656EF15C63
                                                                                                                                                                                                                      SHA-256:D6F926690A4A2823C2D507A3682153AF099C8832EE0C700240F28A38625357F8
                                                                                                                                                                                                                      SHA-512:739D5930D7F434CEFAA20AB8396B2497F174789BFA4592EBE6D17BA0DF6ED38437F9F3154100FDE13CBCCC8818CC02BF87622C9EDC2CF43E0DDDCAB4436E20B2
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exe
                                                                                                                                                                                                                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):647664
                                                                                                                                                                                                                      Entropy (8bit):7.216617738039115
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:12288:qnMwHskY7gjcjhVIEhqgM7bWvcsi6aVZPIyBOuJGP9/ztLlFDq2pmV+:kMysZgjS1hqgSC/izZfpJGlbhllBpr
                                                                                                                                                                                                                      MD5:29C7A21BAE42889B08137C25AAE8E55C
                                                                                                                                                                                                                      SHA1:D5CD79CA094C60F64EF7D9069E24270CEE24B4EA
                                                                                                                                                                                                                      SHA-256:82612A2FA05D62929833052CE76788B98701F0C19DCA313923452AFEC44EDEC5
                                                                                                                                                                                                                      SHA-512:484ECDDA526B95D0FD062A2B24BE537DD6C5A5945441DE250CBE2419B98041625505FA51202735CB6054DB444DC1F4BBF0B0E51588500AB89D54D7ADDCA5E2D6
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c...'.u.'.u.'.u.......u.....[.u.....?.u...v.4.u...q.4.u...p...u.....".u....6.u.'.t.v.u...p.l.u....&.u.'..%.u...w.&.u.Rich'.u.........................PE..L......Z.....................v......m.............@..........................p............@..............................................;...............#...0...=.. t..T...................tt......@n..@...................$........................text.............................. ..`.rdata..............................@..@.data...@...........................@....wixburn8...........................@..@.tls................................@....gfids..............................@..@.rsrc....;.......<..................@..@.reloc...=...0...>..................@..B........................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DF0538875032E347E0.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):69632
                                                                                                                                                                                                                      Entropy (8bit):0.128382633087333
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:9aZYkSYsjipVvipVsS0W1V29aOgNlGgkw+kh+dMClmuxcMClmVjLmB:YZedS9SmRSo9alGwX+d262
                                                                                                                                                                                                                      MD5:52AD094BC8BFF460C6413C1CDBD3622E
                                                                                                                                                                                                                      SHA1:F1077990547C66F840A579312BDAC7DC11EE5CED
                                                                                                                                                                                                                      SHA-256:2567BA1BFBC63B6B9C18C08976C6BF1FACB52CC200A4CBD24423AC43821AD5B2
                                                                                                                                                                                                                      SHA-512:EE63B437428B2C6F602621993749E0B09BA48385EA40807A234C451A53A05A687F49E7BA78468F6C1AA6AE685B4E43D067A857C829100A3E643E3DE6A9C17472
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DF063AD5405B76E19B.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):32768
                                                                                                                                                                                                                      Entropy (8bit):1.2248813923244477
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:ekHulu4vFXiQ7T5Mpd26rXMWSmRSo9al3SIpZ:jHSt7TK2QXxVRilZ
                                                                                                                                                                                                                      MD5:002D5A8E8521649BC5BC78C6DE181581
                                                                                                                                                                                                                      SHA1:E137C02073054752F02AE232DC2972B6E7109018
                                                                                                                                                                                                                      SHA-256:932E863FD3F86B8EF37506063B4654525D9352F26371CD30C3F74639C78DECCB
                                                                                                                                                                                                                      SHA-512:C4D97C5568C8B4A17A846011C3A21BCC2BBD9B6BE4F922FC88B00B9C0603AE2BA95C8BBD09326CA748D00586C2E7CA949FD05B84C378AFE11C72D21CB1835A4C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DF2CB328544F637D7B.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):512
                                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3::
                                                                                                                                                                                                                      MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                                      SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                                      SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                                      SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DF3C6D1ACF4456307B.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):32768
                                                                                                                                                                                                                      Entropy (8bit):1.2248813923244477
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:ekHulu4vFXiQ7T5Mpd26rXMWSmRSo9al3SIpZ:jHSt7TK2QXxVRilZ
                                                                                                                                                                                                                      MD5:002D5A8E8521649BC5BC78C6DE181581
                                                                                                                                                                                                                      SHA1:E137C02073054752F02AE232DC2972B6E7109018
                                                                                                                                                                                                                      SHA-256:932E863FD3F86B8EF37506063B4654525D9352F26371CD30C3F74639C78DECCB
                                                                                                                                                                                                                      SHA-512:C4D97C5568C8B4A17A846011C3A21BCC2BBD9B6BE4F922FC88B00B9C0603AE2BA95C8BBD09326CA748D00586C2E7CA949FD05B84C378AFE11C72D21CB1835A4C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DF497FD7286ECDDC32.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):32768
                                                                                                                                                                                                                      Entropy (8bit):1.2276996127792068
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:bieHu7u4vFXiAT5ypdk96RLBL7XPWSmRSo9al3SIV8ZQco:b1H8VTk8aLBL7XeVRiJ8ZQc
                                                                                                                                                                                                                      MD5:5B23852FC186BD0E2548F5237AD27C68
                                                                                                                                                                                                                      SHA1:1C321BB44F46C4952312949C558E1FA7452145D7
                                                                                                                                                                                                                      SHA-256:5A767B0BAF130E395E8F2BD6CA291A5479B53D4BD0F564142DA7FE4449B21436
                                                                                                                                                                                                                      SHA-512:C16F49A1274512E98D7DC359AA1DD29CF287BD3028EDE3CBCE109AEE7D2D8993A94AE125E5113BF5C42E27A6FC453F72AB2949A56DF8A9852B434ED279E06987
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DF4F6ACF0974D6F467.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):32768
                                                                                                                                                                                                                      Entropy (8bit):1.2248813923244477
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:ekHulu4vFXiQ7T5Mpd26rXMWSmRSo9al3SIpZ:jHSt7TK2QXxVRilZ
                                                                                                                                                                                                                      MD5:002D5A8E8521649BC5BC78C6DE181581
                                                                                                                                                                                                                      SHA1:E137C02073054752F02AE232DC2972B6E7109018
                                                                                                                                                                                                                      SHA-256:932E863FD3F86B8EF37506063B4654525D9352F26371CD30C3F74639C78DECCB
                                                                                                                                                                                                                      SHA-512:C4D97C5568C8B4A17A846011C3A21BCC2BBD9B6BE4F922FC88B00B9C0603AE2BA95C8BBD09326CA748D00586C2E7CA949FD05B84C378AFE11C72D21CB1835A4C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DF5A2D86795CF83812.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):32768
                                                                                                                                                                                                                      Entropy (8bit):1.2276996127792068
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:bieHu7u4vFXiAT5ypdk96RLBL7XPWSmRSo9al3SIV8ZQco:b1H8VTk8aLBL7XeVRiJ8ZQc
                                                                                                                                                                                                                      MD5:5B23852FC186BD0E2548F5237AD27C68
                                                                                                                                                                                                                      SHA1:1C321BB44F46C4952312949C558E1FA7452145D7
                                                                                                                                                                                                                      SHA-256:5A767B0BAF130E395E8F2BD6CA291A5479B53D4BD0F564142DA7FE4449B21436
                                                                                                                                                                                                                      SHA-512:C16F49A1274512E98D7DC359AA1DD29CF287BD3028EDE3CBCE109AEE7D2D8993A94AE125E5113BF5C42E27A6FC453F72AB2949A56DF8A9852B434ED279E06987
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DF6AB17DEB3A600A3C.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):20480
                                                                                                                                                                                                                      Entropy (8bit):1.5331134226160483
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:438PhfuRc06WXi/nT5Spdk96RLBL7XPWSmRSo9al3SIV8ZQco:42hf1RnT08aLBL7XeVRiJ8ZQc
                                                                                                                                                                                                                      MD5:A67AD08F1ACF0F11A152DAFE8A10682D
                                                                                                                                                                                                                      SHA1:719076EAED37A1C5E20DD208638B43EBEA1D2371
                                                                                                                                                                                                                      SHA-256:D6D50173C856DC8CE7E63FBE88DA01D3CD9BA116A83EDF7BB00FDB5ED62C4D2E
                                                                                                                                                                                                                      SHA-512:A5729C8542ABFF450B2C45B247878BF9EF0112EEF0EF04D4B0E9862054A0D157359949B7F157D5931C46D4022C79F2E23F8E246E6A6E975B40B4875AE6C6E2EE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DF728EB49F90B6D81A.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):512
                                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3::
                                                                                                                                                                                                                      MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                                      SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                                      SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                                      SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DF7E5C243651EDAC2F.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):512
                                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3::
                                                                                                                                                                                                                      MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                                      SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                                      SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                                      SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DF83FE8E8802E13142.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):20480
                                                                                                                                                                                                                      Entropy (8bit):1.529512892982101
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:i8PhfuRc06WXikwnT5spd26rXMWSmRSo9al3SIpZ:Nhf1WwnTa2QXxVRilZ
                                                                                                                                                                                                                      MD5:B425ABB367546B78214357A62D55D126
                                                                                                                                                                                                                      SHA1:5EF21F465F04BC1B9C084254A35CF52B8A0047BC
                                                                                                                                                                                                                      SHA-256:7E6436C6A8D67437AB79593E2DEC5AAB4E24233C855308079FE7640FE76BDA55
                                                                                                                                                                                                                      SHA-512:C1906C940EAD69FCCDD0A41BF3944AE2F934D8857A6C47F79ADE9C4642A7D2BF55E2B71DB6836B323A071B420655461977145FDAB0DDC092D3C89EB65F45671C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DF8BDD8E6D32DF3C51.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):512
                                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3::
                                                                                                                                                                                                                      MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                                      SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                                      SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                                      SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DF928F288195A5C8C3.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):69632
                                                                                                                                                                                                                      Entropy (8bit):0.1302013578747837
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:24:/GZQcpk6YaazipVvipVsS0W1V29aOgNlGgwS+w+kh3lLdMClqSxcMClmVj1LFGmK:/GZQc/VmS9SmRSo9al0wXhdk96RLBLA
                                                                                                                                                                                                                      MD5:E6C0B4993FE3426F06D2FA6D6A11B79E
                                                                                                                                                                                                                      SHA1:83B3B979557609B738B9523636B1FFA9B468780F
                                                                                                                                                                                                                      SHA-256:87D6F124BEA5D39290C2DAD119A3D65A820516E9317974EE6D8E8A32F93D2BFB
                                                                                                                                                                                                                      SHA-512:B8EED9ED198D6E77964904D842BF8F9A4B6D4F747D9824ECEB442445DBCE7F7E0BBDA2579101B1651CDFD0DAA4556F8FEC75FCDD65A5F0C8134E228F38E1B6F5
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DFA1E2EDCCBA4B94F5.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):20480
                                                                                                                                                                                                                      Entropy (8bit):1.5331134226160483
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:438PhfuRc06WXi/nT5Spdk96RLBL7XPWSmRSo9al3SIV8ZQco:42hf1RnT08aLBL7XeVRiJ8ZQc
                                                                                                                                                                                                                      MD5:A67AD08F1ACF0F11A152DAFE8A10682D
                                                                                                                                                                                                                      SHA1:719076EAED37A1C5E20DD208638B43EBEA1D2371
                                                                                                                                                                                                                      SHA-256:D6D50173C856DC8CE7E63FBE88DA01D3CD9BA116A83EDF7BB00FDB5ED62C4D2E
                                                                                                                                                                                                                      SHA-512:A5729C8542ABFF450B2C45B247878BF9EF0112EEF0EF04D4B0E9862054A0D157359949B7F157D5931C46D4022C79F2E23F8E246E6A6E975B40B4875AE6C6E2EE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DFA5DDEDE3239FC6C2.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):32768
                                                                                                                                                                                                                      Entropy (8bit):0.10290914382127898
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:xPLG7iVCnLG7iVrKOzPLHKOIIpsR2RvdheM9TEkDbPNm0lIVky6l80t/:50i8n0itFzDHFhpw2RHegNm0p801
                                                                                                                                                                                                                      MD5:3BFD605CBE7DCC94404722BF68B06B7C
                                                                                                                                                                                                                      SHA1:C7394CEA08F0260F2917A8C947DB548CC311DEAE
                                                                                                                                                                                                                      SHA-256:36EC47B7719CEEE76E54CB94001C9AF90F75B20459433E8129B79CA6D006A16A
                                                                                                                                                                                                                      SHA-512:E161B0069037ED401E7CB676627543A45C8099E22AA66CFB42A37B48C8C1C7535C1A5C5C5361176A8B83E8E896EBEA558A65AE18BE1F2954A89AD08C4B74BE86
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DFAB84A446354C418B.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):512
                                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3::
                                                                                                                                                                                                                      MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                                      SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                                      SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                                      SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DFBDB96B0A699B1268.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):512
                                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3::
                                                                                                                                                                                                                      MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                                      SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                                      SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                                      SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DFC1751C8B4A3976B7.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):32768
                                                                                                                                                                                                                      Entropy (8bit):0.10214282289956009
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:6:xPLG7iVCnLG7iVrKOzPLHKOnh1IHUM9RGBuxwxYqliVky6lJl0t/:50i8n0itFzDHFh1IUswQqDr01
                                                                                                                                                                                                                      MD5:650E01E291490D22CC44415951985D53
                                                                                                                                                                                                                      SHA1:0577BDED9F0EAAF7FB4F1E8DC3B7EA0DDDA368D0
                                                                                                                                                                                                                      SHA-256:3FBD538B3A25D9B20353EC19A22578D686D5045AF80E41C276F900BD07A57E10
                                                                                                                                                                                                                      SHA-512:B7F71C98616DDC8995AF9DAF9574D6D39D82D91EEAFD2667173A013F05C681A990D785C43E74FAF3F7AB3B3BB751F430D5F74CFFBD6441C188F0DA77354065F4
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DFCE241A67BA6BDA40.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):512
                                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3::
                                                                                                                                                                                                                      MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                                      SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                                      SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                                      SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DFCFF3B4CEDBD2EB36.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):512
                                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3::
                                                                                                                                                                                                                      MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                                      SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                                      SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                                      SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DFD425AD7A1DD824A1.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):32768
                                                                                                                                                                                                                      Entropy (8bit):1.2276996127792068
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:bieHu7u4vFXiAT5ypdk96RLBL7XPWSmRSo9al3SIV8ZQco:b1H8VTk8aLBL7XeVRiJ8ZQc
                                                                                                                                                                                                                      MD5:5B23852FC186BD0E2548F5237AD27C68
                                                                                                                                                                                                                      SHA1:1C321BB44F46C4952312949C558E1FA7452145D7
                                                                                                                                                                                                                      SHA-256:5A767B0BAF130E395E8F2BD6CA291A5479B53D4BD0F564142DA7FE4449B21436
                                                                                                                                                                                                                      SHA-512:C16F49A1274512E98D7DC359AA1DD29CF287BD3028EDE3CBCE109AEE7D2D8993A94AE125E5113BF5C42E27A6FC453F72AB2949A56DF8A9852B434ED279E06987
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DFE1BCB02B54137856.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):512
                                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3::
                                                                                                                                                                                                                      MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                                      SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                                      SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                                      SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DFF2800AADAF31D898.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:Composite Document File V2 Document, Cannot read section info
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):20480
                                                                                                                                                                                                                      Entropy (8bit):1.529512892982101
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:48:i8PhfuRc06WXikwnT5spd26rXMWSmRSo9al3SIpZ:Nhf1WwnTa2QXxVRilZ
                                                                                                                                                                                                                      MD5:B425ABB367546B78214357A62D55D126
                                                                                                                                                                                                                      SHA1:5EF21F465F04BC1B9C084254A35CF52B8A0047BC
                                                                                                                                                                                                                      SHA-256:7E6436C6A8D67437AB79593E2DEC5AAB4E24233C855308079FE7640FE76BDA55
                                                                                                                                                                                                                      SHA-512:C1906C940EAD69FCCDD0A41BF3944AE2F934D8857A6C47F79ADE9C4642A7D2BF55E2B71DB6836B323A071B420655461977145FDAB0DDC092D3C89EB65F45671C
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      C:\Windows\Temp\~DFF5210D750882D8F6.TMP

                                                                                                                                                                                                                      Download File
                                                                                                                                                                                                                      Process:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      File Type:data
                                                                                                                                                                                                                      Category:dropped
                                                                                                                                                                                                                      Size (bytes):512
                                                                                                                                                                                                                      Entropy (8bit):0.0
                                                                                                                                                                                                                      Encrypted:false
                                                                                                                                                                                                                      SSDEEP:3::
                                                                                                                                                                                                                      MD5:BF619EAC0CDF3F68D496EA9344137E8B
                                                                                                                                                                                                                      SHA1:5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
                                                                                                                                                                                                                      SHA-256:076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
                                                                                                                                                                                                                      SHA-512:DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
                                                                                                                                                                                                                      Malicious:false
                                                                                                                                                                                                                      Preview:................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                                                                                                                      Static File Info

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      File type:PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
                                                                                                                                                                                                                      Entropy (8bit):7.999923115435028
                                                                                                                                                                                                                      TrID:
                                                                                                                                                                                                                      • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                                                                                                                      • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                                                                                                                      • DOS Executable Generic (2002/1) 0.02%
                                                                                                                                                                                                                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                                                                                                                      File name:GlassWireSetup.exe
                                                                                                                                                                                                                      File size:83'546'864 bytes
                                                                                                                                                                                                                      MD5:f1f2568ebb13c2cbe8c481bffa4922bb
                                                                                                                                                                                                                      SHA1:c1a512a08eebea2d8d88e8ac53ca5628c566ef13
                                                                                                                                                                                                                      SHA256:5bd765c18cbe76eddf97ff39aa20c36e6bbf801ee876fc3c07c4651577e711a3
                                                                                                                                                                                                                      SHA512:cbd066801fe41c80b469be21b45c27f52c074a6ad95f00e53cc6983334b7cfd3f2dd9d605e89baa754685a819fbcec744b09e64bfc8cf5436ff9922bf486dace
                                                                                                                                                                                                                      SSDEEP:1572864:c7XckE46cSX9V+Vu62+M5/G9UEqX8mHVeH8x/kG+6v4f9HZJAyCN59b:c7XD/Pv2+Ue9EjcH8x/kt6v2YJR
                                                                                                                                                                                                                      TLSH:76083351E59683F2DB1D0FB8A278526B1B3D3C6C6FC45A0F12B2FD76D83E189142AD05
                                                                                                                                                                                                                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1 ..PN..PN..PN.*_...PN..PO.JPN.*_...PN..s~..PN..VH..PN.Rich.PN.........................PE..L....C.f.................f...".....

                                                                                                                                                                                                                      File Icon

                                                                                                                                                                                                                      Icon Hash:33449281a1836e0d

                                                                                                                                                                                                                      Static PE Info

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Entrypoint:0x40351c
                                                                                                                                                                                                                      Entrypoint Section:.text
                                                                                                                                                                                                                      Digitally signed:true
                                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                                      Subsystem:windows gui
                                                                                                                                                                                                                      Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                                                                                                                      DLL Characteristics:DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                                                                                                                                                                                                                      Time Stamp:0x660843F3 [Sat Mar 30 16:55:15 2024 UTC]
                                                                                                                                                                                                                      TLS Callbacks:
                                                                                                                                                                                                                      CLR (.Net) Version:
                                                                                                                                                                                                                      OS Version Major:4
                                                                                                                                                                                                                      OS Version Minor:0
                                                                                                                                                                                                                      File Version Major:4
                                                                                                                                                                                                                      File Version Minor:0
                                                                                                                                                                                                                      Subsystem Version Major:4
                                                                                                                                                                                                                      Subsystem Version Minor:0
                                                                                                                                                                                                                      Import Hash:f4639a0b3116c2cfc71144b88a929cfd

                                                                                                                                                                                                                      Authenticode Signature

                                                                                                                                                                                                                      Signature Valid:true
                                                                                                                                                                                                                      Signature Issuer:CN=Sectigo Public Code Signing CA R36, O=Sectigo Limited, C=GB
                                                                                                                                                                                                                      Signature Validation Error:The operation completed successfully
                                                                                                                                                                                                                      Error Number:0
                                                                                                                                                                                                                      Not Before, Not After
                                                                                                                                                                                                                      • 18/10/2022 01:00:00 18/10/2025 00:59:59
                                                                                                                                                                                                                      Subject Chain
                                                                                                                                                                                                                      • CN=domotz inc, O=domotz inc, S=Utah, C=US
                                                                                                                                                                                                                      Version:3
                                                                                                                                                                                                                      Thumbprint MD5:63BCE89EB886A68E0FB8D6AC5B8078F6
                                                                                                                                                                                                                      Thumbprint SHA-1:48955D9BB588003961D1CA22198BABEFA3E9FA56
                                                                                                                                                                                                                      Thumbprint SHA-256:0BA5CDA35A2C4959A842D477E08F0F7E48FF2F5D68F05F906026FE19FDD18D20
                                                                                                                                                                                                                      Serial:25FAF533CF4AF592E9D449E1B64FFF9C

                                                                                                                                                                                                                      Entrypoint Preview

                                                                                                                                                                                                                      Instruction
                                                                                                                                                                                                                      sub esp, 000003F8h
                                                                                                                                                                                                                      push ebp
                                                                                                                                                                                                                      push esi
                                                                                                                                                                                                                      push edi
                                                                                                                                                                                                                      push 00000020h
                                                                                                                                                                                                                      pop edi
                                                                                                                                                                                                                      xor ebp, ebp
                                                                                                                                                                                                                      push 00008001h
                                                                                                                                                                                                                      mov dword ptr [esp+20h], ebp
                                                                                                                                                                                                                      mov dword ptr [esp+18h], 0040A2D8h
                                                                                                                                                                                                                      mov dword ptr [esp+14h], ebp
                                                                                                                                                                                                                      call dword ptr [004080A4h]
                                                                                                                                                                                                                      mov esi, dword ptr [004080A8h]
                                                                                                                                                                                                                      lea eax, dword ptr [esp+34h]
                                                                                                                                                                                                                      push eax
                                                                                                                                                                                                                      mov dword ptr [esp+4Ch], ebp
                                                                                                                                                                                                                      mov dword ptr [esp+0000014Ch], ebp
                                                                                                                                                                                                                      mov dword ptr [esp+00000150h], ebp
                                                                                                                                                                                                                      mov dword ptr [esp+38h], 0000011Ch
                                                                                                                                                                                                                      call esi
                                                                                                                                                                                                                      test eax, eax
                                                                                                                                                                                                                      jne 00007FFAF107F82Ah
                                                                                                                                                                                                                      lea eax, dword ptr [esp+34h]
                                                                                                                                                                                                                      mov dword ptr [esp+34h], 00000114h
                                                                                                                                                                                                                      push eax
                                                                                                                                                                                                                      call esi
                                                                                                                                                                                                                      mov ax, word ptr [esp+48h]
                                                                                                                                                                                                                      mov ecx, dword ptr [esp+62h]
                                                                                                                                                                                                                      sub ax, 00000053h
                                                                                                                                                                                                                      add ecx, FFFFFFD0h
                                                                                                                                                                                                                      neg ax
                                                                                                                                                                                                                      sbb eax, eax
                                                                                                                                                                                                                      mov byte ptr [esp+0000014Eh], 00000004h
                                                                                                                                                                                                                      not eax
                                                                                                                                                                                                                      and eax, ecx
                                                                                                                                                                                                                      mov word ptr [esp+00000148h], ax
                                                                                                                                                                                                                      cmp dword ptr [esp+38h], 0Ah
                                                                                                                                                                                                                      jnc 00007FFAF107F7F8h
                                                                                                                                                                                                                      and word ptr [esp+42h], 0000h
                                                                                                                                                                                                                      mov eax, dword ptr [esp+40h]
                                                                                                                                                                                                                      movzx ecx, byte ptr [esp+3Ch]
                                                                                                                                                                                                                      mov dword ptr [00429AD8h], eax
                                                                                                                                                                                                                      xor eax, eax
                                                                                                                                                                                                                      mov ah, byte ptr [esp+38h]
                                                                                                                                                                                                                      movzx eax, ax
                                                                                                                                                                                                                      or eax, ecx
                                                                                                                                                                                                                      xor ecx, ecx
                                                                                                                                                                                                                      mov ch, byte ptr [esp+00000148h]
                                                                                                                                                                                                                      movzx ecx, cx
                                                                                                                                                                                                                      shl eax, 10h
                                                                                                                                                                                                                      or eax, ecx
                                                                                                                                                                                                                      movzx ecx, byte ptr [esp+0000004Eh]

                                                                                                                                                                                                                      Rich Headers

                                                                                                                                                                                                                      Programming Language:
                                                                                                                                                                                                                      • [EXP] VC++ 6.0 SP5 build 8804

                                                                                                                                                                                                                      Data Directories

                                                                                                                                                                                                                      NameVirtual AddressVirtual Size Is in Section
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IMPORT0x84fc0xa0.rdata
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x650000x21da0.rsrc
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_SECURITY0x4faa0780x3278
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_IAT0x80000x2a8.rdata
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                                                                                                                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                                                                                                                      Sections

                                                                                                                                                                                                                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                                                                                                                      .text0x10000x65760x66001e4066ed6e7440cc449c401dfd9ca64fFalse0.6663219975490197data6.461246686118911IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                      .rdata0x80000x13580x1400f0b500ff912dda10f31f36da3efc8a1eFalse0.44296875data5.102094016108248IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                                                                                                                      .data0xa0000x1fb380x6002e1d49b2855a89e6218e118f0c182b81False0.5026041666666666data4.044293204800279IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                      .ndata0x2a0000x3b0000x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                                                                                                                      .rsrc0x650000x21da00x21e00d4ca0b1838137aca76bd99dbfa3a50f4False0.41649850092250923data5.570784865808838IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                                                                                                                      Resources

                                                                                                                                                                                                                      NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                                                                                                                      RT_BITMAP0x654000x666Device independent bitmap graphic, 96 x 16 x 8, image size 1538, resolution 2868 x 2868 px/m, 15 important colorsEnglishUnited States0.18192918192918192
                                                                                                                                                                                                                      RT_ICON0x65a680x10828Device independent bitmap graphic, 128 x 256 x 32, image size 65536EnglishUnited States0.1977404471785165
                                                                                                                                                                                                                      RT_ICON0x762900x75baPNG image data, 256 x 256, 8-bit/color RGBA, non-interlacedEnglishUnited States0.9974450859380184
                                                                                                                                                                                                                      RT_ICON0x7d8500x4228Device independent bitmap graphic, 64 x 128 x 32, image size 16384EnglishUnited States0.2925129900803023
                                                                                                                                                                                                                      RT_ICON0x81a780x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 9216EnglishUnited States0.32085062240663903
                                                                                                                                                                                                                      RT_ICON0x840200x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 4096EnglishUnited States0.4427767354596623
                                                                                                                                                                                                                      RT_ICON0x850c80x988Device independent bitmap graphic, 24 x 48 x 32, image size 2304EnglishUnited States0.47950819672131145
                                                                                                                                                                                                                      RT_ICON0x85a500x468Device independent bitmap graphic, 16 x 32 x 32, image size 1024EnglishUnited States0.5859929078014184
                                                                                                                                                                                                                      RT_DIALOG0x85eb80x120dataEnglishUnited States0.5138888888888888
                                                                                                                                                                                                                      RT_DIALOG0x85fd80x118dataEnglishUnited States0.5392857142857143
                                                                                                                                                                                                                      RT_DIALOG0x860f00x200dataEnglishUnited States0.40234375
                                                                                                                                                                                                                      RT_DIALOG0x862f00xf8dataEnglishUnited States0.6290322580645161
                                                                                                                                                                                                                      RT_DIALOG0x863e80xa0dataEnglishUnited States0.60625
                                                                                                                                                                                                                      RT_DIALOG0x864880xd4dataEnglishUnited States0.5990566037735849
                                                                                                                                                                                                                      RT_DIALOG0x865600xeedataEnglishUnited States0.6302521008403361
                                                                                                                                                                                                                      RT_GROUP_ICON0x866500x68dataEnglishUnited States0.7596153846153846
                                                                                                                                                                                                                      RT_VERSION0x866b80x2b4dataEnglishUnited States0.47109826589595377
                                                                                                                                                                                                                      RT_MANIFEST0x869700x42eXML 1.0 document, ASCII text, with very long lines (1070), with no line terminatorsEnglishUnited States0.5130841121495328

                                                                                                                                                                                                                      Imports

                                                                                                                                                                                                                      DLLImport
                                                                                                                                                                                                                      ADVAPI32.dllRegEnumValueW, RegEnumKeyW, RegQueryValueExW, RegSetValueExW, RegCloseKey, RegDeleteValueW, RegDeleteKeyW, AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegOpenKeyExW, RegCreateKeyExW
                                                                                                                                                                                                                      SHELL32.dllSHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW, ShellExecuteExW
                                                                                                                                                                                                                      ole32.dllCoCreateInstance, OleUninitialize, OleInitialize, IIDFromString, CoTaskMemFree
                                                                                                                                                                                                                      COMCTL32.dllImageList_Destroy, ImageList_AddMasked, ImageList_Create
                                                                                                                                                                                                                      USER32.dllMessageBoxIndirectW, GetDlgItemTextW, SetDlgItemTextW, CreatePopupMenu, AppendMenuW, TrackPopupMenu, OpenClipboard, EmptyClipboard, SetClipboardData, CloseClipboard, IsWindowVisible, CallWindowProcW, GetMessagePos, CheckDlgButton, LoadCursorW, SetCursor, GetSysColor, SetWindowPos, GetWindowLongW, IsWindowEnabled, SetClassLongW, GetSystemMenu, EnableMenuItem, GetWindowRect, ScreenToClient, EndDialog, RegisterClassW, SystemParametersInfoW, CharPrevW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, CreateDialogParamW, SetTimer, SetWindowTextW, PostQuitMessage, SetForegroundWindow, ShowWindow, wsprintfW, SendMessageTimeoutW, FindWindowExW, IsWindow, GetDlgItem, SetWindowLongW, LoadImageW, GetDC, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndPaint, CharNextA, wsprintfA, DispatchMessageW, CreateWindowExW, PeekMessageW, GetSystemMetrics
                                                                                                                                                                                                                      GDI32.dllGetDeviceCaps, SetBkColor, SelectObject, DeleteObject, CreateBrushIndirect, CreateFontIndirectW, SetBkMode, SetTextColor
                                                                                                                                                                                                                      KERNEL32.dlllstrcmpiA, CreateFileW, GetTempFileNameW, RemoveDirectoryW, CreateProcessW, CreateDirectoryW, GetLastError, CreateThread, GlobalLock, GlobalUnlock, GetDiskFreeSpaceW, WideCharToMultiByte, lstrcpynW, lstrlenW, SetErrorMode, GetVersionExW, GetCommandLineW, GetTempPathW, GetWindowsDirectoryW, WriteFile, CopyFileW, ExitProcess, GetCurrentProcess, GetModuleFileNameW, GetFileSize, GetTickCount, Sleep, SetFileAttributesW, GetFileAttributesW, SetCurrentDirectoryW, MoveFileW, GetFullPathNameW, GetShortPathNameW, SearchPathW, CompareFileTime, SetFileTime, CloseHandle, lstrcmpiW, lstrcmpW, ExpandEnvironmentStringsW, GlobalFree, GlobalAlloc, GetModuleHandleW, LoadLibraryExW, FreeLibrary, WritePrivateProfileStringW, GetPrivateProfileStringW, lstrlenA, MultiByteToWideChar, ReadFile, SetFilePointer, FindClose, FindNextFileW, FindFirstFileW, DeleteFileW, MulDiv, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, SetEnvironmentVariableW

                                                                                                                                                                                                                      Possible Origin

                                                                                                                                                                                                                      Language of compilation systemCountry where language is spokenMap
                                                                                                                                                                                                                      EnglishUnited States

                                                                                                                                                                                                                      Network Behavior

                                                                                                                                                                                                                      Network Port Distribution

                                                                                                                                                                                                                      TCP Packets

                                                                                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                      Oct 7, 2024 18:59:43.842447996 CEST57829443192.168.2.413.50.186.172
                                                                                                                                                                                                                      Oct 7, 2024 18:59:43.842492104 CEST4435782913.50.186.172192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:43.842549086 CEST57829443192.168.2.413.50.186.172
                                                                                                                                                                                                                      Oct 7, 2024 18:59:43.845936060 CEST57829443192.168.2.413.50.186.172
                                                                                                                                                                                                                      Oct 7, 2024 18:59:43.845952034 CEST4435782913.50.186.172192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:44.592895985 CEST4435782913.50.186.172192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:44.594357967 CEST57829443192.168.2.413.50.186.172
                                                                                                                                                                                                                      Oct 7, 2024 18:59:44.594366074 CEST4435782913.50.186.172192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:44.595510960 CEST4435782913.50.186.172192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:44.595673084 CEST57829443192.168.2.413.50.186.172
                                                                                                                                                                                                                      Oct 7, 2024 18:59:44.598119020 CEST57829443192.168.2.413.50.186.172
                                                                                                                                                                                                                      Oct 7, 2024 18:59:44.598181009 CEST4435782913.50.186.172192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:44.598354101 CEST57829443192.168.2.413.50.186.172
                                                                                                                                                                                                                      Oct 7, 2024 18:59:44.643400908 CEST4435782913.50.186.172192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:44.650460005 CEST57829443192.168.2.413.50.186.172
                                                                                                                                                                                                                      Oct 7, 2024 18:59:44.650465012 CEST4435782913.50.186.172192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:44.697237968 CEST57829443192.168.2.413.50.186.172
                                                                                                                                                                                                                      Oct 7, 2024 18:59:44.904828072 CEST4435782913.50.186.172192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:44.904898882 CEST4435782913.50.186.172192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:44.906517982 CEST57829443192.168.2.413.50.186.172
                                                                                                                                                                                                                      Oct 7, 2024 18:59:44.906517982 CEST57829443192.168.2.413.50.186.172
                                                                                                                                                                                                                      Oct 7, 2024 18:59:44.906908035 CEST57829443192.168.2.413.50.186.172
                                                                                                                                                                                                                      Oct 7, 2024 18:59:44.906913996 CEST4435782913.50.186.172192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:45.054291964 CEST57840443192.168.2.416.16.13.164
                                                                                                                                                                                                                      Oct 7, 2024 18:59:45.054322958 CEST4435784016.16.13.164192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:45.055234909 CEST57840443192.168.2.416.16.13.164
                                                                                                                                                                                                                      Oct 7, 2024 18:59:45.055403948 CEST57840443192.168.2.416.16.13.164
                                                                                                                                                                                                                      Oct 7, 2024 18:59:45.055408955 CEST4435784016.16.13.164192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:45.780292988 CEST4435784016.16.13.164192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:45.780813932 CEST57840443192.168.2.416.16.13.164
                                                                                                                                                                                                                      Oct 7, 2024 18:59:45.780827045 CEST4435784016.16.13.164192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:45.781723976 CEST4435784016.16.13.164192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:45.781778097 CEST57840443192.168.2.416.16.13.164
                                                                                                                                                                                                                      Oct 7, 2024 18:59:45.784023046 CEST57840443192.168.2.416.16.13.164
                                                                                                                                                                                                                      Oct 7, 2024 18:59:45.784080982 CEST4435784016.16.13.164192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:45.784183025 CEST57840443192.168.2.416.16.13.164
                                                                                                                                                                                                                      Oct 7, 2024 18:59:45.784188986 CEST4435784016.16.13.164192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:45.837881088 CEST57840443192.168.2.416.16.13.164
                                                                                                                                                                                                                      Oct 7, 2024 18:59:46.089647055 CEST4435784016.16.13.164192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:46.090148926 CEST4435784016.16.13.164192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:46.090199947 CEST57840443192.168.2.416.16.13.164
                                                                                                                                                                                                                      Oct 7, 2024 18:59:46.090431929 CEST57840443192.168.2.416.16.13.164
                                                                                                                                                                                                                      Oct 7, 2024 18:59:46.090451956 CEST4435784016.16.13.164192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:46.098337889 CEST57848443192.168.2.416.16.13.164
                                                                                                                                                                                                                      Oct 7, 2024 18:59:46.098357916 CEST4435784816.16.13.164192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:46.098413944 CEST57848443192.168.2.416.16.13.164
                                                                                                                                                                                                                      Oct 7, 2024 18:59:46.099306107 CEST57848443192.168.2.416.16.13.164
                                                                                                                                                                                                                      Oct 7, 2024 18:59:46.099322081 CEST4435784816.16.13.164192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:47.031861067 CEST4435784816.16.13.164192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:47.032361984 CEST57848443192.168.2.416.16.13.164
                                                                                                                                                                                                                      Oct 7, 2024 18:59:47.032372952 CEST4435784816.16.13.164192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:47.033257961 CEST4435784816.16.13.164192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:47.033313990 CEST57848443192.168.2.416.16.13.164
                                                                                                                                                                                                                      Oct 7, 2024 18:59:47.035450935 CEST57848443192.168.2.416.16.13.164
                                                                                                                                                                                                                      Oct 7, 2024 18:59:47.035516977 CEST4435784816.16.13.164192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:47.035693884 CEST57848443192.168.2.416.16.13.164
                                                                                                                                                                                                                      Oct 7, 2024 18:59:47.035701036 CEST4435784816.16.13.164192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:47.078373909 CEST57848443192.168.2.416.16.13.164
                                                                                                                                                                                                                      Oct 7, 2024 18:59:47.349905014 CEST4435784816.16.13.164192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:47.349997044 CEST4435784816.16.13.164192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:47.350115061 CEST57848443192.168.2.416.16.13.164
                                                                                                                                                                                                                      Oct 7, 2024 18:59:47.350423098 CEST57848443192.168.2.416.16.13.164
                                                                                                                                                                                                                      Oct 7, 2024 18:59:47.350429058 CEST4435784816.16.13.164192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:52.296143055 CEST57884443192.168.2.418.244.164.20
                                                                                                                                                                                                                      Oct 7, 2024 18:59:52.296241999 CEST4435788418.244.164.20192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:52.296899080 CEST57884443192.168.2.418.244.164.20
                                                                                                                                                                                                                      Oct 7, 2024 18:59:52.470089912 CEST57884443192.168.2.418.244.164.20
                                                                                                                                                                                                                      Oct 7, 2024 18:59:52.470130920 CEST4435788418.244.164.20192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:53.441111088 CEST4435788418.244.164.20192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:53.441206932 CEST57884443192.168.2.418.244.164.20
                                                                                                                                                                                                                      Oct 7, 2024 18:59:53.627501965 CEST57884443192.168.2.418.244.164.20
                                                                                                                                                                                                                      Oct 7, 2024 18:59:53.627530098 CEST4435788418.244.164.20192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:53.628242016 CEST4435788418.244.164.20192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:53.628317118 CEST57884443192.168.2.418.244.164.20
                                                                                                                                                                                                                      Oct 7, 2024 18:59:53.656522036 CEST57884443192.168.2.418.244.164.20
                                                                                                                                                                                                                      Oct 7, 2024 18:59:53.703409910 CEST4435788418.244.164.20192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:54.056448936 CEST4435788418.244.164.20192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:54.056534052 CEST4435788418.244.164.20192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:54.056647062 CEST57884443192.168.2.418.244.164.20
                                                                                                                                                                                                                      Oct 7, 2024 18:59:54.056647062 CEST57884443192.168.2.418.244.164.20
                                                                                                                                                                                                                      Oct 7, 2024 18:59:54.074760914 CEST57884443192.168.2.418.244.164.20
                                                                                                                                                                                                                      Oct 7, 2024 18:59:54.074827909 CEST4435788418.244.164.20192.168.2.4

                                                                                                                                                                                                                      UDP Packets

                                                                                                                                                                                                                      TimestampSource PortDest PortSource IPDest IP
                                                                                                                                                                                                                      Oct 7, 2024 18:59:07.720768929 CEST53578971.1.1.1192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:43.808170080 CEST6146353192.168.2.41.1.1.1
                                                                                                                                                                                                                      Oct 7, 2024 18:59:43.819574118 CEST53614631.1.1.1192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:45.039434910 CEST5594053192.168.2.41.1.1.1
                                                                                                                                                                                                                      Oct 7, 2024 18:59:45.052850008 CEST53559401.1.1.1192.168.2.4
                                                                                                                                                                                                                      Oct 7, 2024 18:59:52.270447016 CEST5728753192.168.2.41.1.1.1
                                                                                                                                                                                                                      Oct 7, 2024 18:59:52.291342020 CEST53572871.1.1.1192.168.2.4

                                                                                                                                                                                                                      DNS Queries

                                                                                                                                                                                                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClassDNS over HTTPS
                                                                                                                                                                                                                      Oct 7, 2024 18:59:43.808170080 CEST192.168.2.41.1.1.10x2c73Standard query (0)pivot.protect.glasswire.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Oct 7, 2024 18:59:45.039434910 CEST192.168.2.41.1.1.10xda65Standard query (0)api-eu-north-1.protect.glasswire.comA (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Oct 7, 2024 18:59:52.270447016 CEST192.168.2.41.1.1.10xf008Standard query (0)www.glasswire.comA (IP address)IN (0x0001)false

                                                                                                                                                                                                                      DNS Answers

                                                                                                                                                                                                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClassDNS over HTTPS
                                                                                                                                                                                                                      Oct 7, 2024 18:59:43.819574118 CEST1.1.1.1192.168.2.40x2c73No error (0)pivot.protect.glasswire.com13.50.186.172A (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Oct 7, 2024 18:59:43.819574118 CEST1.1.1.1192.168.2.40x2c73No error (0)pivot.protect.glasswire.com16.16.13.164A (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Oct 7, 2024 18:59:43.819574118 CEST1.1.1.1192.168.2.40x2c73No error (0)pivot.protect.glasswire.com16.16.7.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Oct 7, 2024 18:59:45.052850008 CEST1.1.1.1192.168.2.40xda65No error (0)api-eu-north-1.protect.glasswire.com16.16.13.164A (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Oct 7, 2024 18:59:45.052850008 CEST1.1.1.1192.168.2.40xda65No error (0)api-eu-north-1.protect.glasswire.com13.50.186.172A (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Oct 7, 2024 18:59:45.052850008 CEST1.1.1.1192.168.2.40xda65No error (0)api-eu-north-1.protect.glasswire.com16.16.7.3A (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Oct 7, 2024 18:59:52.291342020 CEST1.1.1.1192.168.2.40xf008No error (0)www.glasswire.com18.244.164.20A (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Oct 7, 2024 18:59:52.291342020 CEST1.1.1.1192.168.2.40xf008No error (0)www.glasswire.com18.244.164.34A (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Oct 7, 2024 18:59:52.291342020 CEST1.1.1.1192.168.2.40xf008No error (0)www.glasswire.com18.244.164.94A (IP address)IN (0x0001)false
                                                                                                                                                                                                                      Oct 7, 2024 18:59:52.291342020 CEST1.1.1.1192.168.2.40xf008No error (0)www.glasswire.com18.244.164.84A (IP address)IN (0x0001)false

                                                                                                                                                                                                                      HTTP Request Dependency Graph

                                                                                                                                                                                                                      • pivot.protect.glasswire.com
                                                                                                                                                                                                                      • api-eu-north-1.protect.glasswire.com
                                                                                                                                                                                                                      • www.glasswire.com

                                                                                                                                                                                                                      HTTPS Proxied Packets

                                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                      0192.168.2.45782913.50.186.1724437112C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                                      2024-10-07 16:59:44 UTC139OUTGET /api/v1/cell?locale=ch HTTP/1.1
                                                                                                                                                                                                                      Host: pivot.protect.glasswire.com
                                                                                                                                                                                                                      User-Agent: GW/3.4.694.0 (Desktop Windows 10; x64)
                                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                                      2024-10-07 16:59:44 UTC128INHTTP/1.1 200 OK
                                                                                                                                                                                                                      Date: Mon, 07 Oct 2024 16:59:44 GMT
                                                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                                                      Content-Length: 395
                                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                                      2024-10-07 16:59:44 UTC395INData Raw: 7b 22 6e 61 6d 65 22 3a 22 45 55 2d 4e 4f 52 54 48 2d 31 22 2c 22 75 72 6c 73 22 3a 7b 22 6c 6f 67 69 6e 22 3a 22 68 74 74 70 73 3a 2f 2f 6c 6f 67 69 6e 2d 65 75 2d 6e 6f 72 74 68 2d 31 2e 70 72 6f 74 65 63 74 2e 67 6c 61 73 73 77 69 72 65 2e 63 6f 6d 2f 61 75 74 68 2f 72 65 61 6c 6d 73 2f 67 6c 61 73 73 77 69 72 65 2f 70 72 6f 74 6f 63 6f 6c 2f 6f 70 65 6e 69 64 2d 63 6f 6e 6e 65 63 74 2f 61 75 74 68 3f 63 6c 69 65 6e 74 5f 69 64 3d 61 63 63 6f 75 6e 74 26 72 65 73 70 6f 6e 73 65 5f 74 79 70 65 3d 63 6f 64 65 26 73 63 6f 70 65 3d 6f 70 65 6e 69 64 26 6c 6f 67 69 6e 5f 68 69 6e 74 3d 22 2c 22 70 6f 72 74 61 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 70 6f 72 74 61 6c 2d 65 75 2d 6e 6f 72 74 68 2d 31 2e 70 72 6f 74 65 63 74 2e 67 6c 61 73 73 77 69 72 65 2e 63 6f
                                                                                                                                                                                                                      Data Ascii: {"name":"EU-NORTH-1","urls":{"login":"https://login-eu-north-1.protect.glasswire.com/auth/realms/glasswire/protocol/openid-connect/auth?client_id=account&response_type=code&scope=openid&login_hint=","portal":"https://portal-eu-north-1.protect.glasswire.co


                                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                      1192.168.2.45784016.16.13.1644437112C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                                      2024-10-07 16:59:45 UTC210OUTPOST /api/v1.1/agent/device/register HTTP/1.1
                                                                                                                                                                                                                      Host: api-eu-north-1.protect.glasswire.com
                                                                                                                                                                                                                      User-Agent: GW/3.4.694.0 (Desktop Windows 10; x64)
                                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                                                      Content-Length: 41
                                                                                                                                                                                                                      2024-10-07 16:59:45 UTC41OUTData Raw: 7b 22 76 65 72 73 69 6f 6e 22 3a 22 33 2e 34 2e 36 39 34 22 2c 22 6f 73 5f 74 79 70 65 22 3a 22 57 69 6e 64 6f 77 73 22 7d
                                                                                                                                                                                                                      Data Ascii: {"version":"3.4.694","os_type":"Windows"}
                                                                                                                                                                                                                      2024-10-07 16:59:46 UTC197INHTTP/1.1 200 OK
                                                                                                                                                                                                                      Date: Mon, 07 Oct 2024 16:59:45 GMT
                                                                                                                                                                                                                      Content-Type: application/json; charset=utf-8
                                                                                                                                                                                                                      Content-Length: 45
                                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                                      Access-Control-Allow-Origin: *
                                                                                                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                                                                                                      2024-10-07 16:59:46 UTC45INData Raw: 7b 22 69 64 22 3a 22 34 64 31 36 34 32 65 30 2d 34 37 39 35 2d 34 64 36 66 2d 38 37 34 65 2d 66 35 33 63 64 66 34 36 62 64 37 34 22 7d
                                                                                                                                                                                                                      Data Ascii: {"id":"4d1642e0-4795-4d6f-874e-f53cdf46bd74"}


                                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                      2192.168.2.45784816.16.13.1644437112C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                                      2024-10-07 16:59:47 UTC201OUTPOST /api/v1.1/agent/event HTTP/1.1
                                                                                                                                                                                                                      Host: api-eu-north-1.protect.glasswire.com
                                                                                                                                                                                                                      User-Agent: GW/3.4.694.0 (Desktop Windows 10; x64)
                                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                                      Content-Type: application/json
                                                                                                                                                                                                                      Content-Length: 124
                                                                                                                                                                                                                      2024-10-07 16:59:47 UTC124OUTData Raw: 7b 22 64 65 76 69 63 65 5f 69 64 22 3a 22 34 64 31 36 34 32 65 30 2d 34 37 39 35 2d 34 64 36 66 2d 38 37 34 65 2d 66 35 33 63 64 66 34 36 62 64 37 34 22 2c 22 74 79 70 65 22 3a 22 49 4e 53 54 41 4c 4c 41 54 49 4f 4e 22 2c 22 73 75 62 5f 74 79 70 65 22 3a 22 49 4e 53 54 41 4c 4c 22 2c 22 64 61 74 61 22 3a 7b 22 76 65 72 73 69 6f 6e 22 3a 22 33 2e 34 2e 36 39 34 22 7d 7d
                                                                                                                                                                                                                      Data Ascii: {"device_id":"4d1642e0-4795-4d6f-874e-f53cdf46bd74","type":"INSTALLATION","sub_type":"INSTALL","data":{"version":"3.4.694"}}
                                                                                                                                                                                                                      2024-10-07 16:59:47 UTC111INHTTP/1.1 200 OK
                                                                                                                                                                                                                      Date: Mon, 07 Oct 2024 16:59:47 GMT
                                                                                                                                                                                                                      Content-Length: 0
                                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                                      server: uvicorn


                                                                                                                                                                                                                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                                                                                                                                                                                                                      3192.168.2.45788418.244.164.204437728C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exe
                                                                                                                                                                                                                      TimestampBytes transferredDirectionData
                                                                                                                                                                                                                      2024-10-07 16:59:53 UTC660OUTGET /stat/install.php?v=3.4.694&build_type=full&os=Ten&platform=x64&update=0&install_id=8AC7009D4B52E62F54AD1F4176FBF27962F3EAF3F7DDE916A08729FD64A8AEEE&referrer=https%3A%2F%2Fwww.google.com%2F&user_agent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F129.0.0.0+Safari%2F537.36+Edg%2F129.0.0.0&ga_client_id=1231827075.1728319357 HTTP/1.1
                                                                                                                                                                                                                      Accept: */*
                                                                                                                                                                                                                      Accept-Encoding: gzip, deflate
                                                                                                                                                                                                                      User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)
                                                                                                                                                                                                                      Host: www.glasswire.com
                                                                                                                                                                                                                      Connection: Keep-Alive
                                                                                                                                                                                                                      2024-10-07 16:59:54 UTC642INHTTP/1.1 200 OK
                                                                                                                                                                                                                      Content-Type: text/html; charset=UTF-8
                                                                                                                                                                                                                      Transfer-Encoding: chunked
                                                                                                                                                                                                                      Connection: close
                                                                                                                                                                                                                      Date: Mon, 07 Oct 2024 16:59:53 GMT
                                                                                                                                                                                                                      Server: nginx
                                                                                                                                                                                                                      Expires: Mon, 26 Jul 1997 05:00:00 GMT
                                                                                                                                                                                                                      Last-Modified: Mon, 07 Oct 2024 16:59:53 GMT
                                                                                                                                                                                                                      Cache-Control: no-store, no-cache, must-revalidate
                                                                                                                                                                                                                      Cache-Control: post-check=0, pre-check=0
                                                                                                                                                                                                                      Pragma: no-cache
                                                                                                                                                                                                                      X-Content-Type-Options: nosniff
                                                                                                                                                                                                                      X-XSS-Protection: 1; mode=block
                                                                                                                                                                                                                      Vary: Accept-Encoding
                                                                                                                                                                                                                      X-Cache: Miss from cloudfront
                                                                                                                                                                                                                      Via: 1.1 550a2e33920b164c7fc3dddc1871c3ba.cloudfront.net (CloudFront)
                                                                                                                                                                                                                      X-Amz-Cf-Pop: LHR50-P8
                                                                                                                                                                                                                      X-Amz-Cf-Id: XRBMzQTFg5xSf8RD3-Sos1gDRiDq2jyLKEWEZOd8yoiouuGDNCECBg==
                                                                                                                                                                                                                      2024-10-07 16:59:54 UTC5INData Raw: 30 0d 0a 0d 0a
                                                                                                                                                                                                                      Data Ascii: 0


                                                                                                                                                                                                                      Statistics

                                                                                                                                                                                                                      CPU Usage

                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                      Memory Usage

                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                      High Level Behavior Distribution

                                                                                                                                                                                                                      Click to dive into process behavior distribution

                                                                                                                                                                                                                      Behavior

                                                                                                                                                                                                                      Click to jump to process

                                                                                                                                                                                                                      System Behavior

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:0
                                                                                                                                                                                                                      Start time:12:58:45
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Users\user\Desktop\GlassWireSetup.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:"C:\Users\user\Desktop\GlassWireSetup.exe"
                                                                                                                                                                                                                      Imagebase:0x400000
                                                                                                                                                                                                                      File size:83'546'864 bytes
                                                                                                                                                                                                                      MD5 hash:F1F2568EBB13C2CBE8C481BFFA4922BB
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:1
                                                                                                                                                                                                                      Start time:12:58:48
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exe" /install /quiet /norestart
                                                                                                                                                                                                                      Imagebase:0x5b0000
                                                                                                                                                                                                                      File size:13'787'064 bytes
                                                                                                                                                                                                                      MD5 hash:DD0232EE751164EAAD2FE0DE7158D77D
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Antivirus matches:
                                                                                                                                                                                                                      • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:2
                                                                                                                                                                                                                      Start time:12:58:48
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:"C:\Windows\Temp\{FAC60DB1-A697-45EE-963C-3E79552A0F30}\.cr\vc_redist.x86.exe" -burn.clean.room="C:\Users\user\AppData\Local\Temp\nsx9694.tmp\vc_redist.x86.exe" -burn.filehandle.attached=524 -burn.filehandle.self=640 /install /quiet /norestart
                                                                                                                                                                                                                      Imagebase:0x860000
                                                                                                                                                                                                                      File size:647'664 bytes
                                                                                                                                                                                                                      MD5 hash:29C7A21BAE42889B08137C25AAE8E55C
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:3
                                                                                                                                                                                                                      Start time:12:58:49
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:"C:\Windows\Temp\{A3612FE9-3C22-4098-98C3-2CD91218666B}\.be\VC_redist.x86.exe" -q -burn.elevated BurnPipe.{4C6967F0-7861-4E5E-A266-A79F91D53451} {8D47B6A8-8425-45E8-BA0B-10ED43630BCC} 1148
                                                                                                                                                                                                                      Imagebase:0xdf0000
                                                                                                                                                                                                                      File size:647'664 bytes
                                                                                                                                                                                                                      MD5 hash:29C7A21BAE42889B08137C25AAE8E55C
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:5
                                                                                                                                                                                                                      Start time:12:58:49
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\VSSVC.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                      Imagebase:0x7ff7b0de0000
                                                                                                                                                                                                                      File size:1'495'040 bytes
                                                                                                                                                                                                                      MD5 hash:875046AD4755396636A68F4A9EDB22A4
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:6
                                                                                                                                                                                                                      Start time:12:58:50
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:C:\Windows\System32\svchost.exe -k swprv
                                                                                                                                                                                                                      Imagebase:0x7ff6eef20000
                                                                                                                                                                                                                      File size:55'320 bytes
                                                                                                                                                                                                                      MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:8
                                                                                                                                                                                                                      Start time:12:59:01
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\SrTasks.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:1
                                                                                                                                                                                                                      Imagebase:0x7ff7490a0000
                                                                                                                                                                                                                      File size:59'392 bytes
                                                                                                                                                                                                                      MD5 hash:2694D2D28C368B921686FE567BD319EB
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:9
                                                                                                                                                                                                                      Start time:12:59:01
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:10
                                                                                                                                                                                                                      Start time:12:59:02
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                      Imagebase:0x7ff6bdcc0000
                                                                                                                                                                                                                      File size:69'632 bytes
                                                                                                                                                                                                                      MD5 hash:E5DA170027542E25EDE42FC54C929077
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:13
                                                                                                                                                                                                                      Start time:12:59:43
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:"C:\Users\user\AppData\Local\Temp\nsx9694.tmp\GWInstSt.exe" "https://www.glasswire.com/stat/install.php?v=3.4.694&build_type=full&os=Ten&platform=x64&update=0&install_id=8AC7009D4B52E62F54AD1F4176FBF27962F3EAF3F7DDE916A08729FD64A8AEEE&referrer=https%3A%2F%2Fwww.google.com%2F&user_agent=Mozilla%2F5.0+%28Windows+NT+10.0%3B+Win64%3B+x64%29+AppleWebKit%2F537.36+%28KHTML%2C+like+Gecko%29+Chrome%2F129.0.0.0+Safari%2F537.36+Edg%2F129.0.0.0&ga_client_id=1231827075.1728319357" "nsis$$.tmp"
                                                                                                                                                                                                                      Imagebase:0x1e0000
                                                                                                                                                                                                                      File size:2'570'352 bytes
                                                                                                                                                                                                                      MD5 hash:63DC9E4A693261F14924D8692D2EB442
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Antivirus matches:
                                                                                                                                                                                                                      • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                      Reputation:low
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:14
                                                                                                                                                                                                                      Start time:12:59:47
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:"C:\Windows\system32\rundll32.exe" setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Windows\system32\drivers\gwdrv.inf
                                                                                                                                                                                                                      Imagebase:0x7ff769270000
                                                                                                                                                                                                                      File size:71'680 bytes
                                                                                                                                                                                                                      MD5 hash:EF3179D498793BF4234F708D3BE28633
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:15
                                                                                                                                                                                                                      Start time:12:59:47
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
                                                                                                                                                                                                                      Imagebase:0x7ff6eef20000
                                                                                                                                                                                                                      File size:55'320 bytes
                                                                                                                                                                                                                      MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:high
                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:16
                                                                                                                                                                                                                      Start time:12:59:47
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\drvinst.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:DrvInst.exe "4" "0" "C:\Users\user\AppData\Local\Temp\{1b9ae675-a69a-784f-a0a3-d898132a09ba}\gwdrv.inf" "9" "4e7eab47b" "0000000000000144" "WinSta0\Default" "0000000000000170" "208" "C:\Windows\system32\drivers"
                                                                                                                                                                                                                      Imagebase:0x7ff6cabc0000
                                                                                                                                                                                                                      File size:337'920 bytes
                                                                                                                                                                                                                      MD5 hash:294990C88B9D1FE0A54A1FA8BF4324D9
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Reputation:moderate
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:17
                                                                                                                                                                                                                      Start time:12:59:49
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\drvinst.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gwdrv.inf_amd64_54933c59b5293195\gwdrv.inf" "0" "4e7eab47b" "0000000000000170" "WinSta0\Default"
                                                                                                                                                                                                                      Imagebase:0x7ff6cabc0000
                                                                                                                                                                                                                      File size:337'920 bytes
                                                                                                                                                                                                                      MD5 hash:294990C88B9D1FE0A54A1FA8BF4324D9
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:18
                                                                                                                                                                                                                      Start time:12:59:50
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\runonce.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:"C:\Windows\system32\runonce.exe" -r
                                                                                                                                                                                                                      Imagebase:0x7ff7008c0000
                                                                                                                                                                                                                      File size:61'952 bytes
                                                                                                                                                                                                                      MD5 hash:9ADEF025B168447C1E8514D919CB5DC0
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:19
                                                                                                                                                                                                                      Start time:12:59:51
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\grpconv.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:"C:\Windows\System32\grpconv.exe" -o
                                                                                                                                                                                                                      Imagebase:0x7ff6f5290000
                                                                                                                                                                                                                      File size:52'736 bytes
                                                                                                                                                                                                                      MD5 hash:8531882ACC33CB4BDC11B305A01581CE
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:21
                                                                                                                                                                                                                      Start time:12:59:52
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\net.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:"C:\Windows\system32\net.exe" start gwdrv
                                                                                                                                                                                                                      Imagebase:0x7ff6b0cd0000
                                                                                                                                                                                                                      File size:59'904 bytes
                                                                                                                                                                                                                      MD5 hash:0BD94A338EEA5A4E1F2830AE326E6D19
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:22
                                                                                                                                                                                                                      Start time:12:59:52
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:23
                                                                                                                                                                                                                      Start time:12:59:52
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\net1.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:C:\Windows\system32\net1 start gwdrv
                                                                                                                                                                                                                      Imagebase:0x7ff7359a0000
                                                                                                                                                                                                                      File size:183'808 bytes
                                                                                                                                                                                                                      MD5 hash:55693DF2BB3CBE2899DFDDF18B4EB8C9
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:24
                                                                                                                                                                                                                      Start time:12:59:53
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\SysWOW64\wevtutil.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:"C:\Windows\system32\wevtutil.exe" im "C:\Users\user\AppData\Local\Temp\nsx9694.tmp\eventlog.man" /rf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll" /mf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll"
                                                                                                                                                                                                                      Imagebase:0xd70000
                                                                                                                                                                                                                      File size:208'384 bytes
                                                                                                                                                                                                                      MD5 hash:3C0E48DA02447863279B0FE3CE7FE5E8
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:25
                                                                                                                                                                                                                      Start time:12:59:53
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:26
                                                                                                                                                                                                                      Start time:12:59:53
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\wevtutil.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:"C:\Windows\system32\wevtutil.exe" im "C:\Users\user\AppData\Local\Temp\nsx9694.tmp\eventlog.man" /rf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll" /mf:"C:\Program Files (x86)\GlassWire\GWEventLog.dll" /fromwow64
                                                                                                                                                                                                                      Imagebase:0x7ff793890000
                                                                                                                                                                                                                      File size:278'016 bytes
                                                                                                                                                                                                                      MD5 hash:1AAE26BD68B911D0420626A27070EB8D
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:27
                                                                                                                                                                                                                      Start time:12:59:55
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\GlassWire\GWCtlSrv.exe" "-i"
                                                                                                                                                                                                                      Imagebase:0xa20000
                                                                                                                                                                                                                      File size:8'850'560 bytes
                                                                                                                                                                                                                      MD5 hash:56D6DB5EA2E8EF737A0CF9C808B8D533
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Antivirus matches:
                                                                                                                                                                                                                      • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:28
                                                                                                                                                                                                                      Start time:12:59:55
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:29
                                                                                                                                                                                                                      Start time:12:59:59
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\GlassWire\GWCtlSrv.exe" "-s"
                                                                                                                                                                                                                      Imagebase:0xa20000
                                                                                                                                                                                                                      File size:8'850'560 bytes
                                                                                                                                                                                                                      MD5 hash:56D6DB5EA2E8EF737A0CF9C808B8D533
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:30
                                                                                                                                                                                                                      Start time:12:59:59
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\conhost.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                                                                                                      Imagebase:0x7ff7699e0000
                                                                                                                                                                                                                      File size:862'208 bytes
                                                                                                                                                                                                                      MD5 hash:0D698AF330FD17BEE3BF90011D49251D
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:31
                                                                                                                                                                                                                      Start time:13:00:03
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Program Files (x86)\GlassWire\GWCtlSrv.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\GlassWire\GWCtlSrv.exe"
                                                                                                                                                                                                                      Imagebase:0xa20000
                                                                                                                                                                                                                      File size:8'850'560 bytes
                                                                                                                                                                                                                      MD5 hash:56D6DB5EA2E8EF737A0CF9C808B8D533
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:34
                                                                                                                                                                                                                      Start time:13:00:11
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\explorer.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:"C:\Windows\explorer.exe" "C:\Program Files (x86)\GlassWire\glasswire.exe"
                                                                                                                                                                                                                      Imagebase:0x7ff72b770000
                                                                                                                                                                                                                      File size:5'141'208 bytes
                                                                                                                                                                                                                      MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:35
                                                                                                                                                                                                                      Start time:13:00:11
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\explorer.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                                                                                                                                                                      Imagebase:0x7ff72b770000
                                                                                                                                                                                                                      File size:5'141'208 bytes
                                                                                                                                                                                                                      MD5 hash:662F4F92FDE3557E86D110526BB578D5
                                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:36
                                                                                                                                                                                                                      Start time:13:00:11
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Program Files (x86)\GlassWire\GlassWire.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\GlassWire\GlassWire.exe"
                                                                                                                                                                                                                      Imagebase:0xf10000
                                                                                                                                                                                                                      File size:12'010'624 bytes
                                                                                                                                                                                                                      MD5 hash:E4ADF42227B3BADFCD239669363B4BDF
                                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Antivirus matches:
                                                                                                                                                                                                                      • Detection: 0%, ReversingLabs
                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:37
                                                                                                                                                                                                                      Start time:13:00:16
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                      Wow64 process (32bit):false
                                                                                                                                                                                                                      Commandline:C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
                                                                                                                                                                                                                      Imagebase:0x7ff6eef20000
                                                                                                                                                                                                                      File size:55'320 bytes
                                                                                                                                                                                                                      MD5 hash:B7F884C1B74A263F746EE12A5F7C9F6A
                                                                                                                                                                                                                      Has elevated privileges:true
                                                                                                                                                                                                                      Has administrator privileges:true
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Has exited:false

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:38
                                                                                                                                                                                                                      Start time:13:00:17
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Program Files (x86)\GlassWire\GlassWire.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\GlassWire\glasswire.exe" -hide
                                                                                                                                                                                                                      Imagebase:0xf10000
                                                                                                                                                                                                                      File size:12'010'624 bytes
                                                                                                                                                                                                                      MD5 hash:E4ADF42227B3BADFCD239669363B4BDF
                                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      General

                                                                                                                                                                                                                      Target ID:39
                                                                                                                                                                                                                      Start time:13:00:25
                                                                                                                                                                                                                      Start date:07/10/2024
                                                                                                                                                                                                                      Path:C:\Program Files (x86)\GlassWire\GlassWire.exe
                                                                                                                                                                                                                      Wow64 process (32bit):true
                                                                                                                                                                                                                      Commandline:"C:\Program Files (x86)\GlassWire\glasswire.exe" -hide
                                                                                                                                                                                                                      Imagebase:0xf10000
                                                                                                                                                                                                                      File size:12'010'624 bytes
                                                                                                                                                                                                                      MD5 hash:E4ADF42227B3BADFCD239669363B4BDF
                                                                                                                                                                                                                      Has elevated privileges:false
                                                                                                                                                                                                                      Has administrator privileges:false
                                                                                                                                                                                                                      Programmed in:C, C++ or other language
                                                                                                                                                                                                                      Has exited:true

                                                                                                                                                                                                                      Disassembly

                                                                                                                                                                                                                      Reset < >

                                                                                                                                                                                                                        Execution Graph

                                                                                                                                                                                                                        Execution Coverage:31.7%
                                                                                                                                                                                                                        Dynamic/Decrypted Code Coverage:0%
                                                                                                                                                                                                                        Signature Coverage:17.1%
                                                                                                                                                                                                                        Total number of Nodes:1388
                                                                                                                                                                                                                        Total number of Limit Nodes:56
                                                                                                                                                                                                                        execution_graph 4331 401bc0 4332 401c11 4331->4332 4338 401bcd 4331->4338 4333 401c3b GlobalAlloc 4332->4333 4335 401c16 4332->4335 4336 40657e 21 API calls 4333->4336 4334 4023af 4337 40657e 21 API calls 4334->4337 4344 401c56 4335->4344 4352 406541 lstrcpynW 4335->4352 4336->4344 4340 4023bc 4337->4340 4338->4334 4341 401be4 4338->4341 4345 405ba1 MessageBoxIndirectW 4340->4345 4350 406541 lstrcpynW 4341->4350 4342 401c28 GlobalFree 4342->4344 4345->4344 4346 401bf3 4351 406541 lstrcpynW 4346->4351 4348 401c02 4353 406541 lstrcpynW 4348->4353 4350->4346 4351->4348 4352->4342 4353->4344 3233 403fc1 3234 403fd9 3233->3234 3235 40413a 3233->3235 3234->3235 3238 403fe5 3234->3238 3236 40418b 3235->3236 3237 40414b GetDlgItem GetDlgItem 3235->3237 3242 4041e5 3236->3242 3252 401389 2 API calls 3236->3252 3241 4044c0 22 API calls 3237->3241 3239 403ff0 SetWindowPos 3238->3239 3240 404003 3238->3240 3239->3240 3244 40400c ShowWindow 3240->3244 3245 40404e 3240->3245 3246 404175 SetClassLongW 3241->3246 3253 404135 3242->3253 3304 40450c 3242->3304 3247 4040f8 3244->3247 3248 40402c GetWindowLongW 3244->3248 3249 404056 DestroyWindow 3245->3249 3250 40406d 3245->3250 3251 40140b 2 API calls 3246->3251 3343 404527 3247->3343 3248->3247 3255 404045 ShowWindow 3248->3255 3303 404449 3249->3303 3256 404072 SetWindowLongW 3250->3256 3257 404083 3250->3257 3251->3236 3258 4041bd 3252->3258 3255->3245 3256->3253 3257->3247 3261 40408f GetDlgItem 3257->3261 3258->3242 3262 4041c1 SendMessageW 3258->3262 3259 40140b 2 API calls 3273 4041f7 3259->3273 3260 40444b DestroyWindow KiUserCallbackDispatcher 3260->3303 3264 4040a0 SendMessageW IsWindowEnabled 3261->3264 3265 4040bd 3261->3265 3262->3253 3263 40447a ShowWindow 3263->3253 3264->3253 3264->3265 3267 4040ca 3265->3267 3268 404111 SendMessageW 3265->3268 3269 4040dd 3265->3269 3277 4040c2 3265->3277 3267->3268 3267->3277 3268->3247 3271 4040e5 3269->3271 3272 4040fa 3269->3272 3337 40140b 3271->3337 3275 40140b 2 API calls 3272->3275 3273->3253 3273->3259 3273->3260 3276 4044c0 22 API calls 3273->3276 3294 40438b DestroyWindow 3273->3294 3307 40657e 3273->3307 3324 4044c0 3273->3324 3275->3277 3276->3273 3277->3247 3340 404499 3277->3340 3279 404272 GetDlgItem 3280 404287 3279->3280 3281 40428f ShowWindow KiUserCallbackDispatcher 3279->3281 3280->3281 3327 4044e2 KiUserCallbackDispatcher 3281->3327 3283 4042b9 KiUserCallbackDispatcher 3288 4042cd 3283->3288 3284 4042d2 GetSystemMenu EnableMenuItem SendMessageW 3285 404302 SendMessageW 3284->3285 3284->3288 3285->3288 3288->3284 3328 4044f5 SendMessageW 3288->3328 3329 403fa2 3288->3329 3332 406541 lstrcpynW 3288->3332 3290 404331 lstrlenW 3291 40657e 21 API calls 3290->3291 3292 404347 SetWindowTextW 3291->3292 3333 401389 3292->3333 3295 4043a5 CreateDialogParamW 3294->3295 3294->3303 3296 4043d8 3295->3296 3295->3303 3297 4044c0 22 API calls 3296->3297 3298 4043e3 GetDlgItem GetWindowRect ScreenToClient SetWindowPos 3297->3298 3299 401389 2 API calls 3298->3299 3300 404429 3299->3300 3300->3253 3301 404431 ShowWindow 3300->3301 3302 40450c SendMessageW 3301->3302 3302->3303 3303->3253 3303->3263 3305 404524 3304->3305 3306 404515 SendMessageW 3304->3306 3305->3273 3306->3305 3322 406589 3307->3322 3308 4067d0 3309 4067e9 3308->3309 3379 406541 lstrcpynW 3308->3379 3309->3273 3311 4067a1 lstrlenW 3311->3322 3315 40669a GetSystemDirectoryW 3315->3322 3316 40657e 15 API calls 3316->3311 3317 4066b0 GetWindowsDirectoryW 3317->3322 3318 406742 lstrcatW 3318->3322 3320 40657e 15 API calls 3320->3322 3322->3308 3322->3311 3322->3315 3322->3316 3322->3317 3322->3318 3322->3320 3323 406712 SHGetPathFromIDListW CoTaskMemFree 3322->3323 3357 40640f 3322->3357 3362 406935 GetModuleHandleA 3322->3362 3368 4067ef 3322->3368 3377 406488 wsprintfW 3322->3377 3378 406541 lstrcpynW 3322->3378 3323->3322 3325 40657e 21 API calls 3324->3325 3326 4044cb SetDlgItemTextW 3325->3326 3326->3279 3327->3283 3328->3288 3330 40657e 21 API calls 3329->3330 3331 403fb0 SetWindowTextW 3330->3331 3331->3288 3332->3290 3335 401390 3333->3335 3334 4013fe 3334->3273 3335->3334 3336 4013cb MulDiv SendMessageW 3335->3336 3336->3335 3338 401389 2 API calls 3337->3338 3339 401420 3338->3339 3339->3277 3341 4044a0 3340->3341 3342 4044a6 SendMessageW 3340->3342 3341->3342 3342->3247 3344 4045ea 3343->3344 3345 40453f GetWindowLongW 3343->3345 3344->3253 3345->3344 3346 404554 3345->3346 3346->3344 3347 404581 GetSysColor 3346->3347 3348 404584 3346->3348 3347->3348 3349 404594 SetBkMode 3348->3349 3350 40458a SetTextColor 3348->3350 3351 4045b2 3349->3351 3352 4045ac GetSysColor 3349->3352 3350->3349 3353 4045b9 SetBkColor 3351->3353 3354 4045c3 3351->3354 3352->3351 3353->3354 3354->3344 3355 4045d6 DeleteObject 3354->3355 3356 4045dd CreateBrushIndirect 3354->3356 3355->3356 3356->3344 3380 4063ae 3357->3380 3360 406443 RegQueryValueExW RegCloseKey 3361 406473 3360->3361 3361->3322 3363 406951 3362->3363 3364 40695b GetProcAddress 3362->3364 3384 4068c5 GetSystemDirectoryW 3363->3384 3366 40696a 3364->3366 3366->3322 3367 406957 3367->3364 3367->3366 3369 4067fc 3368->3369 3371 406872 3369->3371 3372 406865 CharNextW 3369->3372 3375 406851 CharNextW 3369->3375 3376 406860 CharNextW 3369->3376 3387 405e3d 3369->3387 3370 406877 CharPrevW 3370->3371 3371->3370 3373 406898 3371->3373 3372->3369 3372->3371 3373->3322 3375->3369 3376->3372 3377->3322 3378->3322 3379->3309 3381 4063bd 3380->3381 3382 4063c1 3381->3382 3383 4063c6 RegOpenKeyExW 3381->3383 3382->3360 3382->3361 3383->3382 3385 4068e7 wsprintfW LoadLibraryExW 3384->3385 3385->3367 3388 405e43 3387->3388 3389 405e59 3388->3389 3390 405e4a CharNextW 3388->3390 3389->3369 3390->3388 4354 402641 4355 402dcb 21 API calls 4354->4355 4356 402648 4355->4356 4359 406031 GetFileAttributesW CreateFileW 4356->4359 4358 402654 4359->4358 4367 4025c3 4368 402e0b 21 API calls 4367->4368 4369 4025cd 4368->4369 4370 402da9 21 API calls 4369->4370 4371 4025d6 4370->4371 4372 4025f2 RegEnumKeyW 4371->4372 4373 4025fe RegEnumValueW 4371->4373 4374 402953 4371->4374 4375 402613 RegCloseKey 4372->4375 4373->4375 4375->4374 4377 4015c8 4378 402dcb 21 API calls 4377->4378 4379 4015cf SetFileAttributesW 4378->4379 4380 4015e1 4379->4380 3693 401fc9 3694 402dcb 21 API calls 3693->3694 3695 401fcf 3694->3695 3696 4055c6 28 API calls 3695->3696 3697 401fd9 3696->3697 3708 405b24 CreateProcessW 3697->3708 3700 402002 CloseHandle 3701 402953 3700->3701 3704 401ff4 3705 402004 3704->3705 3706 401ff9 3704->3706 3705->3700 3716 406488 wsprintfW 3706->3716 3709 401fdf 3708->3709 3710 405b57 CloseHandle 3708->3710 3709->3700 3709->3701 3711 4069e0 WaitForSingleObject 3709->3711 3710->3709 3712 4069fa 3711->3712 3713 406a0c GetExitCodeProcess 3712->3713 3717 406971 3712->3717 3713->3704 3716->3700 3718 40698e PeekMessageW 3717->3718 3719 406984 DispatchMessageW 3718->3719 3720 40699e WaitForSingleObject 3718->3720 3719->3718 3720->3712 3809 4021cf 3810 402dcb 21 API calls 3809->3810 3811 4021d6 3810->3811 3812 402dcb 21 API calls 3811->3812 3813 4021e0 3812->3813 3814 402dcb 21 API calls 3813->3814 3815 4021ea 3814->3815 3816 402dcb 21 API calls 3815->3816 3817 4021f4 3816->3817 3818 402dcb 21 API calls 3817->3818 3819 4021fe 3818->3819 3820 40223d CoCreateInstance 3819->3820 3821 402dcb 21 API calls 3819->3821 3824 40225c 3820->3824 3821->3820 3822 401423 28 API calls 3823 40231b 3822->3823 3824->3822 3824->3823 3825 40254f 3836 402e0b 3825->3836 3828 402dcb 21 API calls 3829 402562 3828->3829 3830 40256d RegQueryValueExW 3829->3830 3834 402953 3829->3834 3831 402593 RegCloseKey 3830->3831 3832 40258d 3830->3832 3831->3834 3832->3831 3841 406488 wsprintfW 3832->3841 3837 402dcb 21 API calls 3836->3837 3838 402e22 3837->3838 3839 4063ae RegOpenKeyExW 3838->3839 3840 402559 3839->3840 3840->3828 3841->3831 4384 40204f 4385 402dcb 21 API calls 4384->4385 4386 402056 4385->4386 4387 406935 5 API calls 4386->4387 4388 402065 4387->4388 4389 402081 GlobalAlloc 4388->4389 4390 4020f1 4388->4390 4389->4390 4391 402095 4389->4391 4392 406935 5 API calls 4391->4392 4393 40209c 4392->4393 4394 406935 5 API calls 4393->4394 4395 4020a6 4394->4395 4395->4390 4399 406488 wsprintfW 4395->4399 4397 4020df 4400 406488 wsprintfW 4397->4400 4399->4397 4400->4390 4401 403bd1 4402 403bdc 4401->4402 4403 403be0 4402->4403 4404 403be3 GlobalAlloc 4402->4404 4404->4403 4412 401a55 4413 402dcb 21 API calls 4412->4413 4414 401a5e ExpandEnvironmentStringsW 4413->4414 4415 401a72 4414->4415 4416 401a85 4414->4416 4415->4416 4417 401a77 lstrcmpW 4415->4417 4417->4416 4019 4014d7 4020 402da9 21 API calls 4019->4020 4021 4014dd Sleep 4020->4021 4023 402c4f 4021->4023 4423 4023d7 4424 4023df 4423->4424 4427 4023e5 4423->4427 4425 402dcb 21 API calls 4424->4425 4425->4427 4426 4023f3 4429 402401 4426->4429 4430 402dcb 21 API calls 4426->4430 4427->4426 4428 402dcb 21 API calls 4427->4428 4428->4426 4431 402dcb 21 API calls 4429->4431 4430->4429 4432 40240a WritePrivateProfileStringW 4431->4432 4433 402459 4434 402461 4433->4434 4435 40248c 4433->4435 4436 402e0b 21 API calls 4434->4436 4437 402dcb 21 API calls 4435->4437 4438 402468 4436->4438 4439 402493 4437->4439 4441 402dcb 21 API calls 4438->4441 4443 4024a0 4438->4443 4444 402e89 4439->4444 4442 402479 RegDeleteValueW RegCloseKey 4441->4442 4442->4443 4445 402e9d 4444->4445 4447 402e96 4444->4447 4445->4447 4448 402ece 4445->4448 4447->4443 4449 4063ae RegOpenKeyExW 4448->4449 4450 402efc 4449->4450 4451 402f0c RegEnumValueW 4450->4451 4455 402f2f 4450->4455 4459 402fa6 4450->4459 4453 402f96 RegCloseKey 4451->4453 4451->4455 4452 402f6b RegEnumKeyW 4454 402f74 RegCloseKey 4452->4454 4452->4455 4453->4459 4456 406935 5 API calls 4454->4456 4455->4452 4455->4453 4455->4454 4457 402ece 6 API calls 4455->4457 4458 402f84 4456->4458 4457->4455 4458->4459 4460 402f88 RegDeleteKeyW 4458->4460 4459->4447 4460->4459 4461 40175a 4462 402dcb 21 API calls 4461->4462 4463 401761 SearchPathW 4462->4463 4464 40177c 4463->4464 4465 401d5d 4466 402da9 21 API calls 4465->4466 4467 401d64 4466->4467 4468 402da9 21 API calls 4467->4468 4469 401d70 GetDlgItem 4468->4469 4470 40265d 4469->4470 4471 406c5f 4477 406ae3 4471->4477 4472 40744e 4473 406b64 GlobalFree 4474 406b6d GlobalAlloc 4473->4474 4474->4472 4474->4477 4475 406be4 GlobalAlloc 4475->4472 4475->4477 4476 406bdb GlobalFree 4476->4475 4477->4472 4477->4473 4477->4474 4477->4475 4477->4476 4478 402663 4479 402692 4478->4479 4480 402677 4478->4480 4482 4026c2 4479->4482 4483 402697 4479->4483 4481 402da9 21 API calls 4480->4481 4492 40267e 4481->4492 4485 402dcb 21 API calls 4482->4485 4484 402dcb 21 API calls 4483->4484 4486 40269e 4484->4486 4487 4026c9 lstrlenW 4485->4487 4495 406563 WideCharToMultiByte 4486->4495 4487->4492 4489 4026b2 lstrlenA 4489->4492 4490 4026f6 4491 40270c 4490->4491 4493 4060e3 WriteFile 4490->4493 4492->4490 4492->4491 4496 406112 SetFilePointer 4492->4496 4493->4491 4495->4489 4497 40612e 4496->4497 4498 406146 4496->4498 4499 4060b4 ReadFile 4497->4499 4498->4490 4500 40613a 4499->4500 4500->4498 4501 406177 SetFilePointer 4500->4501 4502 40614f SetFilePointer 4500->4502 4501->4498 4502->4501 4503 40615a 4502->4503 4504 4060e3 WriteFile 4503->4504 4504->4498 3502 4015e6 3503 402dcb 21 API calls 3502->3503 3504 4015ed 3503->3504 3521 405ebb CharNextW CharNextW 3504->3521 3506 401656 3508 401688 3506->3508 3509 40165b 3506->3509 3507 405e3d CharNextW 3518 4015f6 3507->3518 3512 401423 28 API calls 3508->3512 3533 401423 3509->3533 3519 401680 3512->3519 3516 40166f SetCurrentDirectoryW 3516->3519 3517 40163c GetFileAttributesW 3517->3518 3518->3506 3518->3507 3518->3517 3527 405b0c 3518->3527 3530 405a95 CreateDirectoryW 3518->3530 3537 405aef CreateDirectoryW 3518->3537 3522 405ed8 3521->3522 3525 405eea 3521->3525 3524 405ee5 CharNextW 3522->3524 3522->3525 3523 405f0e 3523->3518 3524->3523 3525->3523 3526 405e3d CharNextW 3525->3526 3526->3525 3528 406935 5 API calls 3527->3528 3529 405b13 3528->3529 3529->3518 3531 405ae1 3530->3531 3532 405ae5 GetLastError 3530->3532 3531->3518 3532->3531 3534 4055c6 28 API calls 3533->3534 3535 401431 3534->3535 3536 406541 lstrcpynW 3535->3536 3536->3516 3538 405b03 GetLastError 3537->3538 3539 405aff 3537->3539 3538->3539 3539->3518 3540 401966 3541 401968 3540->3541 3542 402dcb 21 API calls 3541->3542 3543 40196d 3542->3543 3546 405c4d 3543->3546 3582 405f18 3546->3582 3549 405c75 DeleteFileW 3551 401976 3549->3551 3550 405c8c 3553 405dac 3550->3553 3596 406541 lstrcpynW 3550->3596 3553->3551 3559 40689e 2 API calls 3553->3559 3554 405cb2 3555 405cc5 3554->3555 3556 405cb8 lstrcatW 3554->3556 3597 405e5c lstrlenW 3555->3597 3557 405ccb 3556->3557 3560 405cdb lstrcatW 3557->3560 3562 405ce6 lstrlenW FindFirstFileW 3557->3562 3561 405dd1 3559->3561 3560->3562 3561->3551 3615 405e10 lstrlenW CharPrevW 3561->3615 3562->3553 3580 405d08 3562->3580 3565 405d8f FindNextFileW 3568 405da5 FindClose 3565->3568 3565->3580 3566 405c05 5 API calls 3569 405de7 3566->3569 3568->3553 3570 405e01 3569->3570 3571 405deb 3569->3571 3573 4055c6 28 API calls 3570->3573 3571->3551 3574 4055c6 28 API calls 3571->3574 3573->3551 3576 405df8 3574->3576 3575 405c4d 64 API calls 3575->3580 3577 406301 40 API calls 3576->3577 3577->3551 3578 4055c6 28 API calls 3578->3565 3579 4055c6 28 API calls 3579->3580 3580->3565 3580->3575 3580->3578 3580->3579 3601 406541 lstrcpynW 3580->3601 3602 405c05 3580->3602 3610 406301 MoveFileExW 3580->3610 3618 406541 lstrcpynW 3582->3618 3584 405f29 3585 405ebb 4 API calls 3584->3585 3586 405f2f 3585->3586 3587 405c6d 3586->3587 3588 4067ef 5 API calls 3586->3588 3587->3549 3587->3550 3594 405f3f 3588->3594 3589 405f70 lstrlenW 3590 405f7b 3589->3590 3589->3594 3591 405e10 3 API calls 3590->3591 3593 405f80 GetFileAttributesW 3591->3593 3592 40689e 2 API calls 3592->3594 3593->3587 3594->3587 3594->3589 3594->3592 3595 405e5c 2 API calls 3594->3595 3595->3589 3596->3554 3598 405e6a 3597->3598 3599 405e70 CharPrevW 3598->3599 3600 405e7c 3598->3600 3599->3598 3599->3600 3600->3557 3601->3580 3619 40600c GetFileAttributesW 3602->3619 3605 405c32 3605->3580 3606 405c20 RemoveDirectoryW 3608 405c2e 3606->3608 3607 405c28 DeleteFileW 3607->3608 3608->3605 3609 405c3e SetFileAttributesW 3608->3609 3609->3605 3611 406324 3610->3611 3612 406315 3610->3612 3611->3580 3622 406187 3612->3622 3616 405ddb 3615->3616 3617 405e2c lstrcatW 3615->3617 3616->3566 3617->3616 3618->3584 3620 405c11 3619->3620 3621 40601e SetFileAttributesW 3619->3621 3620->3605 3620->3606 3620->3607 3621->3620 3623 4061b7 3622->3623 3624 4061dd GetShortPathNameW 3622->3624 3649 406031 GetFileAttributesW CreateFileW 3623->3649 3626 4061f2 3624->3626 3627 4062fc 3624->3627 3626->3627 3629 4061fa wsprintfA 3626->3629 3627->3611 3628 4061c1 CloseHandle GetShortPathNameW 3628->3627 3630 4061d5 3628->3630 3631 40657e 21 API calls 3629->3631 3630->3624 3630->3627 3632 406222 3631->3632 3650 406031 GetFileAttributesW CreateFileW 3632->3650 3634 40622f 3634->3627 3635 40623e GetFileSize GlobalAlloc 3634->3635 3636 406260 3635->3636 3637 4062f5 CloseHandle 3635->3637 3651 4060b4 ReadFile 3636->3651 3637->3627 3642 406293 3644 405f96 4 API calls 3642->3644 3643 40627f lstrcpyA 3645 4062a1 3643->3645 3644->3645 3646 4062d8 SetFilePointer 3645->3646 3658 4060e3 WriteFile 3646->3658 3649->3628 3650->3634 3652 4060d2 3651->3652 3652->3637 3653 405f96 lstrlenA 3652->3653 3654 405fd7 lstrlenA 3653->3654 3655 405fb0 lstrcmpiA 3654->3655 3656 405fdf 3654->3656 3655->3656 3657 405fce CharNextA 3655->3657 3656->3642 3656->3643 3657->3654 3659 406101 GlobalFree 3658->3659 3659->3637 3671 401c68 3672 402da9 21 API calls 3671->3672 3673 401c6f 3672->3673 3674 402da9 21 API calls 3673->3674 3675 401c7c 3674->3675 3676 401c91 3675->3676 3677 402dcb 21 API calls 3675->3677 3678 401ca1 3676->3678 3679 402dcb 21 API calls 3676->3679 3677->3676 3680 401cf8 3678->3680 3681 401cac 3678->3681 3679->3678 3682 402dcb 21 API calls 3680->3682 3683 402da9 21 API calls 3681->3683 3685 401cfd 3682->3685 3684 401cb1 3683->3684 3686 402da9 21 API calls 3684->3686 3687 402dcb 21 API calls 3685->3687 3688 401cbd 3686->3688 3689 401d06 FindWindowExW 3687->3689 3690 401ce8 SendMessageW 3688->3690 3691 401cca SendMessageTimeoutW 3688->3691 3692 401d28 3689->3692 3690->3692 3691->3692 4512 4028e9 4513 4028ef 4512->4513 4514 4028f7 FindClose 4513->4514 4515 402c4f 4513->4515 4514->4515 4516 40496a 4517 4049a0 4516->4517 4518 40497a 4516->4518 4519 404527 8 API calls 4517->4519 4520 4044c0 22 API calls 4518->4520 4522 4049ac 4519->4522 4521 404987 SetDlgItemTextW 4520->4521 4521->4517 4523 4016f1 4524 402dcb 21 API calls 4523->4524 4525 4016f7 GetFullPathNameW 4524->4525 4526 401711 4525->4526 4527 401733 4525->4527 4526->4527 4530 40689e 2 API calls 4526->4530 4528 401748 GetShortPathNameW 4527->4528 4529 402c4f 4527->4529 4528->4529 4531 401723 4530->4531 4531->4527 4533 406541 lstrcpynW 4531->4533 4533->4527 4534 401e73 GetDC 4535 402da9 21 API calls 4534->4535 4536 401e85 GetDeviceCaps MulDiv ReleaseDC 4535->4536 4537 402da9 21 API calls 4536->4537 4538 401eb6 4537->4538 4539 40657e 21 API calls 4538->4539 4540 401ef3 CreateFontIndirectW 4539->4540 4541 40265d 4540->4541 4542 402975 4543 402dcb 21 API calls 4542->4543 4544 402981 4543->4544 4545 402997 4544->4545 4546 402dcb 21 API calls 4544->4546 4547 40600c 2 API calls 4545->4547 4546->4545 4548 40299d 4547->4548 4570 406031 GetFileAttributesW CreateFileW 4548->4570 4550 4029aa 4551 402a60 4550->4551 4552 4029c5 GlobalAlloc 4550->4552 4553 402a48 4550->4553 4554 402a67 DeleteFileW 4551->4554 4555 402a7a 4551->4555 4552->4553 4556 4029de 4552->4556 4557 4032d9 39 API calls 4553->4557 4554->4555 4571 4034d4 SetFilePointer 4556->4571 4559 402a55 CloseHandle 4557->4559 4559->4551 4560 4029e4 4561 4034be ReadFile 4560->4561 4562 4029ed GlobalAlloc 4561->4562 4563 402a31 4562->4563 4564 4029fd 4562->4564 4566 4060e3 WriteFile 4563->4566 4565 4032d9 39 API calls 4564->4565 4569 402a0a 4565->4569 4567 402a3d GlobalFree 4566->4567 4567->4553 4568 402a28 GlobalFree 4568->4563 4569->4568 4570->4550 4571->4560 4572 4014f5 SetForegroundWindow 4573 402c4f 4572->4573 4574 4045f6 lstrcpynW lstrlenW 4575 40197b 4576 402dcb 21 API calls 4575->4576 4577 401982 lstrlenW 4576->4577 4578 40265d 4577->4578 4265 4020fd 4266 4021c1 4265->4266 4267 40210f 4265->4267 4270 401423 28 API calls 4266->4270 4268 402dcb 21 API calls 4267->4268 4269 402116 4268->4269 4271 402dcb 21 API calls 4269->4271 4276 40231b 4270->4276 4272 40211f 4271->4272 4273 402135 LoadLibraryExW 4272->4273 4274 402127 GetModuleHandleW 4272->4274 4273->4266 4275 402146 4273->4275 4274->4273 4274->4275 4287 4069a4 4275->4287 4279 402190 4281 4055c6 28 API calls 4279->4281 4280 402157 4282 402176 KiUserCallbackDispatcher 4280->4282 4283 40215f 4280->4283 4285 402167 4281->4285 4282->4285 4284 401423 28 API calls 4283->4284 4284->4285 4285->4276 4286 4021b3 FreeLibrary 4285->4286 4286->4276 4292 406563 WideCharToMultiByte 4287->4292 4289 4069c1 4290 4069c8 GetProcAddress 4289->4290 4291 402151 4289->4291 4290->4291 4291->4279 4291->4280 4292->4289 4579 402b7e 4580 402bd0 4579->4580 4581 402b85 4579->4581 4582 406935 5 API calls 4580->4582 4584 402da9 21 API calls 4581->4584 4587 402bce 4581->4587 4583 402bd7 4582->4583 4585 402dcb 21 API calls 4583->4585 4586 402b93 4584->4586 4588 402be0 4585->4588 4589 402da9 21 API calls 4586->4589 4588->4587 4590 402be4 IIDFromString 4588->4590 4591 402b9f 4589->4591 4590->4587 4592 402bf3 4590->4592 4596 406488 wsprintfW 4591->4596 4592->4587 4597 406541 lstrcpynW 4592->4597 4594 402c10 CoTaskMemFree 4594->4587 4596->4587 4597->4594 4293 40467f 4294 404697 4293->4294 4300 4047b1 4293->4300 4298 4044c0 22 API calls 4294->4298 4295 40481b 4296 4048e5 4295->4296 4297 404825 GetDlgItem 4295->4297 4303 404527 8 API calls 4296->4303 4299 40483f 4297->4299 4304 4048a6 4297->4304 4302 4046fe 4298->4302 4299->4304 4308 404865 SendMessageW LoadCursorW SetCursor 4299->4308 4300->4295 4300->4296 4301 4047ec GetDlgItem SendMessageW 4300->4301 4326 4044e2 KiUserCallbackDispatcher 4301->4326 4306 4044c0 22 API calls 4302->4306 4307 4048e0 4303->4307 4304->4296 4309 4048b8 4304->4309 4311 40470b CheckDlgButton 4306->4311 4327 40492e 4308->4327 4313 4048ce 4309->4313 4314 4048be SendMessageW 4309->4314 4310 404816 4316 40490a SendMessageW 4310->4316 4324 4044e2 KiUserCallbackDispatcher 4311->4324 4313->4307 4315 4048d4 SendMessageW 4313->4315 4314->4313 4315->4307 4316->4295 4319 404729 GetDlgItem 4325 4044f5 SendMessageW 4319->4325 4321 40473f SendMessageW 4322 404765 SendMessageW SendMessageW lstrlenW SendMessageW SendMessageW 4321->4322 4323 40475c GetSysColor 4321->4323 4322->4307 4323->4322 4324->4319 4325->4321 4326->4310 4330 405b67 ShellExecuteExW 4327->4330 4329 404894 LoadCursorW SetCursor 4329->4304 4330->4329 4605 401000 4606 401037 BeginPaint GetClientRect 4605->4606 4607 40100c DefWindowProcW 4605->4607 4609 4010f3 4606->4609 4610 401179 4607->4610 4611 401073 CreateBrushIndirect FillRect DeleteObject 4609->4611 4612 4010fc 4609->4612 4611->4609 4613 401102 CreateFontIndirectW 4612->4613 4614 401167 EndPaint 4612->4614 4613->4614 4615 401112 6 API calls 4613->4615 4614->4610 4615->4614 4616 402a80 4617 402da9 21 API calls 4616->4617 4618 402a86 4617->4618 4619 402ac9 4618->4619 4620 402aad 4618->4620 4626 402953 4618->4626 4623 402ae3 4619->4623 4624 402ad3 4619->4624 4621 402ab2 4620->4621 4622 402ac3 4620->4622 4630 406541 lstrcpynW 4621->4630 4622->4626 4631 406488 wsprintfW 4622->4631 4627 40657e 21 API calls 4623->4627 4625 402da9 21 API calls 4624->4625 4625->4622 4627->4622 4630->4626 4631->4626 3391 401781 3397 402dcb 3391->3397 3395 40178f 3396 406060 2 API calls 3395->3396 3396->3395 3398 402dd7 3397->3398 3399 40657e 21 API calls 3398->3399 3400 402df8 3399->3400 3401 401788 3400->3401 3402 4067ef 5 API calls 3400->3402 3403 406060 3401->3403 3402->3401 3404 40606d GetTickCount GetTempFileNameW 3403->3404 3405 4060a7 3404->3405 3406 4060a3 3404->3406 3405->3395 3406->3404 3406->3405 4632 401d82 4633 402da9 21 API calls 4632->4633 4634 401d93 SetWindowLongW 4633->4634 4635 402c4f 4634->4635 3407 401f03 3415 402da9 3407->3415 3409 401f09 3410 402da9 21 API calls 3409->3410 3411 401f15 3410->3411 3412 401f21 ShowWindow 3411->3412 3413 401f2c EnableWindow 3411->3413 3414 402c4f 3412->3414 3413->3414 3416 40657e 21 API calls 3415->3416 3417 402dbe 3416->3417 3417->3409 4636 401503 4637 401508 4636->4637 4639 40152e 4636->4639 4638 402da9 21 API calls 4637->4638 4638->4639 4640 402903 4641 40290b 4640->4641 4642 40290f FindNextFileW 4641->4642 4643 402921 4641->4643 4642->4643 4644 402968 4642->4644 4646 406541 lstrcpynW 4644->4646 4646->4643 3447 405705 3448 405726 GetDlgItem GetDlgItem GetDlgItem 3447->3448 3449 4058af 3447->3449 3492 4044f5 SendMessageW 3448->3492 3451 4058e0 3449->3451 3452 4058b8 GetDlgItem CreateThread CloseHandle 3449->3452 3454 40590b 3451->3454 3455 405930 3451->3455 3456 4058f7 ShowWindow ShowWindow 3451->3456 3452->3451 3495 405699 OleInitialize 3452->3495 3453 405796 3459 40579d GetClientRect GetSystemMetrics SendMessageW SendMessageW 3453->3459 3457 40596b 3454->3457 3461 405945 ShowWindow 3454->3461 3462 40591f 3454->3462 3458 404527 8 API calls 3455->3458 3494 4044f5 SendMessageW 3456->3494 3457->3455 3467 405979 SendMessageW 3457->3467 3474 40593e 3458->3474 3465 40580b 3459->3465 3466 4057ef SendMessageW SendMessageW 3459->3466 3463 405965 3461->3463 3464 405957 3461->3464 3468 404499 SendMessageW 3462->3468 3470 404499 SendMessageW 3463->3470 3469 4055c6 28 API calls 3464->3469 3471 405810 SendMessageW 3465->3471 3472 40581e 3465->3472 3466->3465 3473 405992 CreatePopupMenu 3467->3473 3467->3474 3468->3455 3469->3463 3470->3457 3471->3472 3476 4044c0 22 API calls 3472->3476 3475 40657e 21 API calls 3473->3475 3477 4059a2 AppendMenuW 3475->3477 3478 40582e 3476->3478 3479 4059d2 TrackPopupMenu 3477->3479 3480 4059bf GetWindowRect 3477->3480 3481 405837 ShowWindow 3478->3481 3482 40586b GetDlgItem SendMessageW 3478->3482 3479->3474 3484 4059ed 3479->3484 3480->3479 3485 40585a 3481->3485 3486 40584d ShowWindow 3481->3486 3482->3474 3483 405892 SendMessageW SendMessageW 3482->3483 3483->3474 3487 405a09 SendMessageW 3484->3487 3493 4044f5 SendMessageW 3485->3493 3486->3485 3487->3487 3488 405a26 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 3487->3488 3490 405a4b SendMessageW 3488->3490 3490->3490 3491 405a74 GlobalUnlock SetClipboardData CloseClipboard 3490->3491 3491->3474 3492->3453 3493->3482 3494->3454 3496 40450c SendMessageW 3495->3496 3501 4056bc 3496->3501 3497 4056e3 3498 40450c SendMessageW 3497->3498 3499 4056f5 CoUninitialize 3498->3499 3500 401389 2 API calls 3500->3501 3501->3497 3501->3500 4647 404d07 4648 404d33 4647->4648 4649 404d17 4647->4649 4651 404d66 4648->4651 4652 404d39 SHGetPathFromIDListW 4648->4652 4658 405b85 GetDlgItemTextW 4649->4658 4654 404d49 4652->4654 4657 404d50 SendMessageW 4652->4657 4653 404d24 SendMessageW 4653->4648 4655 40140b 2 API calls 4654->4655 4655->4657 4657->4651 4658->4653 4659 401588 4660 402bc9 4659->4660 4663 406488 wsprintfW 4660->4663 4662 402bce 4663->4662 4664 40198d 4665 402da9 21 API calls 4664->4665 4666 401994 4665->4666 4667 402da9 21 API calls 4666->4667 4668 4019a1 4667->4668 4669 402dcb 21 API calls 4668->4669 4670 4019b8 lstrlenW 4669->4670 4672 4019c9 4670->4672 4671 401a0a 4672->4671 4676 406541 lstrcpynW 4672->4676 4674 4019fa 4674->4671 4675 4019ff lstrlenW 4674->4675 4675->4671 4676->4674 4677 40168f 4678 402dcb 21 API calls 4677->4678 4679 401695 4678->4679 4680 40689e 2 API calls 4679->4680 4681 40169b 4680->4681 4682 402b10 4683 402da9 21 API calls 4682->4683 4684 402b16 4683->4684 4685 402953 4684->4685 4686 40657e 21 API calls 4684->4686 4686->4685 4687 402711 4688 402da9 21 API calls 4687->4688 4695 402720 4688->4695 4689 40276a ReadFile 4689->4695 4699 40285d 4689->4699 4690 4060b4 ReadFile 4690->4695 4691 4027aa MultiByteToWideChar 4691->4695 4692 40285f 4700 406488 wsprintfW 4692->4700 4693 406112 5 API calls 4693->4695 4695->4689 4695->4690 4695->4691 4695->4692 4695->4693 4696 4027d0 SetFilePointer MultiByteToWideChar 4695->4696 4697 402870 4695->4697 4695->4699 4696->4695 4698 402891 SetFilePointer 4697->4698 4697->4699 4698->4699 4700->4699 4701 401491 4702 4055c6 28 API calls 4701->4702 4703 401498 4702->4703 3974 401794 3975 402dcb 21 API calls 3974->3975 3976 40179b 3975->3976 3977 4017c3 3976->3977 3978 4017bb 3976->3978 4014 406541 lstrcpynW 3977->4014 4013 406541 lstrcpynW 3978->4013 3981 4017c1 3985 4067ef 5 API calls 3981->3985 3982 4017ce 3983 405e10 3 API calls 3982->3983 3984 4017d4 lstrcatW 3983->3984 3984->3981 4007 4017e0 3985->4007 3986 40689e 2 API calls 3986->4007 3987 40600c 2 API calls 3987->4007 3989 4017f2 CompareFileTime 3989->4007 3990 4018b2 3992 4055c6 28 API calls 3990->3992 3991 401889 3993 4055c6 28 API calls 3991->3993 4001 40189e 3991->4001 3994 4018bc 3992->3994 3993->4001 3995 4032d9 39 API calls 3994->3995 3996 4018cf 3995->3996 3997 4018e3 SetFileTime 3996->3997 3998 4018f5 CloseHandle 3996->3998 3997->3998 4000 401906 3998->4000 3998->4001 3999 40657e 21 API calls 3999->4007 4002 40190b 4000->4002 4003 40191e 4000->4003 4005 40657e 21 API calls 4002->4005 4006 40657e 21 API calls 4003->4006 4004 406541 lstrcpynW 4004->4007 4009 401913 lstrcatW 4005->4009 4010 401926 4006->4010 4007->3986 4007->3987 4007->3989 4007->3990 4007->3991 4007->3999 4007->4004 4012 406031 GetFileAttributesW CreateFileW 4007->4012 4015 405ba1 4007->4015 4009->4010 4011 405ba1 MessageBoxIndirectW 4010->4011 4011->4001 4012->4007 4013->3981 4014->3982 4016 405bb6 4015->4016 4017 405c02 4016->4017 4018 405bca MessageBoxIndirectW 4016->4018 4017->4007 4018->4017 4718 401a97 4719 402da9 21 API calls 4718->4719 4720 401aa0 4719->4720 4721 402da9 21 API calls 4720->4721 4722 401a45 4721->4722 4723 401598 4724 4015b1 4723->4724 4725 4015a8 ShowWindow 4723->4725 4726 402c4f 4724->4726 4727 4015bf ShowWindow 4724->4727 4725->4724 4727->4726 4728 402419 4729 402dcb 21 API calls 4728->4729 4730 402428 4729->4730 4731 402dcb 21 API calls 4730->4731 4732 402431 4731->4732 4733 402dcb 21 API calls 4732->4733 4734 40243b GetPrivateProfileStringW 4733->4734 4735 40201b 4736 402dcb 21 API calls 4735->4736 4737 402022 4736->4737 4738 40689e 2 API calls 4737->4738 4739 402028 4738->4739 4741 402039 4739->4741 4742 406488 wsprintfW 4739->4742 4742->4741 4049 40351c SetErrorMode GetVersionExW 4050 403570 GetVersionExW 4049->4050 4051 4035a8 4049->4051 4050->4051 4052 4035ff 4051->4052 4053 406935 5 API calls 4051->4053 4054 4068c5 3 API calls 4052->4054 4053->4052 4055 403615 lstrlenA 4054->4055 4055->4052 4056 403625 4055->4056 4057 406935 5 API calls 4056->4057 4058 40362c 4057->4058 4059 406935 5 API calls 4058->4059 4060 403633 4059->4060 4061 406935 5 API calls 4060->4061 4062 40363f #17 OleInitialize SHGetFileInfoW 4061->4062 4137 406541 lstrcpynW 4062->4137 4065 40368e GetCommandLineW 4138 406541 lstrcpynW 4065->4138 4067 4036a0 4068 405e3d CharNextW 4067->4068 4069 4036c6 CharNextW 4068->4069 4077 4036d8 4069->4077 4070 4037da 4071 4037ee GetTempPathW 4070->4071 4139 4034eb 4071->4139 4073 403806 4074 403860 DeleteFileW 4073->4074 4075 40380a GetWindowsDirectoryW lstrcatW 4073->4075 4149 4030a2 GetTickCount GetModuleFileNameW 4074->4149 4078 4034eb 12 API calls 4075->4078 4076 405e3d CharNextW 4076->4077 4077->4070 4077->4076 4083 4037dc 4077->4083 4080 403826 4078->4080 4080->4074 4082 40382a GetTempPathW lstrcatW SetEnvironmentVariableW SetEnvironmentVariableW 4080->4082 4081 403874 4084 403a67 ExitProcess OleUninitialize 4081->4084 4088 40391b 4081->4088 4092 405e3d CharNextW 4081->4092 4085 4034eb 12 API calls 4082->4085 4233 406541 lstrcpynW 4083->4233 4086 403a79 4084->4086 4087 403a9d 4084->4087 4090 403858 4085->4090 4091 405ba1 MessageBoxIndirectW 4086->4091 4093 403b21 ExitProcess 4087->4093 4094 403aa5 GetCurrentProcess OpenProcessToken 4087->4094 4177 403c13 4088->4177 4090->4074 4090->4084 4100 403a87 ExitProcess 4091->4100 4105 403893 4092->4105 4096 403af1 4094->4096 4097 403abd LookupPrivilegeValueW AdjustTokenPrivileges 4094->4097 4101 406935 5 API calls 4096->4101 4097->4096 4098 40392b 4098->4084 4102 403af8 4101->4102 4107 403b0d ExitWindowsEx 4102->4107 4110 403b1a 4102->4110 4103 4038f1 4108 405f18 18 API calls 4103->4108 4104 403934 4106 405b0c 5 API calls 4104->4106 4105->4103 4105->4104 4109 403939 lstrlenW 4106->4109 4107->4093 4107->4110 4111 4038fd 4108->4111 4236 406541 lstrcpynW 4109->4236 4113 40140b 2 API calls 4110->4113 4111->4084 4234 406541 lstrcpynW 4111->4234 4113->4093 4114 403953 4116 40396b 4114->4116 4237 406541 lstrcpynW 4114->4237 4120 403991 wsprintfW 4116->4120 4134 4039bd 4116->4134 4117 403910 4235 406541 lstrcpynW 4117->4235 4121 40657e 21 API calls 4120->4121 4121->4116 4122 405aef 2 API calls 4122->4134 4123 405a95 2 API calls 4123->4134 4124 403a07 SetCurrentDirectoryW 4127 406301 40 API calls 4124->4127 4125 4039cd GetFileAttributesW 4126 4039d9 DeleteFileW 4125->4126 4125->4134 4126->4134 4129 403a16 CopyFileW 4127->4129 4128 403a05 4128->4084 4129->4128 4129->4134 4130 405c4d 71 API calls 4130->4134 4131 406301 40 API calls 4131->4134 4132 40657e 21 API calls 4132->4134 4133 405b24 2 API calls 4133->4134 4134->4116 4134->4120 4134->4122 4134->4123 4134->4124 4134->4125 4134->4128 4134->4130 4134->4131 4134->4132 4134->4133 4135 403a8f CloseHandle 4134->4135 4136 40689e 2 API calls 4134->4136 4135->4128 4136->4134 4137->4065 4138->4067 4140 4067ef 5 API calls 4139->4140 4141 4034f7 4140->4141 4142 403501 4141->4142 4143 405e10 3 API calls 4141->4143 4142->4073 4144 403509 4143->4144 4145 405aef 2 API calls 4144->4145 4146 40350f 4145->4146 4147 406060 2 API calls 4146->4147 4148 40351a 4147->4148 4148->4073 4238 406031 GetFileAttributesW CreateFileW 4149->4238 4151 4030e2 4172 4030f2 4151->4172 4239 406541 lstrcpynW 4151->4239 4153 403108 4154 405e5c 2 API calls 4153->4154 4155 40310e 4154->4155 4240 406541 lstrcpynW 4155->4240 4157 403119 GetFileSize 4158 403213 4157->4158 4169 403130 4157->4169 4241 40303e 4158->4241 4160 40321c 4162 40324c GlobalAlloc 4160->4162 4160->4172 4253 4034d4 SetFilePointer 4160->4253 4161 4034be ReadFile 4161->4169 4252 4034d4 SetFilePointer 4162->4252 4163 40327f 4167 40303e 6 API calls 4163->4167 4166 403267 4171 4032d9 39 API calls 4166->4171 4167->4172 4168 403235 4170 4034be ReadFile 4168->4170 4169->4158 4169->4161 4169->4163 4169->4172 4173 40303e 6 API calls 4169->4173 4174 403240 4170->4174 4175 403273 4171->4175 4172->4081 4173->4169 4174->4162 4174->4172 4175->4172 4175->4175 4176 4032b0 SetFilePointer 4175->4176 4176->4172 4178 406935 5 API calls 4177->4178 4179 403c27 4178->4179 4180 403c2d 4179->4180 4181 403c3f 4179->4181 4262 406488 wsprintfW 4180->4262 4182 40640f 3 API calls 4181->4182 4183 403c6f 4182->4183 4185 403c8e lstrcatW 4183->4185 4187 40640f 3 API calls 4183->4187 4186 403c3d 4185->4186 4254 403ee9 4186->4254 4187->4185 4190 405f18 18 API calls 4191 403cc0 4190->4191 4192 403d54 4191->4192 4194 40640f 3 API calls 4191->4194 4193 405f18 18 API calls 4192->4193 4195 403d5a 4193->4195 4196 403cf2 4194->4196 4197 403d6a LoadImageW 4195->4197 4198 40657e 21 API calls 4195->4198 4196->4192 4201 403d13 lstrlenW 4196->4201 4205 405e3d CharNextW 4196->4205 4199 403e10 4197->4199 4200 403d91 RegisterClassW 4197->4200 4198->4197 4203 40140b 2 API calls 4199->4203 4202 403dc7 SystemParametersInfoW CreateWindowExW 4200->4202 4232 403e1a 4200->4232 4206 403d21 lstrcmpiW 4201->4206 4207 403d47 4201->4207 4202->4199 4204 403e16 4203->4204 4211 403ee9 22 API calls 4204->4211 4204->4232 4209 403d10 4205->4209 4206->4207 4210 403d31 GetFileAttributesW 4206->4210 4208 405e10 3 API calls 4207->4208 4212 403d4d 4208->4212 4209->4201 4213 403d3d 4210->4213 4215 403e27 4211->4215 4263 406541 lstrcpynW 4212->4263 4213->4207 4214 405e5c 2 API calls 4213->4214 4214->4207 4217 403e33 ShowWindow 4215->4217 4218 403eb6 4215->4218 4220 4068c5 3 API calls 4217->4220 4219 405699 5 API calls 4218->4219 4221 403ebc 4219->4221 4222 403e4b 4220->4222 4223 403ec0 4221->4223 4224 403ed8 4221->4224 4225 403e59 GetClassInfoW 4222->4225 4227 4068c5 3 API calls 4222->4227 4230 40140b 2 API calls 4223->4230 4223->4232 4226 40140b 2 API calls 4224->4226 4228 403e83 DialogBoxParamW 4225->4228 4229 403e6d GetClassInfoW RegisterClassW 4225->4229 4226->4232 4227->4225 4231 40140b 2 API calls 4228->4231 4229->4228 4230->4232 4231->4232 4232->4098 4233->4071 4234->4117 4235->4088 4236->4114 4237->4116 4238->4151 4239->4153 4240->4157 4242 403047 4241->4242 4243 40305f 4241->4243 4244 403050 DestroyWindow 4242->4244 4245 403057 4242->4245 4246 403067 4243->4246 4247 40306f GetTickCount 4243->4247 4244->4245 4245->4160 4250 406971 2 API calls 4246->4250 4248 4030a0 4247->4248 4249 40307d CreateDialogParamW ShowWindow 4247->4249 4248->4160 4249->4248 4251 40306d 4250->4251 4251->4160 4252->4166 4253->4168 4255 403efd 4254->4255 4264 406488 wsprintfW 4255->4264 4257 403f6e 4258 403fa2 22 API calls 4257->4258 4260 403f73 4258->4260 4259 403c9e 4259->4190 4260->4259 4261 40657e 21 API calls 4260->4261 4261->4260 4262->4186 4263->4192 4264->4257 4750 401b9c 4751 402dcb 21 API calls 4750->4751 4752 401ba3 4751->4752 4753 402da9 21 API calls 4752->4753 4754 401bac wsprintfW 4753->4754 4755 402c4f 4754->4755 4756 40149e 4757 4023c2 4756->4757 4758 4014ac PostQuitMessage 4756->4758 4758->4757 4759 4016a0 4760 402dcb 21 API calls 4759->4760 4761 4016a7 4760->4761 4762 402dcb 21 API calls 4761->4762 4763 4016b0 4762->4763 4764 402dcb 21 API calls 4763->4764 4765 4016b9 MoveFileW 4764->4765 4766 4016cc 4765->4766 4772 4016c5 4765->4772 4767 40689e 2 API calls 4766->4767 4770 40231b 4766->4770 4769 4016db 4767->4769 4768 401423 28 API calls 4768->4770 4769->4770 4771 406301 40 API calls 4769->4771 4771->4772 4772->4768 3418 402324 3419 402dcb 21 API calls 3418->3419 3420 40232a 3419->3420 3421 402dcb 21 API calls 3420->3421 3422 402333 3421->3422 3423 402dcb 21 API calls 3422->3423 3424 40233c 3423->3424 3433 40689e FindFirstFileW 3424->3433 3427 402356 lstrlenW lstrlenW 3436 4055c6 3427->3436 3429 4055c6 28 API calls 3432 402351 3429->3432 3431 402349 3431->3429 3431->3432 3434 4068b4 FindClose 3433->3434 3435 402345 3433->3435 3434->3435 3435->3427 3435->3431 3437 4055e1 3436->3437 3438 402394 SHFileOperationW 3436->3438 3439 4055fd lstrlenW 3437->3439 3442 40657e 21 API calls 3437->3442 3438->3431 3438->3432 3440 405626 3439->3440 3441 40560b lstrlenW 3439->3441 3444 405639 3440->3444 3445 40562c SetWindowTextW 3440->3445 3441->3438 3443 40561d lstrcatW 3441->3443 3442->3439 3443->3440 3444->3438 3446 40563f SendMessageW SendMessageW SendMessageW 3444->3446 3445->3444 3446->3438 4773 401a24 4774 402dcb 21 API calls 4773->4774 4775 401a2b 4774->4775 4776 402dcb 21 API calls 4775->4776 4777 401a34 4776->4777 4778 401a3b lstrcmpiW 4777->4778 4779 401a4d lstrcmpW 4777->4779 4780 401a41 4778->4780 4779->4780 3660 401da6 3661 401db9 GetDlgItem 3660->3661 3662 401dac 3660->3662 3663 401db3 3661->3663 3664 402da9 21 API calls 3662->3664 3665 401dfa GetClientRect LoadImageW SendMessageW 3663->3665 3666 402dcb 21 API calls 3663->3666 3664->3663 3668 401e58 3665->3668 3670 401e64 3665->3670 3666->3665 3669 401e5d DeleteObject 3668->3669 3668->3670 3669->3670 4781 4023a8 4782 4023c2 4781->4782 4783 4023af 4781->4783 4784 40657e 21 API calls 4783->4784 4785 4023bc 4784->4785 4786 405ba1 MessageBoxIndirectW 4785->4786 4786->4782 3721 402c2a SendMessageW 3722 402c44 InvalidateRect 3721->3722 3723 402c4f 3721->3723 3722->3723 3724 404f2d GetDlgItem GetDlgItem 3725 404f7f 7 API calls 3724->3725 3729 4051a4 3724->3729 3726 405026 DeleteObject 3725->3726 3727 405019 SendMessageW 3725->3727 3728 40502f 3726->3728 3727->3726 3730 405066 3728->3730 3732 40657e 21 API calls 3728->3732 3736 405267 3729->3736 3739 405202 3729->3739 3743 405286 3729->3743 3733 4044c0 22 API calls 3730->3733 3731 405332 3737 405344 3731->3737 3738 40533c SendMessageW 3731->3738 3740 405048 SendMessageW SendMessageW 3732->3740 3734 40507a 3733->3734 3741 4044c0 22 API calls 3734->3741 3735 405525 3745 404527 8 API calls 3735->3745 3736->3743 3744 405278 SendMessageW 3736->3744 3750 405356 ImageList_Destroy 3737->3750 3751 40535d 3737->3751 3755 40536d 3737->3755 3738->3737 3781 404e7b SendMessageW 3739->3781 3740->3728 3759 40508b 3741->3759 3742 4052df SendMessageW 3742->3735 3748 4052f4 SendMessageW 3742->3748 3743->3731 3743->3735 3743->3742 3744->3743 3749 405533 3745->3749 3747 4054e7 3747->3735 3756 4054f9 ShowWindow GetDlgItem ShowWindow 3747->3756 3754 405307 3748->3754 3750->3751 3752 405366 GlobalFree 3751->3752 3751->3755 3752->3755 3753 405166 GetWindowLongW SetWindowLongW 3757 40517f 3753->3757 3764 405318 SendMessageW 3754->3764 3755->3747 3774 4053a8 3755->3774 3786 404efb 3755->3786 3756->3735 3760 405184 ShowWindow 3757->3760 3761 40519c 3757->3761 3758 405213 3758->3736 3759->3753 3763 4050de SendMessageW 3759->3763 3765 405161 3759->3765 3767 405130 SendMessageW 3759->3767 3768 40511c SendMessageW 3759->3768 3779 4044f5 SendMessageW 3760->3779 3780 4044f5 SendMessageW 3761->3780 3763->3759 3764->3731 3765->3753 3765->3757 3767->3759 3768->3759 3770 405197 3770->3735 3771 4054b2 3772 4054bd InvalidateRect 3771->3772 3775 4054c9 3771->3775 3772->3775 3773 4053d6 SendMessageW 3778 4053ec 3773->3778 3774->3773 3774->3778 3775->3747 3795 404e36 3775->3795 3777 405460 SendMessageW SendMessageW 3777->3778 3778->3771 3778->3777 3779->3770 3780->3729 3782 404eda SendMessageW 3781->3782 3783 404e9e GetMessagePos ScreenToClient SendMessageW 3781->3783 3784 404ed2 3782->3784 3783->3784 3785 404ed7 3783->3785 3784->3758 3785->3782 3798 406541 lstrcpynW 3786->3798 3788 404f0e 3799 406488 wsprintfW 3788->3799 3790 404f18 3791 40140b 2 API calls 3790->3791 3792 404f21 3791->3792 3800 406541 lstrcpynW 3792->3800 3794 404f28 3794->3774 3801 404d6d 3795->3801 3797 404e4b 3797->3747 3798->3788 3799->3790 3800->3794 3802 404d86 3801->3802 3803 40657e 21 API calls 3802->3803 3804 404dea 3803->3804 3805 40657e 21 API calls 3804->3805 3806 404df5 3805->3806 3807 40657e 21 API calls 3806->3807 3808 404e0b lstrlenW wsprintfW SetDlgItemTextW 3807->3808 3808->3797 3842 4024af 3843 402dcb 21 API calls 3842->3843 3844 4024c1 3843->3844 3845 402dcb 21 API calls 3844->3845 3846 4024cb 3845->3846 3859 402e5b 3846->3859 3849 402953 3850 402503 3851 40250f 3850->3851 3854 402da9 21 API calls 3850->3854 3855 40252e RegSetValueExW 3851->3855 3863 4032d9 3851->3863 3852 402dcb 21 API calls 3853 4024f9 lstrlenW 3852->3853 3853->3850 3854->3851 3857 402544 RegCloseKey 3855->3857 3857->3849 3860 402e76 3859->3860 3884 4063dc 3860->3884 3864 4032f2 3863->3864 3865 40331d 3864->3865 3898 4034d4 SetFilePointer 3864->3898 3888 4034be 3865->3888 3869 40333a GetTickCount 3880 40334d 3869->3880 3870 40345e 3871 403462 3870->3871 3875 40347a 3870->3875 3873 4034be ReadFile 3871->3873 3872 403448 3872->3855 3873->3872 3874 4034be ReadFile 3874->3875 3875->3872 3875->3874 3877 4060e3 WriteFile 3875->3877 3876 4034be ReadFile 3876->3880 3877->3875 3879 4033b3 GetTickCount 3879->3880 3880->3872 3880->3876 3880->3879 3881 4033dc MulDiv wsprintfW 3880->3881 3883 4060e3 WriteFile 3880->3883 3891 406ab0 3880->3891 3882 4055c6 28 API calls 3881->3882 3882->3880 3883->3880 3885 4063eb 3884->3885 3886 4063f6 RegCreateKeyExW 3885->3886 3887 4024db 3885->3887 3886->3887 3887->3849 3887->3850 3887->3852 3889 4060b4 ReadFile 3888->3889 3890 403328 3889->3890 3890->3869 3890->3870 3890->3872 3892 406ad5 3891->3892 3893 406add 3891->3893 3892->3880 3893->3892 3894 406b64 GlobalFree 3893->3894 3895 406b6d GlobalAlloc 3893->3895 3896 406be4 GlobalAlloc 3893->3896 3897 406bdb GlobalFree 3893->3897 3894->3895 3895->3892 3895->3893 3896->3892 3896->3893 3897->3896 3898->3865 4794 404630 lstrlenW 4795 404651 WideCharToMultiByte 4794->4795 4796 40464f 4794->4796 4796->4795 4797 402930 4798 402dcb 21 API calls 4797->4798 4799 402937 FindFirstFileW 4798->4799 4800 40295f 4799->4800 4804 40294a 4799->4804 4802 402968 4800->4802 4805 406488 wsprintfW 4800->4805 4806 406541 lstrcpynW 4802->4806 4805->4802 4806->4804 3899 4049b1 3900 4049dd 3899->3900 3901 4049ee 3899->3901 3968 405b85 GetDlgItemTextW 3900->3968 3903 4049fa GetDlgItem 3901->3903 3910 404a66 3901->3910 3905 404a0e 3903->3905 3904 4049e8 3907 4067ef 5 API calls 3904->3907 3908 404a22 SetWindowTextW 3905->3908 3916 405ebb 4 API calls 3905->3916 3906 404b3d 3909 404cec 3906->3909 3966 405b85 GetDlgItemTextW 3906->3966 3907->3901 3914 4044c0 22 API calls 3908->3914 3915 404527 8 API calls 3909->3915 3910->3906 3910->3909 3912 40657e 21 API calls 3910->3912 3917 404acd SHBrowseForFolderW 3912->3917 3913 404b6d 3918 405f18 18 API calls 3913->3918 3919 404a3e 3914->3919 3920 404d00 3915->3920 3921 404a18 3916->3921 3917->3906 3922 404ae5 CoTaskMemFree 3917->3922 3923 404b73 3918->3923 3924 4044c0 22 API calls 3919->3924 3921->3908 3927 405e10 3 API calls 3921->3927 3925 405e10 3 API calls 3922->3925 3967 406541 lstrcpynW 3923->3967 3926 404a4c 3924->3926 3928 404af2 3925->3928 3965 4044f5 SendMessageW 3926->3965 3927->3908 3931 404b29 SetDlgItemTextW 3928->3931 3936 40657e 21 API calls 3928->3936 3931->3906 3932 404b8a 3934 406935 5 API calls 3932->3934 3933 404a52 3935 406935 5 API calls 3933->3935 3945 404b91 3934->3945 3937 404a59 3935->3937 3938 404b11 lstrcmpiW 3936->3938 3937->3909 3940 404a61 SHAutoComplete 3937->3940 3938->3931 3942 404b22 lstrcatW 3938->3942 3939 404bd2 3969 406541 lstrcpynW 3939->3969 3940->3910 3942->3931 3943 404ba0 GetDiskFreeSpaceExW 3943->3945 3953 404c2a 3943->3953 3944 404bd9 3946 405ebb 4 API calls 3944->3946 3945->3939 3945->3943 3948 405e5c 2 API calls 3945->3948 3947 404bdf 3946->3947 3949 404be5 3947->3949 3950 404be8 GetDiskFreeSpaceW 3947->3950 3948->3945 3949->3950 3951 404c03 MulDiv 3950->3951 3950->3953 3951->3953 3952 404c9b 3955 404cbe 3952->3955 3957 40140b 2 API calls 3952->3957 3953->3952 3954 404e36 24 API calls 3953->3954 3956 404c88 3954->3956 3970 4044e2 KiUserCallbackDispatcher 3955->3970 3959 404c9d SetDlgItemTextW 3956->3959 3960 404c8d 3956->3960 3957->3955 3959->3952 3962 404d6d 24 API calls 3960->3962 3961 404cda 3961->3909 3963 404ce7 3961->3963 3962->3952 3971 40490a 3963->3971 3965->3933 3966->3913 3967->3932 3968->3904 3969->3944 3970->3961 3972 404918 3971->3972 3973 40491d SendMessageW 3971->3973 3972->3973 3973->3909 4807 401931 4808 401968 4807->4808 4809 402dcb 21 API calls 4808->4809 4810 40196d 4809->4810 4811 405c4d 71 API calls 4810->4811 4812 401976 4811->4812 4813 401934 4814 402dcb 21 API calls 4813->4814 4815 40193b 4814->4815 4816 405ba1 MessageBoxIndirectW 4815->4816 4817 401944 4816->4817 4818 4028b6 4819 4028bd 4818->4819 4822 402bce 4818->4822 4820 402da9 21 API calls 4819->4820 4821 4028c4 4820->4821 4823 4028d3 SetFilePointer 4821->4823 4823->4822 4824 4028e3 4823->4824 4826 406488 wsprintfW 4824->4826 4826->4822 4827 401f37 4828 402dcb 21 API calls 4827->4828 4829 401f3d 4828->4829 4830 402dcb 21 API calls 4829->4830 4831 401f46 4830->4831 4832 402dcb 21 API calls 4831->4832 4833 401f4f 4832->4833 4834 402dcb 21 API calls 4833->4834 4835 401f58 4834->4835 4836 401423 28 API calls 4835->4836 4837 401f5f 4836->4837 4844 405b67 ShellExecuteExW 4837->4844 4839 401fa7 4840 4069e0 5 API calls 4839->4840 4841 402953 4839->4841 4842 401fc4 CloseHandle 4840->4842 4842->4841 4844->4839 4845 402fb8 4846 402fe3 4845->4846 4847 402fca SetTimer 4845->4847 4848 403038 4846->4848 4849 402ffd MulDiv wsprintfW SetWindowTextW SetDlgItemTextW 4846->4849 4847->4846 4849->4848 4850 4014b8 4851 4014be 4850->4851 4852 401389 2 API calls 4851->4852 4853 4014c6 4852->4853 4024 403b39 4025 403b51 4024->4025 4026 403b43 CloseHandle 4024->4026 4031 403b7e 4025->4031 4026->4025 4029 405c4d 71 API calls 4030 403b62 4029->4030 4032 403b8c 4031->4032 4033 403b56 4032->4033 4034 403b91 FreeLibrary GlobalFree 4032->4034 4033->4029 4034->4033 4034->4034 4035 40553a 4036 40554a 4035->4036 4037 40555e 4035->4037 4039 405550 4036->4039 4040 4055a7 4036->4040 4038 405566 IsWindowVisible 4037->4038 4047 405586 4037->4047 4038->4040 4041 405573 4038->4041 4043 40450c SendMessageW 4039->4043 4042 4055ac CallWindowProcW 4040->4042 4044 404e7b 5 API calls 4041->4044 4045 40555a 4042->4045 4043->4045 4046 40557d 4044->4046 4046->4047 4047->4042 4048 404efb 4 API calls 4047->4048 4048->4040 4854 401d3c 4855 402da9 21 API calls 4854->4855 4856 401d42 IsWindow 4855->4856 4857 401a45 4856->4857

                                                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                                                        Function 0040351C Relevance: 86.2, APIs: 33, Strings: 16, Instructions: 464stringfilecomCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 0 40351c-40356e SetErrorMode GetVersionExW 1 403570-4035a0 GetVersionExW 0->1 2 4035a8-4035ad 0->2 1->2 3 4035b5-4035f7 2->3 4 4035af 2->4 5 4035f9-403601 call 406935 3->5 6 40360a 3->6 4->3 5->6 12 403603 5->12 7 40360f-403623 call 4068c5 lstrlenA 6->7 13 403625-403641 call 406935 * 3 7->13 12->6 20 403652-4036b6 #17 OleInitialize SHGetFileInfoW call 406541 GetCommandLineW call 406541 13->20 21 403643-403649 13->21 28 4036b8-4036ba 20->28 29 4036bf-4036d3 call 405e3d CharNextW 20->29 21->20 26 40364b 21->26 26->20 28->29 32 4037ce-4037d4 29->32 33 4036d8-4036de 32->33 34 4037da 32->34 35 4036e0-4036e5 33->35 36 4036e7-4036ee 33->36 37 4037ee-403808 GetTempPathW call 4034eb 34->37 35->35 35->36 39 4036f0-4036f5 36->39 40 4036f6-4036fa 36->40 44 403860-40387a DeleteFileW call 4030a2 37->44 45 40380a-403828 GetWindowsDirectoryW lstrcatW call 4034eb 37->45 39->40 42 403700-403706 40->42 43 4037bb-4037ca call 405e3d 40->43 47 403720-403759 42->47 48 403708-40370f 42->48 43->32 61 4037cc-4037cd 43->61 66 403880-403886 44->66 67 403a67-403a77 ExitProcess OleUninitialize 44->67 45->44 64 40382a-40385a GetTempPathW lstrcatW SetEnvironmentVariableW * 2 call 4034eb 45->64 49 403776-4037b0 47->49 50 40375b-403760 47->50 54 403711-403714 48->54 55 403716 48->55 58 4037b2-4037b6 49->58 59 4037b8-4037ba 49->59 50->49 56 403762-40376a 50->56 54->47 54->55 55->47 62 403771 56->62 63 40376c-40376f 56->63 58->59 65 4037dc-4037e9 call 406541 58->65 59->43 61->32 62->49 63->49 63->62 64->44 64->67 65->37 71 40388c-403897 call 405e3d 66->71 72 40391f-403926 call 403c13 66->72 69 403a79-403a89 call 405ba1 ExitProcess 67->69 70 403a9d-403aa3 67->70 77 403b21-403b29 70->77 78 403aa5-403abb GetCurrentProcess OpenProcessToken 70->78 87 4038e5-4038ef 71->87 88 403899-4038ce 71->88 82 40392b-40392f 72->82 83 403b2b 77->83 84 403b2f-403b33 ExitProcess 77->84 80 403af1-403aff call 406935 78->80 81 403abd-403aeb LookupPrivilegeValueW AdjustTokenPrivileges 78->81 97 403b01-403b0b 80->97 98 403b0d-403b18 ExitWindowsEx 80->98 81->80 82->67 83->84 92 4038f1-4038ff call 405f18 87->92 93 403934-40395a call 405b0c lstrlenW call 406541 87->93 90 4038d0-4038d4 88->90 94 4038d6-4038db 90->94 95 4038dd-4038e1 90->95 92->67 107 403905-40391b call 406541 * 2 92->107 110 40396b-403983 93->110 111 40395c-403966 call 406541 93->111 94->95 100 4038e3 94->100 95->90 95->100 97->98 102 403b1a-403b1c call 40140b 97->102 98->77 98->102 100->87 102->77 107->72 114 403988-40398c 110->114 111->110 116 403991-4039bb wsprintfW call 40657e 114->116 120 4039c4 call 405aef 116->120 121 4039bd-4039c2 call 405a95 116->121 124 4039c9-4039cb 120->124 121->124 126 403a07-403a26 SetCurrentDirectoryW call 406301 CopyFileW 124->126 127 4039cd-4039d7 GetFileAttributesW 124->127 135 403a65 126->135 136 403a28-403a49 call 406301 call 40657e call 405b24 126->136 128 4039f8-403a03 127->128 129 4039d9-4039e2 DeleteFileW 127->129 128->114 132 403a05 128->132 129->128 131 4039e4-4039f6 call 405c4d 129->131 131->116 131->128 132->67 135->67 144 403a4b-403a55 136->144 145 403a8f-403a9b CloseHandle 136->145 144->135 146 403a57-403a5f call 40689e 144->146 145->135 146->116 146->135
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SetErrorMode.KERNEL32 ref: 0040353F
                                                                                                                                                                                                                        • GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?), ref: 0040356A
                                                                                                                                                                                                                        • GetVersionExW.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 0040357D
                                                                                                                                                                                                                        • lstrlenA.KERNEL32(UXTHEME,UXTHEME,?,?,?,?,?,?,?,?), ref: 00403616
                                                                                                                                                                                                                        • #17.COMCTL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403653
                                                                                                                                                                                                                        • OleInitialize.OLE32(00000000), ref: 0040365A
                                                                                                                                                                                                                        • SHGetFileInfoW.SHELL32(00420EC8,00000000,?,000002B4,00000000), ref: 00403679
                                                                                                                                                                                                                        • GetCommandLineW.KERNEL32(00428A20,NSIS Error,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040368E
                                                                                                                                                                                                                        • CharNextW.USER32(00000000,"C:\Users\user\Desktop\GlassWireSetup.exe",00000020,"C:\Users\user\Desktop\GlassWireSetup.exe",00000000,?,00000008,0000000A,0000000C), ref: 004036C7
                                                                                                                                                                                                                        • GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00008001,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 004037FF
                                                                                                                                                                                                                        • GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403810
                                                                                                                                                                                                                        • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040381C
                                                                                                                                                                                                                        • GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403830
                                                                                                                                                                                                                        • lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403838
                                                                                                                                                                                                                        • SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403849
                                                                                                                                                                                                                        • SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403851
                                                                                                                                                                                                                        • DeleteFileW.KERNEL32(1033,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403865
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\GlassWireSetup.exe",00000000,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 0040393E
                                                                                                                                                                                                                          • Part of subcall function 00406541: lstrcpynW.KERNEL32(?,?,00000400,0040368E,00428A20,NSIS Error,?,00000008,0000000A,0000000C), ref: 0040654E
                                                                                                                                                                                                                        • wsprintfW.USER32 ref: 0040399B
                                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(0042C800,C:\Users\user\AppData\Local\Temp\), ref: 004039CE
                                                                                                                                                                                                                        • DeleteFileW.KERNEL32(0042C800), ref: 004039DA
                                                                                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 00403A08
                                                                                                                                                                                                                          • Part of subcall function 00406301: MoveFileExW.KERNEL32(?,?,00000005,00405DFF,?,00000000,000000F1,?,?,?,?,?), ref: 0040630B
                                                                                                                                                                                                                        • CopyFileW.KERNEL32(C:\Users\user\Desktop\GlassWireSetup.exe,0042C800,00000001,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00403A1E
                                                                                                                                                                                                                          • Part of subcall function 00405B24: CreateProcessW.KERNEL32(00000000,0042C800,00000000,00000000,00000000,04000000,00000000,00000000,00425F10,?,?,?,0042C800,?), ref: 00405B4D
                                                                                                                                                                                                                          • Part of subcall function 00405B24: CloseHandle.KERNEL32(?,?,?,0042C800,?), ref: 00405B5A
                                                                                                                                                                                                                          • Part of subcall function 0040689E: FindFirstFileW.KERNEL32(74DF3420,00425F58,C:\,00405F61,C:\,C:\,00000000,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C6D,?,74DF3420,C:\Users\user\AppData\Local\Temp\), ref: 004068A9
                                                                                                                                                                                                                          • Part of subcall function 0040689E: FindClose.KERNEL32(00000000), ref: 004068B5
                                                                                                                                                                                                                        • ExitProcess.KERNEL32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403A67
                                                                                                                                                                                                                        • OleUninitialize.OLE32(?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403A6C
                                                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 00403A89
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,0042D000,0042D000,?,0042C800,00000000), ref: 00403A90
                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000028,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403AAC
                                                                                                                                                                                                                        • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,?), ref: 00403AB3
                                                                                                                                                                                                                        • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403AC8
                                                                                                                                                                                                                        • AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00403AEB
                                                                                                                                                                                                                        • ExitWindowsEx.USER32(00000002,80040002), ref: 00403B10
                                                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 00403B33
                                                                                                                                                                                                                          • Part of subcall function 00405AEF: CreateDirectoryW.KERNEL32(?,00000000,0040350F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806,?,00000008,0000000A,0000000C), ref: 00405AF5
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: File$Process$Exit$CloseDirectory$CreateCurrentDeleteEnvironmentFindHandlePathTempTokenVariableVersionWindowslstrcatlstrlen$AdjustAttributesCharCommandCopyErrorFirstInfoInitializeLineLookupModeMoveNextOpenPrivilegePrivilegesUninitializeValuelstrcpynwsprintf
                                                                                                                                                                                                                        • String ID: "C:\Users\user\Desktop\GlassWireSetup.exe"$1033$C:\Program Files (x86)\GlassWire$C:\Program Files (x86)\GlassWire$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\GlassWireSetup.exe$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu%X.tmp
                                                                                                                                                                                                                        • API String ID: 2017177436-2257195497
                                                                                                                                                                                                                        • Opcode ID: 10d6a22c51abdd2a943d42b402ab190dd8818dd1211e44bdc4ace5df734d0f69
                                                                                                                                                                                                                        • Instruction ID: b6c3ecddbcec298392be70143bc2b9781a35be0696dc4cb4866b7eddd329dddd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 10d6a22c51abdd2a943d42b402ab190dd8818dd1211e44bdc4ace5df734d0f69
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A9F12370604311ABD720AF659D05B2B7EE8EF8570AF10483EF481B22D1DB7D9A45CB6E
                                                                                                                                                                                                                        Function 00405705 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 149 405705-405720 150 405726-4057ed GetDlgItem * 3 call 4044f5 call 404e4e GetClientRect GetSystemMetrics SendMessageW * 2 149->150 151 4058af-4058b6 149->151 172 40580b-40580e 150->172 173 4057ef-405809 SendMessageW * 2 150->173 153 4058e0-4058ed 151->153 154 4058b8-4058da GetDlgItem CreateThread CloseHandle 151->154 156 40590b-405915 153->156 157 4058ef-4058f5 153->157 154->153 161 405917-40591d 156->161 162 40596b-40596f 156->162 159 405930-405939 call 404527 157->159 160 4058f7-405906 ShowWindow * 2 call 4044f5 157->160 169 40593e-405942 159->169 160->156 167 405945-405955 ShowWindow 161->167 168 40591f-40592b call 404499 161->168 162->159 165 405971-405977 162->165 165->159 174 405979-40598c SendMessageW 165->174 170 405965-405966 call 404499 167->170 171 405957-405960 call 4055c6 167->171 168->159 170->162 171->170 178 405810-40581c SendMessageW 172->178 179 40581e-405835 call 4044c0 172->179 173->172 180 405992-4059bd CreatePopupMenu call 40657e AppendMenuW 174->180 181 405a8e-405a90 174->181 178->179 188 405837-40584b ShowWindow 179->188 189 40586b-40588c GetDlgItem SendMessageW 179->189 186 4059d2-4059e7 TrackPopupMenu 180->186 187 4059bf-4059cf GetWindowRect 180->187 181->169 186->181 191 4059ed-405a04 186->191 187->186 192 40585a 188->192 193 40584d-405858 ShowWindow 188->193 189->181 190 405892-4058aa SendMessageW * 2 189->190 190->181 194 405a09-405a24 SendMessageW 191->194 195 405860-405866 call 4044f5 192->195 193->195 194->194 196 405a26-405a49 OpenClipboard EmptyClipboard GlobalAlloc GlobalLock 194->196 195->189 198 405a4b-405a72 SendMessageW 196->198 198->198 199 405a74-405a88 GlobalUnlock SetClipboardData CloseClipboard 198->199 199->181
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000403), ref: 00405763
                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EE), ref: 00405772
                                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 004057AF
                                                                                                                                                                                                                        • GetSystemMetrics.USER32(00000002), ref: 004057B6
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001061,00000000,?), ref: 004057D7
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004057E8
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001001,00000000,00000110), ref: 004057FB
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405809
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001024,00000000,?), ref: 0040581C
                                                                                                                                                                                                                        • ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040583E
                                                                                                                                                                                                                        • ShowWindow.USER32(?,00000008), ref: 00405852
                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 00405873
                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 00405883
                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000409,00000000,?), ref: 0040589C
                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004058A8
                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003F8), ref: 00405781
                                                                                                                                                                                                                          • Part of subcall function 004044F5: SendMessageW.USER32(00000028,?,00000001,00404320), ref: 00404503
                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003EC), ref: 004058C5
                                                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,Function_00005699,00000000), ref: 004058D3
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 004058DA
                                                                                                                                                                                                                        • ShowWindow.USER32(00000000), ref: 004058FE
                                                                                                                                                                                                                        • ShowWindow.USER32(?,00000008), ref: 00405903
                                                                                                                                                                                                                        • ShowWindow.USER32(00000008), ref: 0040594D
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405981
                                                                                                                                                                                                                        • CreatePopupMenu.USER32 ref: 00405992
                                                                                                                                                                                                                        • AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004059A6
                                                                                                                                                                                                                        • GetWindowRect.USER32(?,?), ref: 004059C6
                                                                                                                                                                                                                        • TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004059DF
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A17
                                                                                                                                                                                                                        • OpenClipboard.USER32(00000000), ref: 00405A27
                                                                                                                                                                                                                        • EmptyClipboard.USER32 ref: 00405A2D
                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405A39
                                                                                                                                                                                                                        • GlobalLock.KERNEL32(00000000), ref: 00405A43
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001073,00000000,?), ref: 00405A57
                                                                                                                                                                                                                        • GlobalUnlock.KERNEL32(00000000), ref: 00405A77
                                                                                                                                                                                                                        • SetClipboardData.USER32(0000000D,00000000), ref: 00405A82
                                                                                                                                                                                                                        • CloseClipboard.USER32 ref: 00405A88
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
                                                                                                                                                                                                                        • String ID: {
                                                                                                                                                                                                                        • API String ID: 590372296-366298937
                                                                                                                                                                                                                        • Opcode ID: 3824989ea0536e5c3d89d87b24ed579d9185aa06a8fa494c1d573172a0034d7b
                                                                                                                                                                                                                        • Instruction ID: 1ec4b4c3d0988b91a44b02e8c0f1a80d5eff4bd371306251f5288e66bb296ab7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3824989ea0536e5c3d89d87b24ed579d9185aa06a8fa494c1d573172a0034d7b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4FB139B1900608FFDB11AFA0DD89AAE7B79FB04354F40813AFA41B61A0CB744E51DF68
                                                                                                                                                                                                                        Function 004049B1 Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 275stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 548 4049b1-4049db 549 4049dd-4049e9 call 405b85 call 4067ef 548->549 550 4049ee-4049f8 548->550 549->550 552 404a66-404a6d 550->552 553 4049fa-404a10 GetDlgItem call 405e87 550->553 556 404a73-404a7c 552->556 557 404b44-404b4b 552->557 564 404a22-404a5b SetWindowTextW call 4044c0 * 2 call 4044f5 call 406935 553->564 565 404a12-404a1a call 405ebb 553->565 560 404a96-404a9b 556->560 561 404a7e-404a89 556->561 562 404b5a-404b75 call 405b85 call 405f18 557->562 563 404b4d-404b54 557->563 560->557 568 404aa1-404ae3 call 40657e SHBrowseForFolderW 560->568 566 404cf2-404d04 call 404527 561->566 567 404a8f 561->567 586 404b77 562->586 587 404b7e-404b96 call 406541 call 406935 562->587 563->562 563->566 564->566 606 404a61-404a64 SHAutoComplete 564->606 565->564 584 404a1c-404a1d call 405e10 565->584 567->560 580 404ae5-404aff CoTaskMemFree call 405e10 568->580 581 404b3d 568->581 593 404b01-404b07 580->593 594 404b29-404b3b SetDlgItemTextW 580->594 581->557 584->564 586->587 604 404bd2-404be3 call 406541 call 405ebb 587->604 605 404b98-404b9e 587->605 593->594 597 404b09-404b20 call 40657e lstrcmpiW 593->597 594->557 597->594 608 404b22-404b24 lstrcatW 597->608 620 404be5 604->620 621 404be8-404c01 GetDiskFreeSpaceW 604->621 605->604 609 404ba0-404bb2 GetDiskFreeSpaceExW 605->609 606->552 608->594 611 404bb4-404bb6 609->611 612 404c2a-404c44 609->612 615 404bb8 611->615 616 404bbb-404bd0 call 405e5c 611->616 614 404c46 612->614 618 404c4b-404c55 call 404e4e 614->618 615->616 616->604 616->609 626 404c70-404c79 618->626 627 404c57-404c5e 618->627 620->621 621->614 624 404c03-404c28 MulDiv 621->624 624->618 628 404cab-404cb5 626->628 629 404c7b-404c8b call 404e36 626->629 627->626 630 404c60 627->630 632 404cc1-404cc7 628->632 633 404cb7-404cbe call 40140b 628->633 641 404c9d-404ca6 SetDlgItemTextW 629->641 642 404c8d-404c96 call 404d6d 629->642 634 404c62-404c67 630->634 635 404c69 630->635 638 404cc9 632->638 639 404ccc-404cdd call 4044e2 632->639 633->632 634->626 634->635 635->626 638->639 646 404cec 639->646 647 404cdf-404ce5 639->647 641->628 648 404c9b 642->648 646->566 647->646 649 404ce7 call 40490a 647->649 648->628 649->646
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FB), ref: 00404A00
                                                                                                                                                                                                                        • SetWindowTextW.USER32(00000000,-0042A000), ref: 00404A2A
                                                                                                                                                                                                                        • SHAutoComplete.SHLWAPI(00000000,00000001,00000009,00000000,?,00000014,?,?,00000001,?), ref: 00404A64
                                                                                                                                                                                                                        • SHBrowseForFolderW.SHELL32(?), ref: 00404ADB
                                                                                                                                                                                                                        • CoTaskMemFree.OLE32(00000000), ref: 00404AE6
                                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(Delete on reboot: ,00422F08,00000000,?,-0042A000), ref: 00404B18
                                                                                                                                                                                                                        • lstrcatW.KERNEL32(-0042A000,Delete on reboot: ), ref: 00404B24
                                                                                                                                                                                                                        • SetDlgItemTextW.USER32(?,000003FB,-0042A000), ref: 00404B36
                                                                                                                                                                                                                          • Part of subcall function 00405B85: GetDlgItemTextW.USER32(?,?,00000400,00404B6D), ref: 00405B98
                                                                                                                                                                                                                          • Part of subcall function 004067EF: CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\GlassWireSetup.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,004034F7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806,?,00000008,0000000A,0000000C), ref: 00406852
                                                                                                                                                                                                                          • Part of subcall function 004067EF: CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406861
                                                                                                                                                                                                                          • Part of subcall function 004067EF: CharNextW.USER32(?,"C:\Users\user\Desktop\GlassWireSetup.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,004034F7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806,?,00000008,0000000A,0000000C), ref: 00406866
                                                                                                                                                                                                                          • Part of subcall function 004067EF: CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,004034F7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806,?,00000008,0000000A,0000000C), ref: 00406879
                                                                                                                                                                                                                        • GetDiskFreeSpaceExW.KERNEL32(C:\Program Files (x86)\,?,?,?,00000001,C:\Program Files (x86)\,-0042A000,-0042A000,000003FB,-0042A000), ref: 00404BAD
                                                                                                                                                                                                                        • GetDiskFreeSpaceW.KERNEL32(C:\Program Files (x86)\,?,?,0000040F,?,C:\Program Files (x86)\,C:\Program Files (x86)\,-0042A000,00000001,C:\Program Files (x86)\,-0042A000,-0042A000,000003FB,-0042A000), ref: 00404BF9
                                                                                                                                                                                                                        • MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404C14
                                                                                                                                                                                                                          • Part of subcall function 00404D6D: lstrlenW.KERNEL32(00422F08,00422F08,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,-0042A000), ref: 00404E0E
                                                                                                                                                                                                                          • Part of subcall function 00404D6D: wsprintfW.USER32 ref: 00404E17
                                                                                                                                                                                                                          • Part of subcall function 00404D6D: SetDlgItemTextW.USER32(?,00422F08), ref: 00404E2A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CharItemText$FreeNext$DiskSpace$AutoBrowseCompleteFolderPrevTaskWindowlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                        • String ID: A$C:\Program Files (x86)\$C:\Program Files (x86)\GlassWire$Delete on reboot:
                                                                                                                                                                                                                        • API String ID: 4039761011-3953233372
                                                                                                                                                                                                                        • Opcode ID: ca0a332e2726a2bcadb8e331bd863bc0276bdf77efdf1ce4884902225ddefa85
                                                                                                                                                                                                                        • Instruction ID: bc895223e5afc39127eca44d4d62e4eac8fcc33aadfc8ea3f63fda85b43113f0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ca0a332e2726a2bcadb8e331bd863bc0276bdf77efdf1ce4884902225ddefa85
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 15A190B1A01208ABDB11DFA6DD45AAFB7B8EF84304F11403BF611B62D1D77C9A418B6D
                                                                                                                                                                                                                        Function 00405C4D Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148filestringCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 777 405c4d-405c73 call 405f18 780 405c75-405c87 DeleteFileW 777->780 781 405c8c-405c93 777->781 782 405e09-405e0d 780->782 783 405c95-405c97 781->783 784 405ca6-405cb6 call 406541 781->784 786 405db7-405dbc 783->786 787 405c9d-405ca0 783->787 790 405cc5-405cc6 call 405e5c 784->790 791 405cb8-405cc3 lstrcatW 784->791 786->782 789 405dbe-405dc1 786->789 787->784 787->786 792 405dc3-405dc9 789->792 793 405dcb-405dd3 call 40689e 789->793 794 405ccb-405ccf 790->794 791->794 792->782 793->782 801 405dd5-405de9 call 405e10 call 405c05 793->801 797 405cd1-405cd9 794->797 798 405cdb-405ce1 lstrcatW 794->798 797->798 800 405ce6-405d02 lstrlenW FindFirstFileW 797->800 798->800 802 405d08-405d10 800->802 803 405dac-405db0 800->803 819 405e01-405e04 call 4055c6 801->819 820 405deb-405dee 801->820 806 405d30-405d44 call 406541 802->806 807 405d12-405d1a 802->807 803->786 805 405db2 803->805 805->786 817 405d46-405d4e 806->817 818 405d5b-405d66 call 405c05 806->818 809 405d1c-405d24 807->809 810 405d8f-405d9f FindNextFileW 807->810 809->806 814 405d26-405d2e 809->814 810->802 813 405da5-405da6 FindClose 810->813 813->803 814->806 814->810 817->810 822 405d50-405d59 call 405c4d 817->822 830 405d87-405d8a call 4055c6 818->830 831 405d68-405d6b 818->831 819->782 820->792 821 405df0-405dff call 4055c6 call 406301 820->821 821->782 822->810 830->810 833 405d6d-405d7d call 4055c6 call 406301 831->833 834 405d7f-405d85 831->834 833->810 834->810
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • DeleteFileW.KERNEL32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\GlassWireSetup.exe"), ref: 00405C76
                                                                                                                                                                                                                        • lstrcatW.KERNEL32(00424F10,\*.*,00424F10,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\GlassWireSetup.exe"), ref: 00405CBE
                                                                                                                                                                                                                        • lstrcatW.KERNEL32(?,0040A014,?,00424F10,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\GlassWireSetup.exe"), ref: 00405CE1
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,?,0040A014,?,00424F10,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\GlassWireSetup.exe"), ref: 00405CE7
                                                                                                                                                                                                                        • FindFirstFileW.KERNEL32(00424F10,?,?,?,0040A014,?,00424F10,?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\GlassWireSetup.exe"), ref: 00405CF7
                                                                                                                                                                                                                        • FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405D97
                                                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 00405DA6
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • \*.*, xrefs: 00405CB8
                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405C5A
                                                                                                                                                                                                                        • "C:\Users\user\Desktop\GlassWireSetup.exe", xrefs: 00405C56
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
                                                                                                                                                                                                                        • String ID: "C:\Users\user\Desktop\GlassWireSetup.exe"$C:\Users\user\AppData\Local\Temp\$\*.*
                                                                                                                                                                                                                        • API String ID: 2035342205-4023275833
                                                                                                                                                                                                                        • Opcode ID: 0b85f367639a69f5b614f98777155fba44d4349fb39831c7af8fd38ecdabae30
                                                                                                                                                                                                                        • Instruction ID: c1737a7785d2a2f908f5f44de07c4aee1227101a85bdbc8c56ed50a571596083
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0b85f367639a69f5b614f98777155fba44d4349fb39831c7af8fd38ecdabae30
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3241C430800A14BADB216B65CD4DABF7678DF41758F14813BF802B21D1D77C4AC19EAE
                                                                                                                                                                                                                        Function 0040689E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • FindFirstFileW.KERNEL32(74DF3420,00425F58,C:\,00405F61,C:\,C:\,00000000,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C6D,?,74DF3420,C:\Users\user\AppData\Local\Temp\), ref: 004068A9
                                                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 004068B5
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                        • String ID: C:\$X_B
                                                                                                                                                                                                                        • API String ID: 2295610775-1485017309
                                                                                                                                                                                                                        • Opcode ID: 368a1c0a689282c2aa5195ddf357efb180b92b440bed087baa82a07527058284
                                                                                                                                                                                                                        • Instruction ID: f67f359cedd367be1f2f51a398ada2a6aadcf11014009cc1af4821528039bb17
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 368a1c0a689282c2aa5195ddf357efb180b92b440bed087baa82a07527058284
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 68D0123251A5205BC64067396E0C84B7B58AF153717268A36F5AAF21E0CB348C6A969C
                                                                                                                                                                                                                        Function 00406C5F Relevance: 5.4, APIs: 4, Instructions: 382COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: c61fa70d481ae7decb37dc56cf27f7a4c6ea5b826eb98dd3ad332090416f9cd2
                                                                                                                                                                                                                        • Instruction ID: db5d81fcbfa5be4a2d8af1487b95e9640f9c883cb1993a3fcb30b22963867ec5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c61fa70d481ae7decb37dc56cf27f7a4c6ea5b826eb98dd3ad332090416f9cd2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 87F17871D04229CBDF28CFA8C8946ADBBB0FF44305F25816ED456BB281D7786A86CF45
                                                                                                                                                                                                                        Function 004021CF Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CoCreateInstance.OLE32(004084DC,?,00000001,004084CC,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 0040224E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • C:\Program Files (x86)\GlassWire, xrefs: 0040228E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CreateInstance
                                                                                                                                                                                                                        • String ID: C:\Program Files (x86)\GlassWire
                                                                                                                                                                                                                        • API String ID: 542301482-786346560
                                                                                                                                                                                                                        • Opcode ID: f85662b23458363dd6ab5ae1447e3296406ee4d16919afc4b05b52c53faf9e24
                                                                                                                                                                                                                        • Instruction ID: 7c9e104ca8be0d6b13ead4f97a80eb64338f0e545dbf3bddd9310e0b0504cb73
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f85662b23458363dd6ab5ae1447e3296406ee4d16919afc4b05b52c53faf9e24
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 54410575A00209AFCB00DFE4CA89AAD7BB5FF48318B20457EF505EB2D1DB799981CB54
                                                                                                                                                                                                                        Function 00404F2D Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 489windowmemoryCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 200 404f2d-404f79 GetDlgItem * 2 201 4051a4-4051ab 200->201 202 404f7f-405017 GlobalAlloc LoadImageW SetWindowLongW ImageList_Create ImageList_AddMasked SendMessageW * 2 200->202 203 4051ad-4051bd 201->203 204 4051bf 201->204 205 405026-40502d DeleteObject 202->205 206 405019-405024 SendMessageW 202->206 207 4051c2-4051cb 203->207 204->207 208 40502f-405037 205->208 206->205 209 4051d6-4051dc 207->209 210 4051cd-4051d0 207->210 211 405060-405064 208->211 212 405039-40503c 208->212 214 4051eb-4051f2 209->214 215 4051de-4051e5 209->215 210->209 213 4052ba-4052c1 210->213 211->208 218 405066-405096 call 4044c0 * 2 211->218 216 405041-40505e call 40657e SendMessageW * 2 212->216 217 40503e 212->217 219 405332-40533a 213->219 220 4052c3-4052c9 213->220 221 4051f4-4051f7 214->221 222 405267-40526a 214->222 215->213 215->214 216->211 217->216 254 405166-405179 GetWindowLongW SetWindowLongW 218->254 255 40509c-4050a2 218->255 229 405344-40534b 219->229 230 40533c-405342 SendMessageW 219->230 226 405525-405537 call 404527 220->226 227 4052cf-4052d9 220->227 231 405202-405217 call 404e7b 221->231 232 4051f9-405200 221->232 222->213 228 40526c-405276 222->228 227->226 235 4052df-4052ee SendMessageW 227->235 236 405286-405290 228->236 237 405278-405284 SendMessageW 228->237 239 40534d-405354 229->239 240 40537f-405386 229->240 230->229 231->222 253 405219-40522a 231->253 232->222 232->231 235->226 245 4052f4-405305 SendMessageW 235->245 236->213 246 405292-40529c 236->246 237->236 248 405356-405357 ImageList_Destroy 239->248 249 40535d-405364 239->249 243 4054e7-4054ee 240->243 244 40538c-405398 call 4011ef 240->244 243->226 259 4054f0-4054f7 243->259 272 4053a8-4053ab 244->272 273 40539a-40539d 244->273 257 405307-40530d 245->257 258 40530f-405311 245->258 260 4052ad-4052b7 246->260 261 40529e-4052ab 246->261 248->249 251 405366-405367 GlobalFree 249->251 252 40536d-405379 249->252 251->252 252->240 253->222 262 40522c-40522e 253->262 267 40517f-405182 254->267 263 4050a5-4050ab 255->263 257->258 265 405312-40532b call 401299 SendMessageW 257->265 258->265 259->226 266 4054f9-405523 ShowWindow GetDlgItem ShowWindow 259->266 260->213 261->213 268 405230-405237 262->268 269 405241 262->269 270 4050b1-4050dc 263->270 271 405148-40515b 263->271 265->219 266->226 275 405184-405197 ShowWindow call 4044f5 267->275 276 40519c-40519f call 4044f5 267->276 278 405239-40523b 268->278 279 40523d-40523f 268->279 280 405244-405260 call 40117d 269->280 281 405118-40511a 270->281 282 4050de-405116 SendMessageW 270->282 271->263 286 405161-405164 271->286 287 4053ec-405410 call 4011ef 272->287 288 4053ad-4053c6 call 4012e2 call 401299 272->288 283 4053a0-4053a3 call 404efb 273->283 284 40539f 273->284 275->226 276->201 278->280 279->280 280->222 291 405130-405145 SendMessageW 281->291 292 40511c-40512e SendMessageW 281->292 282->271 283->272 284->283 286->254 286->267 301 4054b2-4054bb 287->301 302 405416 287->302 308 4053d6-4053e5 SendMessageW 288->308 309 4053c8-4053ce 288->309 291->271 292->271 303 4054c9-4054d1 301->303 304 4054bd-4054c3 InvalidateRect 301->304 305 405419-405424 302->305 303->243 307 4054d3-4054e2 call 404e4e call 404e36 303->307 304->303 310 405426-405435 305->310 311 40549a-4054ac 305->311 307->243 308->287 312 4053d0 309->312 313 4053d1-4053d4 309->313 315 405437-405444 310->315 316 405448-40544b 310->316 311->301 311->305 312->313 313->308 313->309 315->316 318 405452-40545b 316->318 319 40544d-405450 316->319 321 405460-405498 SendMessageW * 2 318->321 322 40545d 318->322 319->321 321->311 322->321
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003F9), ref: 00404F45
                                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000408), ref: 00404F50
                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?), ref: 00404F9A
                                                                                                                                                                                                                        • LoadImageW.USER32(0000006E,00000000,00000000,00000000,00000000), ref: 00404FB1
                                                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000FC,0040553A), ref: 00404FCA
                                                                                                                                                                                                                        • ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404FDE
                                                                                                                                                                                                                        • ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404FF0
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001109,00000002), ref: 00405006
                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00405012
                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00405024
                                                                                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 00405027
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00405052
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000151,00000000,00000000), ref: 0040505E
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001132,00000000,?), ref: 004050F9
                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000110A,00000003,00000110), ref: 00405129
                                                                                                                                                                                                                          • Part of subcall function 004044F5: SendMessageW.USER32(00000028,?,00000001,00404320), ref: 00404503
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001132,00000000,?), ref: 0040513D
                                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 0040516B
                                                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000F0,00000000), ref: 00405179
                                                                                                                                                                                                                        • ShowWindow.USER32(?,00000005), ref: 00405189
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000419,00000000,?), ref: 00405284
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000147,00000000,00000000), ref: 004052E9
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000150,00000000,00000000), ref: 004052FE
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405322
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405342
                                                                                                                                                                                                                        • ImageList_Destroy.COMCTL32(00000000), ref: 00405357
                                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 00405367
                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 004053E0
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001102,?,?), ref: 00405489
                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 00405498
                                                                                                                                                                                                                        • InvalidateRect.USER32(?,00000000,00000001), ref: 004054C3
                                                                                                                                                                                                                        • ShowWindow.USER32(?,00000000), ref: 00405511
                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003FE), ref: 0040551C
                                                                                                                                                                                                                        • ShowWindow.USER32(00000000), ref: 00405523
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: MessageSend$Window$Image$ItemList_LongShow$Global$AllocCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
                                                                                                                                                                                                                        • String ID: $M$N
                                                                                                                                                                                                                        • API String ID: 2564846305-813528018
                                                                                                                                                                                                                        • Opcode ID: a09e9907cf1d85342395cb53904611de706c132920ab67d22d4dedafd93240b8
                                                                                                                                                                                                                        • Instruction ID: 4e4e2263315175f506fe38719dbb0ef9e1096acd748b53dfdf66ec3fe5014b92
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a09e9907cf1d85342395cb53904611de706c132920ab67d22d4dedafd93240b8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BA029C70A00608AFDB20DF64DD45AAF7BB5FB44314F10817AE610BA2E1D7B98A42DF18
                                                                                                                                                                                                                        Function 00403FC1 Relevance: 51.4, APIs: 34, Instructions: 357windowstringCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 323 403fc1-403fd3 324 403fd9-403fdf 323->324 325 40413a-404149 323->325 324->325 328 403fe5-403fee 324->328 326 404198-4041ad 325->326 327 40414b-404193 GetDlgItem * 2 call 4044c0 SetClassLongW call 40140b 325->327 332 4041ed-4041f2 call 40450c 326->332 333 4041af-4041b2 326->333 327->326 329 403ff0-403ffd SetWindowPos 328->329 330 404003-40400a 328->330 329->330 335 40400c-404026 ShowWindow 330->335 336 40404e-404054 330->336 340 4041f7-404212 332->340 338 4041b4-4041bf call 401389 333->338 339 4041e5-4041e7 333->339 341 404127-404135 call 404527 335->341 342 40402c-40403f GetWindowLongW 335->342 343 404056-404068 DestroyWindow 336->343 344 40406d-404070 336->344 338->339 364 4041c1-4041e0 SendMessageW 338->364 339->332 347 40448d 339->347 349 404214-404216 call 40140b 340->349 350 40421b-404221 340->350 354 40448f-404496 341->354 342->341 351 404045-404048 ShowWindow 342->351 352 40446a-404470 343->352 355 404072-40407e SetWindowLongW 344->355 356 404083-404089 344->356 347->354 349->350 361 404227-404232 350->361 362 40444b-404464 DestroyWindow KiUserCallbackDispatcher 350->362 351->336 352->347 360 404472-404478 352->360 355->354 356->341 363 40408f-40409e GetDlgItem 356->363 360->347 365 40447a-404483 ShowWindow 360->365 361->362 366 404238-404285 call 40657e call 4044c0 * 3 GetDlgItem 361->366 362->352 367 4040a0-4040b7 SendMessageW IsWindowEnabled 363->367 368 4040bd-4040c0 363->368 364->354 365->347 395 404287-40428c 366->395 396 40428f-4042cb ShowWindow KiUserCallbackDispatcher call 4044e2 KiUserCallbackDispatcher 366->396 367->347 367->368 370 4040c2-4040c3 368->370 371 4040c5-4040c8 368->371 373 4040f3-4040f8 call 404499 370->373 374 4040d6-4040db 371->374 375 4040ca-4040d0 371->375 373->341 376 404111-404121 SendMessageW 374->376 378 4040dd-4040e3 374->378 375->376 377 4040d2-4040d4 375->377 376->341 377->373 381 4040e5-4040eb call 40140b 378->381 382 4040fa-404103 call 40140b 378->382 391 4040f1 381->391 382->341 392 404105-40410f 382->392 391->373 392->391 395->396 399 4042d0 396->399 400 4042cd-4042ce 396->400 401 4042d2-404300 GetSystemMenu EnableMenuItem SendMessageW 399->401 400->401 402 404302-404313 SendMessageW 401->402 403 404315 401->403 404 40431b-40435a call 4044f5 call 403fa2 call 406541 lstrlenW call 40657e SetWindowTextW call 401389 402->404 403->404 404->340 415 404360-404362 404->415 415->340 416 404368-40436c 415->416 417 40438b-40439f DestroyWindow 416->417 418 40436e-404374 416->418 417->352 420 4043a5-4043d2 CreateDialogParamW 417->420 418->347 419 40437a-404380 418->419 419->340 421 404386 419->421 420->352 422 4043d8-40442f call 4044c0 GetDlgItem GetWindowRect ScreenToClient SetWindowPos call 401389 420->422 421->347 422->347 427 404431-404444 ShowWindow call 40450c 422->427 429 404449 427->429 429->352
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403FFD
                                                                                                                                                                                                                        • ShowWindow.USER32(?), ref: 0040401D
                                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000F0), ref: 0040402F
                                                                                                                                                                                                                        • ShowWindow.USER32(?,00000004), ref: 00404048
                                                                                                                                                                                                                        • DestroyWindow.USER32 ref: 0040405C
                                                                                                                                                                                                                        • SetWindowLongW.USER32(?,00000000,00000000), ref: 00404075
                                                                                                                                                                                                                        • GetDlgItem.USER32(?,?), ref: 00404094
                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 004040A8
                                                                                                                                                                                                                        • IsWindowEnabled.USER32(00000000), ref: 004040AF
                                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000001), ref: 0040415A
                                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000002), ref: 00404164
                                                                                                                                                                                                                        • SetClassLongW.USER32(?,000000F2,?), ref: 0040417E
                                                                                                                                                                                                                        • SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 004041CF
                                                                                                                                                                                                                        • GetDlgItem.USER32(?,00000003), ref: 00404275
                                                                                                                                                                                                                        • ShowWindow.USER32(00000000,?), ref: 00404296
                                                                                                                                                                                                                        • KiUserCallbackDispatcher.NTDLL(?,?), ref: 004042A8
                                                                                                                                                                                                                        • KiUserCallbackDispatcher.NTDLL(?,?), ref: 004042C3
                                                                                                                                                                                                                        • GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 004042D9
                                                                                                                                                                                                                        • EnableMenuItem.USER32(00000000), ref: 004042E0
                                                                                                                                                                                                                        • SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 004042F8
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040430B
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(00422F08,?,00422F08,00000000), ref: 00404335
                                                                                                                                                                                                                        • SetWindowTextW.USER32(?,00422F08), ref: 00404349
                                                                                                                                                                                                                        • ShowWindow.USER32(?,0000000A), ref: 0040447D
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Window$Item$MessageSendShow$Long$CallbackDispatcherMenuUser$ClassDestroyEnableEnabledSystemTextlstrlen
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3964124867-0
                                                                                                                                                                                                                        • Opcode ID: 4b3fe02cb5795506d30df4e66f46237e59566fdbff82c58b44480cf0eb866077
                                                                                                                                                                                                                        • Instruction ID: f4824fcfb4375dbde2e3aa314f90dcffafac0cdac9d9fdfce080a9e5a5e1030c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4b3fe02cb5795506d30df4e66f46237e59566fdbff82c58b44480cf0eb866077
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E7C1CEB1600200BBCB216F61EE49E2B3A68FB95719F41053EF751B11F0CB795882DB2E
                                                                                                                                                                                                                        Function 00403C13 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 215stringregistryCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 430 403c13-403c2b call 406935 433 403c2d-403c3d call 406488 430->433 434 403c3f-403c76 call 40640f 430->434 443 403c99-403cc2 call 403ee9 call 405f18 433->443 439 403c78-403c89 call 40640f 434->439 440 403c8e-403c94 lstrcatW 434->440 439->440 440->443 448 403d54-403d5c call 405f18 443->448 449 403cc8-403ccd 443->449 455 403d6a-403d8f LoadImageW 448->455 456 403d5e-403d65 call 40657e 448->456 449->448 450 403cd3-403cfb call 40640f 449->450 450->448 457 403cfd-403d01 450->457 459 403e10-403e18 call 40140b 455->459 460 403d91-403dc1 RegisterClassW 455->460 456->455 461 403d13-403d1f lstrlenW 457->461 462 403d03-403d10 call 405e3d 457->462 471 403e22-403e2d call 403ee9 459->471 472 403e1a-403e1d 459->472 463 403dc7-403e0b SystemParametersInfoW CreateWindowExW 460->463 464 403edf 460->464 469 403d21-403d2f lstrcmpiW 461->469 470 403d47-403d4f call 405e10 call 406541 461->470 462->461 463->459 468 403ee1-403ee8 464->468 469->470 475 403d31-403d3b GetFileAttributesW 469->475 470->448 483 403e33-403e4d ShowWindow call 4068c5 471->483 484 403eb6-403eb7 call 405699 471->484 472->468 478 403d41-403d42 call 405e5c 475->478 479 403d3d-403d3f 475->479 478->470 479->470 479->478 491 403e59-403e6b GetClassInfoW 483->491 492 403e4f-403e54 call 4068c5 483->492 487 403ebc-403ebe 484->487 489 403ec0-403ec6 487->489 490 403ed8-403eda call 40140b 487->490 489->472 493 403ecc-403ed3 call 40140b 489->493 490->464 496 403e83-403ea6 DialogBoxParamW call 40140b 491->496 497 403e6d-403e7d GetClassInfoW RegisterClassW 491->497 492->491 493->472 501 403eab-403eb4 call 403b63 496->501 497->496 501->468
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00406935: GetModuleHandleA.KERNEL32(?,00000020,?,0040362C,0000000C,?,?,?,?,?,?,?,?), ref: 00406947
                                                                                                                                                                                                                          • Part of subcall function 00406935: GetProcAddress.KERNEL32(00000000,?), ref: 00406962
                                                                                                                                                                                                                        • lstrcatW.KERNEL32(1033,00422F08,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422F08,00000000,00000002,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,"C:\Users\user\Desktop\GlassWireSetup.exe",00008001), ref: 00403C94
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(Delete on reboot: ,?,?,?,Delete on reboot: ,00000000,C:\Program Files (x86)\GlassWire,1033,00422F08,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422F08,00000000,00000002,74DF3420), ref: 00403D14
                                                                                                                                                                                                                        • lstrcmpiW.KERNEL32(?,.exe,Delete on reboot: ,?,?,?,Delete on reboot: ,00000000,C:\Program Files (x86)\GlassWire,1033,00422F08,80000001,Control Panel\Desktop\ResourceLocale,00000000,00422F08,00000000), ref: 00403D27
                                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(Delete on reboot: ), ref: 00403D32
                                                                                                                                                                                                                        • LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Program Files (x86)\GlassWire), ref: 00403D7B
                                                                                                                                                                                                                          • Part of subcall function 00406488: wsprintfW.USER32 ref: 00406495
                                                                                                                                                                                                                        • RegisterClassW.USER32(004289C0), ref: 00403DB8
                                                                                                                                                                                                                        • SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403DD0
                                                                                                                                                                                                                        • CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403E05
                                                                                                                                                                                                                        • ShowWindow.USER32(00000005,00000000), ref: 00403E3B
                                                                                                                                                                                                                        • GetClassInfoW.USER32(00000000,RichEdit20W,004289C0), ref: 00403E67
                                                                                                                                                                                                                        • GetClassInfoW.USER32(00000000,RichEdit,004289C0), ref: 00403E74
                                                                                                                                                                                                                        • RegisterClassW.USER32(004289C0), ref: 00403E7D
                                                                                                                                                                                                                        • DialogBoxParamW.USER32(?,00000000,00403FC1,00000000), ref: 00403E9C
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
                                                                                                                                                                                                                        • String ID: "C:\Users\user\Desktop\GlassWireSetup.exe"$.DEFAULT\Control Panel\International$.exe$1033$C:\Program Files (x86)\GlassWire$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$Delete on reboot: $RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
                                                                                                                                                                                                                        • API String ID: 1975747703-3892318539
                                                                                                                                                                                                                        • Opcode ID: ca2a60a29edbf8f6c38066e0c2e5cc4dbcbfcab219627d2edf9e89d089edb966
                                                                                                                                                                                                                        • Instruction ID: 5b9c441e0465166458f669e0e2db1e5d0b29f952519833dd96bf398df7fa21fd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ca2a60a29edbf8f6c38066e0c2e5cc4dbcbfcab219627d2edf9e89d089edb966
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E661D570600300BAD620AF66DD46F3B3A7CEB84B49F81453FF941B61E2CB795952CA6D
                                                                                                                                                                                                                        Function 0040467F Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 204windowstringCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 504 40467f-404691 505 4047b1-4047be 504->505 506 404697-40469f 504->506 507 4047c0-4047c9 505->507 508 40481b-40481f 505->508 509 4046a1-4046b0 506->509 510 4046b2-4046d6 506->510 515 4048f4 507->515 516 4047cf-4047d5 507->516 513 4048e5-4048ec 508->513 514 404825-40483d GetDlgItem 508->514 509->510 511 4046d8 510->511 512 4046df-40475a call 4044c0 * 2 CheckDlgButton call 4044e2 GetDlgItem call 4044f5 SendMessageW 510->512 511->512 546 404765-4047ac SendMessageW * 2 lstrlenW SendMessageW * 2 512->546 547 40475c-40475f GetSysColor 512->547 513->515 518 4048ee 513->518 520 4048a6-4048ad 514->520 521 40483f-404846 514->521 519 4048f7-4048fe call 404527 515->519 516->515 522 4047db-4047e6 516->522 518->515 530 404903-404907 519->530 520->519 527 4048af-4048b6 520->527 521->520 526 404848-404863 521->526 522->515 523 4047ec-404816 GetDlgItem SendMessageW call 4044e2 call 40490a 522->523 523->508 526->520 531 404865-4048a3 SendMessageW LoadCursorW SetCursor call 40492e LoadCursorW SetCursor 526->531 527->519 532 4048b8-4048bc 527->532 531->520 536 4048ce-4048d2 532->536 537 4048be-4048cc SendMessageW 532->537 538 4048e0-4048e3 536->538 539 4048d4-4048de SendMessageW 536->539 537->536 538->530 539->538 546->530 547->546
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040471D
                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003E8), ref: 00404731
                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 0040474E
                                                                                                                                                                                                                        • GetSysColor.USER32(?), ref: 0040475F
                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000443,00000000,?), ref: 0040476D
                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 0040477B
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(?), ref: 00404780
                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 0040478D
                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 004047A2
                                                                                                                                                                                                                        • GetDlgItem.USER32(?,0000040A), ref: 004047FB
                                                                                                                                                                                                                        • SendMessageW.USER32(00000000), ref: 00404802
                                                                                                                                                                                                                        • GetDlgItem.USER32(?,000003E8), ref: 0040482D
                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 00404870
                                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F02), ref: 0040487E
                                                                                                                                                                                                                        • SetCursor.USER32(00000000), ref: 00404881
                                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F00), ref: 0040489A
                                                                                                                                                                                                                        • SetCursor.USER32(00000000), ref: 0040489D
                                                                                                                                                                                                                        • SendMessageW.USER32(00000111,00000001,00000000), ref: 004048CC
                                                                                                                                                                                                                        • SendMessageW.USER32(00000010,00000000,00000000), ref: 004048DE
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
                                                                                                                                                                                                                        • String ID: Delete on reboot: $N
                                                                                                                                                                                                                        • API String ID: 3103080414-3180768264
                                                                                                                                                                                                                        • Opcode ID: 4011bf91f23cdad070dcf702cd0082b1ea04741390be1e297b86103e4649bf75
                                                                                                                                                                                                                        • Instruction ID: 9930e5d90db5dccbb26e86255d6156f8bb9eb7c4e216bd2cc4efdce7ef6c99e8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4011bf91f23cdad070dcf702cd0082b1ea04741390be1e297b86103e4649bf75
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8E6180B1A00209BFDB10AF64DD85A6A7B69FB84354F00843AF605B62D0D7B8AD51DF98
                                                                                                                                                                                                                        Function 004030A2 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 181memoryCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 651 4030a2-4030f0 GetTickCount GetModuleFileNameW call 406031 654 4030f2-4030f7 651->654 655 4030fc-40312a call 406541 call 405e5c call 406541 GetFileSize 651->655 656 4032d2-4032d6 654->656 663 403130 655->663 664 403215-403223 call 40303e 655->664 666 403135-40314c 663->666 671 403225-403228 664->671 672 403278-40327d 664->672 668 403150-403159 call 4034be 666->668 669 40314e 666->669 676 40327f-403287 call 40303e 668->676 677 40315f-403166 668->677 669->668 674 40322a-403242 call 4034d4 call 4034be 671->674 675 40324c-403276 GlobalAlloc call 4034d4 call 4032d9 671->675 672->656 674->672 698 403244-40324a 674->698 675->672 702 403289-40329a 675->702 676->672 680 4031e2-4031e6 677->680 681 403168-40317c call 405fec 677->681 685 4031f0-4031f6 680->685 686 4031e8-4031ef call 40303e 680->686 681->685 700 40317e-403185 681->700 693 403205-40320d 685->693 694 4031f8-403202 call 406a22 685->694 686->685 693->666 701 403213 693->701 694->693 698->672 698->675 700->685 704 403187-40318e 700->704 701->664 705 4032a2-4032a7 702->705 706 40329c 702->706 704->685 707 403190-403197 704->707 708 4032a8-4032ae 705->708 706->705 707->685 710 403199-4031a0 707->710 708->708 709 4032b0-4032cb SetFilePointer call 405fec 708->709 713 4032d0 709->713 710->685 712 4031a2-4031c2 710->712 712->672 714 4031c8-4031cc 712->714 713->656 715 4031d4-4031dc 714->715 716 4031ce-4031d2 714->716 715->685 717 4031de-4031e0 715->717 716->701 716->715 717->685
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 004030B3
                                                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\GlassWireSetup.exe,00000400), ref: 004030CF
                                                                                                                                                                                                                          • Part of subcall function 00406031: GetFileAttributesW.KERNEL32(00000003,004030E2,C:\Users\user\Desktop\GlassWireSetup.exe,80000000,00000003), ref: 00406035
                                                                                                                                                                                                                          • Part of subcall function 00406031: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00406057
                                                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,00438000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\GlassWireSetup.exe,C:\Users\user\Desktop\GlassWireSetup.exe,80000000,00000003), ref: 0040311B
                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?), ref: 00403251
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
                                                                                                                                                                                                                        • String ID: "C:\Users\user\Desktop\GlassWireSetup.exe"$C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$C:\Users\user\Desktop\GlassWireSetup.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
                                                                                                                                                                                                                        • API String ID: 2803837635-3590178600
                                                                                                                                                                                                                        • Opcode ID: f6f149303cde104692999693530b98443d3dd0b2c967e283c98aa5a581eac7be
                                                                                                                                                                                                                        • Instruction ID: 0f45a59523ef10b9f6d61eaf83b2f91e1f12d324a613ce28672a4e7bf9d48b30
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f6f149303cde104692999693530b98443d3dd0b2c967e283c98aa5a581eac7be
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7B51B071A01304AFDB209F65DD86B9E7FACAB08356F20417BF504B62D1CB789E818B5D
                                                                                                                                                                                                                        Function 0040657E Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 204stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 718 40657e-406587 719 406589-406598 718->719 720 40659a-4065b4 718->720 719->720 721 4067c4-4067ca 720->721 722 4065ba-4065c6 720->722 724 4067d0-4067dd 721->724 725 4065d8-4065e5 721->725 722->721 723 4065cc-4065d3 722->723 723->721 727 4067e9-4067ec 724->727 728 4067df-4067e4 call 406541 724->728 725->724 726 4065eb-4065f4 725->726 729 4067b1 726->729 730 4065fa-40663d 726->730 728->727 732 4067b3-4067bd 729->732 733 4067bf-4067c2 729->733 734 406643-40664f 730->734 735 406755-406759 730->735 732->721 733->721 736 406651 734->736 737 406659-40665b 734->737 738 40675b-406762 735->738 739 40678d-406791 735->739 736->737 742 406695-406698 737->742 743 40665d-40667b call 40640f 737->743 740 406772-40677e call 406541 738->740 741 406764-406770 call 406488 738->741 744 4067a1-4067af lstrlenW 739->744 745 406793-40679c call 40657e 739->745 756 406783-406789 740->756 741->756 749 40669a-4066a6 GetSystemDirectoryW 742->749 750 4066ab-4066ae 742->750 755 406680-406683 743->755 744->721 745->744 757 406738-40673b 749->757 752 4066c0-4066c4 750->752 753 4066b0-4066bc GetWindowsDirectoryW 750->753 752->757 758 4066c6-4066e4 752->758 753->752 759 406689-406690 call 40657e 755->759 760 40673d-406740 755->760 756->744 761 40678b 756->761 757->760 762 40674d-406753 call 4067ef 757->762 765 4066e6-4066ec 758->765 766 4066f8-406710 call 406935 758->766 759->757 760->762 763 406742-406748 lstrcatW 760->763 761->762 762->744 763->762 771 4066f4-4066f6 765->771 775 406712-406725 SHGetPathFromIDListW CoTaskMemFree 766->775 776 406727-406730 766->776 771->766 773 406732-406736 771->773 773->757 775->773 775->776 776->758 776->773
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetSystemDirectoryW.KERNEL32(Delete on reboot: ,00000400), ref: 004066A0
                                                                                                                                                                                                                        • GetWindowsDirectoryW.KERNEL32(Delete on reboot: ,00000400,00000000,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,?,?,00000000,00000000,00418EC0,00000000), ref: 004066B6
                                                                                                                                                                                                                        • SHGetPathFromIDListW.SHELL32(00000000,Delete on reboot: ), ref: 00406714
                                                                                                                                                                                                                        • CoTaskMemFree.OLE32(00000000,?,00000000,00000007), ref: 0040671D
                                                                                                                                                                                                                        • lstrcatW.KERNEL32(Delete on reboot: ,\Microsoft\Internet Explorer\Quick Launch,00000000,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,?,?,00000000,00000000,00418EC0,00000000), ref: 00406748
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(Delete on reboot: ,00000000,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,?,?,00000000,00000000,00418EC0,00000000), ref: 004067A2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Directory$FreeFromListPathSystemTaskWindowslstrcatlstrlen
                                                                                                                                                                                                                        • String ID: Delete on reboot: $Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
                                                                                                                                                                                                                        • API String ID: 4024019347-2609689930
                                                                                                                                                                                                                        • Opcode ID: 14c9f03641932d7153c154bb414b77852189b75d1473d82c894b9adbe9647435
                                                                                                                                                                                                                        • Instruction ID: 9d84e59ac7151f7caf92dcd2fae633819e279481621c74ff0a59597acd22528a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 14c9f03641932d7153c154bb414b77852189b75d1473d82c894b9adbe9647435
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 46612471A047119BD7209F28DC80B7A77E4AF58328F65053FF686B32D0DA3C89A5875E
                                                                                                                                                                                                                        Function 00401794 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 145stringtimeCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 841 401794-4017b9 call 402dcb call 405e87 846 4017c3-4017d5 call 406541 call 405e10 lstrcatW 841->846 847 4017bb-4017c1 call 406541 841->847 852 4017da-4017db call 4067ef 846->852 847->852 856 4017e0-4017e4 852->856 857 4017e6-4017f0 call 40689e 856->857 858 401817-40181a 856->858 866 401802-401814 857->866 867 4017f2-401800 CompareFileTime 857->867 859 401822-40183e call 406031 858->859 860 40181c-40181d call 40600c 858->860 868 401840-401843 859->868 869 4018b2-4018db call 4055c6 call 4032d9 859->869 860->859 866->858 867->866 870 401894-40189e call 4055c6 868->870 871 401845-401883 call 406541 * 2 call 40657e call 406541 call 405ba1 868->871 883 4018e3-4018ef SetFileTime 869->883 884 4018dd-4018e1 869->884 881 4018a7-4018ad 870->881 871->856 903 401889-40188a 871->903 886 402c58 881->886 885 4018f5-401900 CloseHandle 883->885 884->883 884->885 888 401906-401909 885->888 889 402c4f-402c52 885->889 890 402c5a-402c5e 886->890 892 40190b-40191c call 40657e lstrcatW 888->892 893 40191e-401921 call 40657e 888->893 889->886 900 401926-4023c7 call 405ba1 892->900 893->900 900->890 907 402953-40295a 900->907 903->881 905 40188c-40188d 903->905 905->870 907->889
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • lstrcatW.KERNEL32(00000000,00000000,Call,C:\Program Files (x86)\GlassWire,?,?,00000031), ref: 004017D5
                                                                                                                                                                                                                        • CompareFileTime.KERNEL32(-00000014,?,Call,Call,00000000,00000000,Call,C:\Program Files (x86)\GlassWire,?,?,00000031), ref: 004017FA
                                                                                                                                                                                                                          • Part of subcall function 00406541: lstrcpynW.KERNEL32(?,?,00000400,0040368E,00428A20,NSIS Error,?,00000008,0000000A,0000000C), ref: 0040654E
                                                                                                                                                                                                                          • Part of subcall function 004055C6: lstrlenW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,00000000,00418EC0,00000000,?,?,?,?,?,?,?,?,?,00403412,00000000,?), ref: 004055FE
                                                                                                                                                                                                                          • Part of subcall function 004055C6: lstrlenW.KERNEL32(00403412,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,00000000,00418EC0,00000000,?,?,?,?,?,?,?,?,?,00403412,00000000), ref: 0040560E
                                                                                                                                                                                                                          • Part of subcall function 004055C6: lstrcatW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,00403412,00403412,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,00000000,00418EC0,00000000), ref: 00405621
                                                                                                                                                                                                                          • Part of subcall function 004055C6: SetWindowTextW.USER32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\), ref: 00405633
                                                                                                                                                                                                                          • Part of subcall function 004055C6: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405659
                                                                                                                                                                                                                          • Part of subcall function 004055C6: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405673
                                                                                                                                                                                                                          • Part of subcall function 004055C6: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405681
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
                                                                                                                                                                                                                        • String ID: C:\Program Files (x86)\GlassWire$C:\Users\user\AppData\Local\Temp\nsx9694.tmp$C:\Users\user\AppData\Local\Temp\nsx9694.tmp\System.dll$Call
                                                                                                                                                                                                                        • API String ID: 1941528284-3449997827
                                                                                                                                                                                                                        • Opcode ID: b5c9de8d8c973790bb063ac1906df9c73b5cc822e409ceab015e7b2e817133de
                                                                                                                                                                                                                        • Instruction ID: 43cdcdb3dd666cfde73f7e2270c9ebc879cf542ec353fd5a36f292582218c0dc
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b5c9de8d8c973790bb063ac1906df9c73b5cc822e409ceab015e7b2e817133de
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0141B431910604BACB117BA9DD86DBE3AB5EF45329F21427FF412B10E1CB3C8A91966D
                                                                                                                                                                                                                        Function 004032D9 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 908 4032d9-4032f0 909 4032f2 908->909 910 4032f9-403301 908->910 909->910 911 403303 910->911 912 403308-40330d 910->912 911->912 913 40331d-40332a call 4034be 912->913 914 40330f-403318 call 4034d4 912->914 918 403330-403334 913->918 919 403475 913->919 914->913 920 40333a-40335a GetTickCount call 406a90 918->920 921 40345e-403460 918->921 922 403477-403478 919->922 934 4034b4 920->934 936 403360-403368 920->936 924 403462-403465 921->924 925 4034a9-4034ad 921->925 923 4034b7-4034bb 922->923 927 403467 924->927 928 40346a-403473 call 4034be 924->928 929 40347a-403480 925->929 930 4034af 925->930 927->928 928->919 942 4034b1 928->942 932 403482 929->932 933 403485-403493 call 4034be 929->933 930->934 932->933 933->919 945 403495-40349a call 4060e3 933->945 934->923 939 40336a 936->939 940 40336d-40337b call 4034be 936->940 939->940 940->919 946 403381-40338a 940->946 942->934 949 40349f-4034a1 945->949 948 403390-4033ad call 406ab0 946->948 954 4033b3-4033ca GetTickCount 948->954 955 403456-403458 948->955 951 4034a3-4034a6 949->951 952 40345a-40345c 949->952 951->925 952->922 956 403415-403417 954->956 957 4033cc-4033d4 954->957 955->922 960 403419-40341d 956->960 961 40344a-40344e 956->961 958 4033d6-4033da 957->958 959 4033dc-403412 MulDiv wsprintfW call 4055c6 957->959 958->956 958->959 959->956 964 403432-403438 960->964 965 40341f-403424 call 4060e3 960->965 961->936 962 403454 961->962 962->934 966 40343e-403442 964->966 970 403429-40342b 965->970 966->948 969 403448 966->969 969->934 970->952 971 40342d-403430 970->971 971->966
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CountTick$wsprintf
                                                                                                                                                                                                                        • String ID: ... %d%%
                                                                                                                                                                                                                        • API String ID: 551687249-2449383134
                                                                                                                                                                                                                        • Opcode ID: e7fa7c67b3f0a3124cb3a29f9b55057277156487209fd06c273e2d2da92cacc6
                                                                                                                                                                                                                        • Instruction ID: 37f968fffa50e4a1d2003f203ee40286d056d648d4267fa9fd8a089c231f80ea
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e7fa7c67b3f0a3124cb3a29f9b55057277156487209fd06c273e2d2da92cacc6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 39517E71900219EBCB11DF65D944BAF3FA8AF40766F14417BF804BB2C1D7789E408BA9
                                                                                                                                                                                                                        Function 004068C5 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36libraryCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 972 4068c5-4068e5 GetSystemDirectoryW 973 4068e7 972->973 974 4068e9-4068eb 972->974 973->974 975 4068fc-4068fe 974->975 976 4068ed-4068f6 974->976 978 4068ff-406932 wsprintfW LoadLibraryExW 975->978 976->975 977 4068f8-4068fa 976->977 977->978
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068DC
                                                                                                                                                                                                                        • wsprintfW.USER32 ref: 00406917
                                                                                                                                                                                                                        • LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040692B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: DirectoryLibraryLoadSystemwsprintf
                                                                                                                                                                                                                        • String ID: %s%S.dll$UXTHEME
                                                                                                                                                                                                                        • API String ID: 2200240437-1106614640
                                                                                                                                                                                                                        • Opcode ID: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
                                                                                                                                                                                                                        • Instruction ID: 5a11031caceee5166790be9fdf4905626ac305c011281564bfcfed8699633c36
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7a73cbb44207cafadb11ab8eaaa41fd963bfa172cfc882b2dd9c54e233860d96
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4FF0FC31501219A6CF10BB68DD0DF9B375C9B00304F10847EA546F10E0EB78D768C798
                                                                                                                                                                                                                        Function 00401DA6 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 979 401da6-401daa 980 401db9-401dbf GetDlgItem 979->980 981 401dac-401db7 call 402da9 979->981 982 401dc5-401df1 980->982 981->982 985 401df3-401dfa call 402dcb 982->985 986 401dfc 982->986 988 401e00-401e56 GetClientRect LoadImageW SendMessageW 985->988 986->988 990 401e64-401e67 988->990 991 401e58-401e5b 988->991 993 401e6d-401e6e 990->993 994 402c4f-402c5e 990->994 991->990 992 401e5d-401e5e DeleteObject 991->992 992->990 993->994
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetDlgItem.USER32(?,?), ref: 00401DBF
                                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 00401E0A
                                                                                                                                                                                                                        • LoadImageW.USER32(?,?,?,?,?,?), ref: 00401E3A
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000172,?,00000000), ref: 00401E4E
                                                                                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 00401E5E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ClientDeleteImageItemLoadMessageObjectRectSend
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1849352358-0
                                                                                                                                                                                                                        • Opcode ID: 24d559174ba8d1ea0ff588d178efc5a8b4b5bc163578ff463a4868f6c49c4eb4
                                                                                                                                                                                                                        • Instruction ID: eb17948d85696e98a42b5b2e026cdebc0bad80675354e43e8e08d2e827efe14e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 24d559174ba8d1ea0ff588d178efc5a8b4b5bc163578ff463a4868f6c49c4eb4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 94213B72D00119AFCB05DF98DE45AEEBBB5EB08300F14003AF945F62A0D7349D81DB98
                                                                                                                                                                                                                        Function 00401C68 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 998 401c68-401c88 call 402da9 * 2 1003 401c94-401c98 998->1003 1004 401c8a-401c91 call 402dcb 998->1004 1006 401ca4-401caa 1003->1006 1007 401c9a-401ca1 call 402dcb 1003->1007 1004->1003 1010 401cf8-401d22 call 402dcb * 2 FindWindowExW 1006->1010 1011 401cac-401cc8 call 402da9 * 2 1006->1011 1007->1006 1023 401d28 1010->1023 1021 401ce8-401cf6 SendMessageW 1011->1021 1022 401cca-401ce6 SendMessageTimeoutW 1011->1022 1021->1023 1024 401d2b-401d2e 1022->1024 1023->1024 1025 401d34 1024->1025 1026 402c4f-402c5e 1024->1026 1025->1026
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401CD8
                                                                                                                                                                                                                        • SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CF0
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: MessageSend$Timeout
                                                                                                                                                                                                                        • String ID: !
                                                                                                                                                                                                                        • API String ID: 1777923405-2657877971
                                                                                                                                                                                                                        • Opcode ID: e5ebd0c2485f00d6c9f151be0d8d18ef0011f408847e131bf1e0c601e94fb195
                                                                                                                                                                                                                        • Instruction ID: 7915d77c0e8d2f35ba529c4d8f0c1bf85837a2641dbb4ead1ffb962ccc12b17a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e5ebd0c2485f00d6c9f151be0d8d18ef0011f408847e131bf1e0c601e94fb195
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CC218071D1421AAEEB05AFA4D94AAFE7BB0EF44304F10453FF505B61D0D7B88941DB98
                                                                                                                                                                                                                        Function 00404D6D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(00422F08,00422F08,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,-0042A000), ref: 00404E0E
                                                                                                                                                                                                                        • wsprintfW.USER32 ref: 00404E17
                                                                                                                                                                                                                        • SetDlgItemTextW.USER32(?,00422F08), ref: 00404E2A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ItemTextlstrlenwsprintf
                                                                                                                                                                                                                        • String ID: %u.%u%s%s
                                                                                                                                                                                                                        • API String ID: 3540041739-3551169577
                                                                                                                                                                                                                        • Opcode ID: 808c56ceb77bc8fa6bb0a4fcfba6dc4e55d7e9e185af3d36fc5e6f51395c7837
                                                                                                                                                                                                                        • Instruction ID: 531ff4d773969165704d770d32cd75e70745a6e311be36c98e560407ed735fca
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 808c56ceb77bc8fa6bb0a4fcfba6dc4e55d7e9e185af3d36fc5e6f51395c7837
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1711EB73A0422837DB0056ADAC46E9E3698DF85374F250237FA66F21D5D978CC2142D8
                                                                                                                                                                                                                        Function 004024AF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64registrystringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsx9694.tmp,00000023,00000011,00000002), ref: 004024FA
                                                                                                                                                                                                                        • RegSetValueExW.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\nsx9694.tmp,00000000,00000011,00000002), ref: 0040253A
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsx9694.tmp,00000000,00000011,00000002), ref: 00402622
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseValuelstrlen
                                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\nsx9694.tmp
                                                                                                                                                                                                                        • API String ID: 2655323295-902317614
                                                                                                                                                                                                                        • Opcode ID: 37a11c6b0f51b22a2f33a6809eb4fcf72931e05cd9d281b1516a83ef08499fb1
                                                                                                                                                                                                                        • Instruction ID: 8b3a83999d63c16b18a9973427bcf430ab7992b94c8fe07ed2dd95b358db5eaa
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 37a11c6b0f51b22a2f33a6809eb4fcf72931e05cd9d281b1516a83ef08499fb1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1611B431D00114BEDB00AFA5DE59AAEB6B4EF44318F20443FF400B61D1C7B88E409668
                                                                                                                                                                                                                        Function 00405F18 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 47stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00406541: lstrcpynW.KERNEL32(?,?,00000400,0040368E,00428A20,NSIS Error,?,00000008,0000000A,0000000C), ref: 0040654E
                                                                                                                                                                                                                          • Part of subcall function 00405EBB: CharNextW.USER32(?,?,C:\,?,00405F2F,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C6D,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\GlassWireSetup.exe"), ref: 00405EC9
                                                                                                                                                                                                                          • Part of subcall function 00405EBB: CharNextW.USER32(00000000), ref: 00405ECE
                                                                                                                                                                                                                          • Part of subcall function 00405EBB: CharNextW.USER32(00000000), ref: 00405EE6
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(C:\,00000000,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C6D,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\GlassWireSetup.exe"), ref: 00405F71
                                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C6D,?,74DF3420,C:\Users\user\AppData\Local\Temp\), ref: 00405F81
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CharNext$AttributesFilelstrcpynlstrlen
                                                                                                                                                                                                                        • String ID: C:\$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                        • API String ID: 3248276644-3049482934
                                                                                                                                                                                                                        • Opcode ID: db39f955a116f1e539d990513461dc7a207fa728de065fffbfa736c70f2b9a34
                                                                                                                                                                                                                        • Instruction ID: 8289fae0aeb6f8c8bb33a18b648b52325edb3dacd4d1dfbf908f72671121fed4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: db39f955a116f1e539d990513461dc7a207fa728de065fffbfa736c70f2b9a34
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5EF0F435115E6326E722373A5C49AAF1A04CEC6324B59053BF8A5B22C1DF3C8D5389BE
                                                                                                                                                                                                                        Function 00406060 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 0040607E
                                                                                                                                                                                                                        • GetTempFileNameW.KERNEL32(?,?,00000000,?,?,?,00000000,0040351A,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806), ref: 00406099
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CountFileNameTempTick
                                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\$nsa
                                                                                                                                                                                                                        • API String ID: 1716503409-678247507
                                                                                                                                                                                                                        • Opcode ID: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
                                                                                                                                                                                                                        • Instruction ID: 6ac4114a0c6328616d68196ae331b9967fc339ed7b26ce04d623ba2336a1d7a6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 017de5c5da22b1c6cf72d7a8a287ef2c48f88e3ac937424cf3c6df762bd8e462
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D4F09076B40204BBEB00CF69ED05F9FB7ACEB95750F11803AFA01F7180E6B099548768
                                                                                                                                                                                                                        Function 004020FD Relevance: 6.1, APIs: 4, Instructions: 73libraryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(00000000,00000001,000000F0), ref: 00402128
                                                                                                                                                                                                                        • LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00402139
                                                                                                                                                                                                                        • KiUserCallbackDispatcher.NTDLL(?,00000400,?,0040CE28,0040A000,?,00000008,00000001,000000F0), ref: 00402189
                                                                                                                                                                                                                          • Part of subcall function 004055C6: lstrlenW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,00000000,00418EC0,00000000,?,?,?,?,?,?,?,?,?,00403412,00000000,?), ref: 004055FE
                                                                                                                                                                                                                          • Part of subcall function 004055C6: lstrlenW.KERNEL32(00403412,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,00000000,00418EC0,00000000,?,?,?,?,?,?,?,?,?,00403412,00000000), ref: 0040560E
                                                                                                                                                                                                                          • Part of subcall function 004055C6: lstrcatW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,00403412,00403412,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,00000000,00418EC0,00000000), ref: 00405621
                                                                                                                                                                                                                          • Part of subcall function 004055C6: SetWindowTextW.USER32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\), ref: 00405633
                                                                                                                                                                                                                          • Part of subcall function 004055C6: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405659
                                                                                                                                                                                                                          • Part of subcall function 004055C6: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405673
                                                                                                                                                                                                                          • Part of subcall function 004055C6: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405681
                                                                                                                                                                                                                        • FreeLibrary.KERNEL32(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 004021B6
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: MessageSend$Librarylstrlen$CallbackDispatcherFreeHandleLoadModuleTextUserWindowlstrcat
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 719239633-0
                                                                                                                                                                                                                        • Opcode ID: 87ca4aa348f59b6215766dcf7a4b6f1fb8702d7c164a10d0237d14db202080f8
                                                                                                                                                                                                                        • Instruction ID: 9d10c82c24da772f465f8b6e856316e7ef0d48b300f6b25f54a31c11c95ed806
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 87ca4aa348f59b6215766dcf7a4b6f1fb8702d7c164a10d0237d14db202080f8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F821A431904204EACF10AFA5CF49A9E7AB1BF44359F30413BF105B91E5CBBD8982DA2D
                                                                                                                                                                                                                        Function 004015E6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 00405EBB: CharNextW.USER32(?,?,C:\,?,00405F2F,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C6D,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\GlassWireSetup.exe"), ref: 00405EC9
                                                                                                                                                                                                                          • Part of subcall function 00405EBB: CharNextW.USER32(00000000), ref: 00405ECE
                                                                                                                                                                                                                          • Part of subcall function 00405EBB: CharNextW.USER32(00000000), ref: 00405EE6
                                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(?,?,00000000,0000005C,00000000,000000F0), ref: 0040163F
                                                                                                                                                                                                                          • Part of subcall function 00405A95: CreateDirectoryW.KERNEL32(0042C800,?), ref: 00405AD7
                                                                                                                                                                                                                        • SetCurrentDirectoryW.KERNEL32(?,C:\Program Files (x86)\GlassWire,?,00000000,000000F0), ref: 00401672
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • C:\Program Files (x86)\GlassWire, xrefs: 00401665
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CharNext$Directory$AttributesCreateCurrentFile
                                                                                                                                                                                                                        • String ID: C:\Program Files (x86)\GlassWire
                                                                                                                                                                                                                        • API String ID: 1892508949-786346560
                                                                                                                                                                                                                        • Opcode ID: 1cb6e0f2a5ab0800d51524057d62bd681975080efc3acd993a5567cdeed0022e
                                                                                                                                                                                                                        • Instruction ID: 707209c2395922376f9f001c82b8f9212c950a3f0646f554414056ec45e3a30b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1cb6e0f2a5ab0800d51524057d62bd681975080efc3acd993a5567cdeed0022e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DC11B231504514EBDF206FA5CD415AF36B0EF14368B25493FE942B22F1D63E4A81DA9D
                                                                                                                                                                                                                        Function 0040553A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • IsWindowVisible.USER32(?), ref: 00405569
                                                                                                                                                                                                                        • CallWindowProcW.USER32(?,?,?,?), ref: 004055BA
                                                                                                                                                                                                                          • Part of subcall function 0040450C: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040451E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Window$CallMessageProcSendVisible
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3748168415-3916222277
                                                                                                                                                                                                                        • Opcode ID: 8a6e7ab2b2ebc920f12c2d5b2b2096f2e9954bb0ec9a095f665350d4b71d8349
                                                                                                                                                                                                                        • Instruction ID: e9ac82e17096a71ceb81da4f6da7be56a9305aae285fff99253fdd5fe3b389a1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8a6e7ab2b2ebc920f12c2d5b2b2096f2e9954bb0ec9a095f665350d4b71d8349
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6B017171200609BFDF315F11DD84AAB3A66FB84754F100037FA00B51E5C7BA8D52AE69
                                                                                                                                                                                                                        Function 0040640F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RegQueryValueExW.KERNEL32(?,00000000,00000000,?,?,00000800,00000000,?,?,?,?,Delete on reboot: ,?,00000000,00406680,80000002), ref: 00406455
                                                                                                                                                                                                                        • RegCloseKey.KERNEL32(?), ref: 00406460
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseQueryValue
                                                                                                                                                                                                                        • String ID: Delete on reboot:
                                                                                                                                                                                                                        • API String ID: 3356406503-2410499825
                                                                                                                                                                                                                        • Opcode ID: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
                                                                                                                                                                                                                        • Instruction ID: ab0cc6cc405738cc07c99bf25685dc2411b0540f073fb059e05756a610da7e73
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5e421e957683aa7155fe1e1f393967b6404614e05e15b89e99e168e2dc4a01c3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4F015E72510209AADF218F51CC05EDB3BA8EB54354F01403AFD5992150D738D968DB94
                                                                                                                                                                                                                        Function 00403B7E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • FreeLibrary.KERNEL32(?,74DF3420,00000000,C:\Users\user\AppData\Local\Temp\,00403B56,00403A6C,?,?,00000008,0000000A,0000000C), ref: 00403B98
                                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 00403B9F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00403B7E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Free$GlobalLibrary
                                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                        • API String ID: 1100898210-3081826266
                                                                                                                                                                                                                        • Opcode ID: 628ac1cb43285a1a84ac4c7f875ed8910a03c7a164280e3efa8a6a131abbe062
                                                                                                                                                                                                                        • Instruction ID: 6342289a3e1e3ca18c24491f6708bfd4349b13536718f8c5743bc800c8661b5d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 628ac1cb43285a1a84ac4c7f875ed8910a03c7a164280e3efa8a6a131abbe062
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FBE08C329015205BC6211F19ED04B1A77B86F45B27F06402AE8807B26287B82C838FD8
                                                                                                                                                                                                                        Function 00407094 Relevance: 5.2, APIs: 4, Instructions: 236COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 2ff22e2e2fe9ce3de78e7ddd3335664d820a6fec416f6b591a6c72a947d9530d
                                                                                                                                                                                                                        • Instruction ID: 57bf2fd90c69a3a2134d3ca1d9604f9a54cf20ddad3feead76618616929b2f58
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2ff22e2e2fe9ce3de78e7ddd3335664d820a6fec416f6b591a6c72a947d9530d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 17A15471E04229CBDF28CFA8C8546ADBBB1FF44305F10846ED816BB281D7786A86DF45
                                                                                                                                                                                                                        Function 00407295 Relevance: 5.2, APIs: 4, Instructions: 208COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 0bdb7e84a84856003d11171116f50dfbd9bb9a779b2e7a3e4899fdc47cedc848
                                                                                                                                                                                                                        • Instruction ID: 6b1c66eb9f97b1ade68f1d395623a9ed29f1776dbc94043a645b3c6b65beda35
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0bdb7e84a84856003d11171116f50dfbd9bb9a779b2e7a3e4899fdc47cedc848
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C5912270E04228CBDF28CF98C854BADBBB1FF44305F14816AD856BB281D778A986DF45
                                                                                                                                                                                                                        Function 00406FAB Relevance: 5.2, APIs: 4, Instructions: 205COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: be7a598e94a0405de8a772e3f69c54869daecda94b4303a07673bf76e2652f1c
                                                                                                                                                                                                                        • Instruction ID: ce41943af36f178b06a8ef9aeec7331a28cc36c4f565c07526a7a1ecbc0683f6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: be7a598e94a0405de8a772e3f69c54869daecda94b4303a07673bf76e2652f1c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8C813571E04228CFDF24CFA8C844BADBBB1FB45305F24816AD456BB281D778A986DF45
                                                                                                                                                                                                                        Function 00406AB0 Relevance: 5.2, APIs: 4, Instructions: 198COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 32d59b201beac9d8f322f7ad5055b4a277c8e7969ed8db35c8d1fbf5724c7b18
                                                                                                                                                                                                                        • Instruction ID: 8f4657df29e0a6c4f41eae1c6e560b42ebe12933d6c33c39fa024371cffe791d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 32d59b201beac9d8f322f7ad5055b4a277c8e7969ed8db35c8d1fbf5724c7b18
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F4815771E04228DBDF24CFA8C8447ADBBB1FF44315F10816AD856BB281D7786986DF45
                                                                                                                                                                                                                        Function 00406EFE Relevance: 5.2, APIs: 4, Instructions: 180COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 5ad3ccd1842de9fa96a72a1c56b2a37abd66cddd4bfb2a4aa43cc43f3deb674d
                                                                                                                                                                                                                        • Instruction ID: 467485e0bb60f7ca81b57cb4e762169b1f98b62e9d0b722d18e83a7fcf81438f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5ad3ccd1842de9fa96a72a1c56b2a37abd66cddd4bfb2a4aa43cc43f3deb674d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 04711375E04228CBDF24CFA8C844BADBBF1FB48305F15806AD856B7281D778A986DF45
                                                                                                                                                                                                                        Function 0040701C Relevance: 5.2, APIs: 4, Instructions: 170COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 702cc36666a341df00ed023e166d9505421316bb70e071c2ca241f15019959e6
                                                                                                                                                                                                                        • Instruction ID: 8594309fab6a939f8579025671b20e25c27ad2f20b93bd04310bc8f9388019e2
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 702cc36666a341df00ed023e166d9505421316bb70e071c2ca241f15019959e6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A6713471E04228CBDF28CF98C844BADBBB1FF45305F14806AD816BB281D778A986DF45
                                                                                                                                                                                                                        Function 00406F68 Relevance: 5.2, APIs: 4, Instructions: 168COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 97fac772243d771687d70cd7bd51d4e603ca3fb4096038018fdbee07d45d8760
                                                                                                                                                                                                                        • Instruction ID: 804367245b599a5d262e6525417658d62bb0317a144133a249ff79fbb491f744
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 97fac772243d771687d70cd7bd51d4e603ca3fb4096038018fdbee07d45d8760
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 04712571E04228CBDF28CF98C854BADBBB1FF44305F15806AD856B7281C778A986DF45
                                                                                                                                                                                                                        Function 00402324 Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 0040689E: FindFirstFileW.KERNEL32(74DF3420,00425F58,C:\,00405F61,C:\,C:\,00000000,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C6D,?,74DF3420,C:\Users\user\AppData\Local\Temp\), ref: 004068A9
                                                                                                                                                                                                                          • Part of subcall function 0040689E: FindClose.KERNEL32(00000000), ref: 004068B5
                                                                                                                                                                                                                        • lstrlenW.KERNEL32 ref: 00402364
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(00000000), ref: 0040236F
                                                                                                                                                                                                                        • SHFileOperationW.SHELL32(?,?,?,00000000), ref: 00402398
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FileFindlstrlen$CloseFirstOperation
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1486964399-0
                                                                                                                                                                                                                        • Opcode ID: a3bb19d95e476dd8bbc583506952c5cdcba294f5665b9ee25fc4d3e851aba20e
                                                                                                                                                                                                                        • Instruction ID: 4b56b22c303741424533d160fa84e2ffed8a1021af9df4f2b95841071a9a5ea9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a3bb19d95e476dd8bbc583506952c5cdcba294f5665b9ee25fc4d3e851aba20e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 44118671910314AADB10EFF98D0A99EB7F8AF04304F10443FA505F71D5D7B8C9418B69
                                                                                                                                                                                                                        Function 00405C05 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 0040600C: GetFileAttributesW.KERNEL32(?,?,00405C11,?,?,00000000,00405DE7,?,?,?,?), ref: 00406011
                                                                                                                                                                                                                          • Part of subcall function 0040600C: SetFileAttributesW.KERNEL32(?,00000000), ref: 00406025
                                                                                                                                                                                                                        • RemoveDirectoryW.KERNEL32(?,?,?,00000000,00405DE7), ref: 00405C20
                                                                                                                                                                                                                        • DeleteFileW.KERNEL32(?,?,?,00000000,00405DE7), ref: 00405C28
                                                                                                                                                                                                                        • SetFileAttributesW.KERNEL32(?,00000000), ref: 00405C40
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: File$Attributes$DeleteDirectoryRemove
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1655745494-0
                                                                                                                                                                                                                        • Opcode ID: db7f6541ced3958ca03b9484ad33d053af3f68eb31512009fba6ce163230055c
                                                                                                                                                                                                                        • Instruction ID: 21c1b26766a80c26ab34b8335d5319d4b2b0a8cd46ef6be29cca4843f5d65557
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: db7f6541ced3958ca03b9484ad33d053af3f68eb31512009fba6ce163230055c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 56E0653150D79056E22057355A08A9B2AD9DFC6725F05093AF8A1B11D4CB78444A8E6D
                                                                                                                                                                                                                        Function 004069E0 Relevance: 4.5, APIs: 3, Instructions: 27synchronizationCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,00000064), ref: 004069F1
                                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00406A06
                                                                                                                                                                                                                        • GetExitCodeProcess.KERNEL32(?,?), ref: 00406A13
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ObjectSingleWait$CodeExitProcess
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2567322000-0
                                                                                                                                                                                                                        • Opcode ID: 2f96d25466b50161d36a247ea1857d3da149f4b0ac0fce789d184ce1e3082720
                                                                                                                                                                                                                        • Instruction ID: acb36e27aab87908a79ffd06662c499a3f36dd0ca49ed4bb2a313832a7c32036
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2f96d25466b50161d36a247ea1857d3da149f4b0ac0fce789d184ce1e3082720
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 09E09272600208BBDB009B54CD01D9E7B6ADB45704F110036BA05B6190C6B5AE62DB98
                                                                                                                                                                                                                        Function 00404499 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SendMessageW.USER32(00000408,?,00000000,004040F8), ref: 004044B7
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                                        • String ID: x
                                                                                                                                                                                                                        • API String ID: 3850602802-2363233923
                                                                                                                                                                                                                        • Opcode ID: e278e9d37010375a50761408d456b72e73770d9f1980e034c35bddb088f409a6
                                                                                                                                                                                                                        • Instruction ID: 073c857c58a4ee18543911d40a8e244073c6e17ea65c180b90953d4a8c94edec
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e278e9d37010375a50761408d456b72e73770d9f1980e034c35bddb088f409a6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9AC012B2681200AADB219B40DE01F1A7B31A7A4712F10843EF380200B08A7018A2DB0D
                                                                                                                                                                                                                        Function 0040254F Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RegQueryValueExW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,00000033), ref: 00402580
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,C:\Users\user\AppData\Local\Temp\nsx9694.tmp,00000000,00000011,00000002), ref: 00402622
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseQueryValue
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3356406503-0
                                                                                                                                                                                                                        • Opcode ID: df434ad9e61f8f71b2db311f576036875c1165a0340788b8ea338e36c311122b
                                                                                                                                                                                                                        • Instruction ID: d59507dec88f13297dcb42e268b6e0170753ff524d958fced3891ef78adf3038
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: df434ad9e61f8f71b2db311f576036875c1165a0340788b8ea338e36c311122b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8F118C71904216EADF15DFA0CA589AEB7B4FF04348F20443FE806B62D0D3B84A45DB9D
                                                                                                                                                                                                                        Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
                                                                                                                                                                                                                        • SendMessageW.USER32(0040A2D8,00000402,00000000), ref: 004013F4
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3850602802-0
                                                                                                                                                                                                                        • Opcode ID: 24120cd7971efbcf380a3cfcf85aef56aa5faf56da28ec4d1ccb8bb0957475b6
                                                                                                                                                                                                                        • Instruction ID: 2b867b2a322a557ec20ecaa395e060e0be7e2a6973b32d365fcb6e947ad1390c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 24120cd7971efbcf380a3cfcf85aef56aa5faf56da28ec4d1ccb8bb0957475b6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9E01F4327242209BE7195B389D05B6B3798E710314F10863FF855F66F1DA78CC429B4C
                                                                                                                                                                                                                        Function 00405699 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • OleInitialize.OLE32(00000000), ref: 004056A9
                                                                                                                                                                                                                          • Part of subcall function 0040450C: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040451E
                                                                                                                                                                                                                        • CoUninitialize.COMBASE(00000404,00000000), ref: 004056F5
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InitializeMessageSendUninitialize
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2896919175-0
                                                                                                                                                                                                                        • Opcode ID: e6b44ab65c096e2096ca35a4d59063f1915fe47593d787d59728b780318f1d57
                                                                                                                                                                                                                        • Instruction ID: b888f1dcde8397bdf9a4ac710541df7d57aeeece4d3a8f29a6716c55d94af5f1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e6b44ab65c096e2096ca35a4d59063f1915fe47593d787d59728b780318f1d57
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0AF0B4776007409BE7115B54AE05B5B77B0EB90354F85483AEF8D726F1C7764C028B5D
                                                                                                                                                                                                                        Function 00405A95 Relevance: 3.0, APIs: 2, Instructions: 26COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateDirectoryW.KERNEL32(0042C800,?), ref: 00405AD7
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 00405AE5
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1375471231-0
                                                                                                                                                                                                                        • Opcode ID: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
                                                                                                                                                                                                                        • Instruction ID: d90010de02f5ef9460f17531ca4347861228eabf88ca3652e96e8ae86f83f0cd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 93d1f65b513afb97053b6d969de6af344d99c991354c8e43ed6bd2c6eb9068ab
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5FF017B1D0060EDBDF00CFA4D6487EFBBB4AF04309F00812AD941B6281D7B882488FE9
                                                                                                                                                                                                                        Function 00401F03 Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ShowWindow.USER32(00000000,00000000), ref: 00401F21
                                                                                                                                                                                                                        • EnableWindow.USER32(00000000,00000000), ref: 00401F2C
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Window$EnableShow
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1136574915-0
                                                                                                                                                                                                                        • Opcode ID: 1c1008cabeb65706c4d80cd9f40d1efee8b09dc724503127a4cfafcc83429b1a
                                                                                                                                                                                                                        • Instruction ID: cc057469d20fee5af05168c8280afa7b014ceb16d0f4b1b408cb009327ac905f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c1008cabeb65706c4d80cd9f40d1efee8b09dc724503127a4cfafcc83429b1a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7BE04876908610DFE754EBA4AE495EE73B4EF80365B10097FE001F11D1D7B94D00975D
                                                                                                                                                                                                                        Function 00405B24 Relevance: 3.0, APIs: 2, Instructions: 24processCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateProcessW.KERNEL32(00000000,0042C800,00000000,00000000,00000000,04000000,00000000,00000000,00425F10,?,?,?,0042C800,?), ref: 00405B4D
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?,0042C800,?), ref: 00405B5A
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseCreateHandleProcess
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3712363035-0
                                                                                                                                                                                                                        • Opcode ID: ab728716b39bc4ae5022fc4c28ab15e9e5542c8e0cf41f1555c5a84b4fa30c9d
                                                                                                                                                                                                                        • Instruction ID: 3e6b85693243cf5959e47e0a5ce0ecee53803ede082a99688cf67a66356fc275
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ab728716b39bc4ae5022fc4c28ab15e9e5542c8e0cf41f1555c5a84b4fa30c9d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3AE0BFB4A10219BFFB10AB64ED05F7B77BCF704604F418825BD10F2551D774A9148A7C
                                                                                                                                                                                                                        Function 00406935 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(?,00000020,?,0040362C,0000000C,?,?,?,?,?,?,?,?), ref: 00406947
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,?), ref: 00406962
                                                                                                                                                                                                                          • Part of subcall function 004068C5: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004068DC
                                                                                                                                                                                                                          • Part of subcall function 004068C5: wsprintfW.USER32 ref: 00406917
                                                                                                                                                                                                                          • Part of subcall function 004068C5: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040692B
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2547128583-0
                                                                                                                                                                                                                        • Opcode ID: fa9529b661a20328ef717d54741181462d2da8a99b8882de0ad3477ad76f042b
                                                                                                                                                                                                                        • Instruction ID: 5f896a6f513cb693e05c26686958cbb9026995673407ad46a654cc37c4de4e39
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fa9529b661a20328ef717d54741181462d2da8a99b8882de0ad3477ad76f042b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BCE0CD73604310EBD61067755D0493773E89F85B50302483EF947F2140D734DC32A7AA
                                                                                                                                                                                                                        Function 00402C2A Relevance: 3.0, APIs: 2, Instructions: 21windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000000B,?), ref: 00402C39
                                                                                                                                                                                                                        • InvalidateRect.USER32(?), ref: 00402C49
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InvalidateMessageRectSend
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 909852535-0
                                                                                                                                                                                                                        • Opcode ID: 04029d6712b3ec0f937b0f2920279da8c4e9e08754be6b5f55e565d51ec051e0
                                                                                                                                                                                                                        • Instruction ID: 05598acf5c7af108251ebea2eef134ebc896970cc080083959604efc312f4b68
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 04029d6712b3ec0f937b0f2920279da8c4e9e08754be6b5f55e565d51ec051e0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 85E046B2600104BFEB109B94EE849AEB7B9EB80205B00047AE201A00A0D7740C818A28
                                                                                                                                                                                                                        Function 00406031 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(00000003,004030E2,C:\Users\user\Desktop\GlassWireSetup.exe,80000000,00000003), ref: 00406035
                                                                                                                                                                                                                        • CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00406057
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: File$AttributesCreate
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 415043291-0
                                                                                                                                                                                                                        • Opcode ID: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
                                                                                                                                                                                                                        • Instruction ID: 9d50a09f5748d4f60ef03139cc16a9656d1073ae209d3065c053d14625e31d4c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6be4d53c09d0ea7202590e2ef391dde9d68f005235e9a58d36352f422cb06a2c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 87D09E31654301AFEF098F20DE16F2EBAA2EB84B00F11552CB682941E0DA715819DB15
                                                                                                                                                                                                                        Function 0040600C Relevance: 3.0, APIs: 2, Instructions: 13COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(?,?,00405C11,?,?,00000000,00405DE7,?,?,?,?), ref: 00406011
                                                                                                                                                                                                                        • SetFileAttributesW.KERNEL32(?,00000000), ref: 00406025
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AttributesFile
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3188754299-0
                                                                                                                                                                                                                        • Opcode ID: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
                                                                                                                                                                                                                        • Instruction ID: fbd6844141adfc982ff7d741096df028d7bbee698e850df9006aa2ae5f51d9dd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bc30e5c928ed30f9cb3e730bb3a024ff28878b527ec9bdb2640fa07c227b463d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 24D0C972504221AFC2103728EE0889BBF55DB542717028A35F8A9A22B0CB304C668694
                                                                                                                                                                                                                        Function 00403B39 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(FFFFFFFF,00403A6C,?,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00403B44
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\nsx9694.tmp\, xrefs: 00403B58
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseHandle
                                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\
                                                                                                                                                                                                                        • API String ID: 2962429428-1815885787
                                                                                                                                                                                                                        • Opcode ID: bf978e923f6b918306acec48239fbd538ac0084e51c586c4fd0b1848a54ae116
                                                                                                                                                                                                                        • Instruction ID: 8dac91232a398f62bf45de51be5dc2ff74670ad6c91f22ea1f9351e9d641195c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bf978e923f6b918306acec48239fbd538ac0084e51c586c4fd0b1848a54ae116
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4BC0123050870896D5247F799E4FF093A249B40339B608325B0B9B10F2D73CA659596D
                                                                                                                                                                                                                        Function 00405AEF Relevance: 3.0, APIs: 2, Instructions: 9COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateDirectoryW.KERNEL32(?,00000000,0040350F,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806,?,00000008,0000000A,0000000C), ref: 00405AF5
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405B03
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1375471231-0
                                                                                                                                                                                                                        • Opcode ID: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
                                                                                                                                                                                                                        • Instruction ID: c3646108da72950d5b730f2af08982bf7448ccd78712563759f5c9f930c8cbe9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7ce514c051633c67dabed91c1ba2c830ad6f4192d7236d4c27a26ed09d9cb01d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 11C04C70244906DAD6509B219F0C71779A0EB50781F195839A586E50A0DA34B455D92D
                                                                                                                                                                                                                        Function 004063DC Relevance: 1.5, APIs: 1, Instructions: 24registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RegCreateKeyExW.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,00402E7C,00000000,?,?), ref: 00406405
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Create
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2289755597-0
                                                                                                                                                                                                                        • Opcode ID: b17b4e85cc10dff7c00d1995fa2300a068af545831f113dbcef6cd8b4d780b07
                                                                                                                                                                                                                        • Instruction ID: 15c5175e75f921513b7f3d75ccef30e451623c4c54541e9d5ee9eac1385433f3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b17b4e85cc10dff7c00d1995fa2300a068af545831f113dbcef6cd8b4d780b07
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1DE0E6B2010109BFEF195F50DD0AD7B371DEB04310F01492EFE16D4051E6B5E9306674
                                                                                                                                                                                                                        Function 004060E3 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • WriteFile.KERNEL32(00000000,00000000,00000004,00000004,00000000,?,?,0040349F,00000000,00414EC0,?,00414EC0,?,000000FF,00000004,00000000), ref: 004060F7
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FileWrite
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3934441357-0
                                                                                                                                                                                                                        • Opcode ID: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
                                                                                                                                                                                                                        • Instruction ID: b9d802e93a63440494d75fc60edee4ff4d41d1542efeb3ab79d4fb436c6ecda5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4494c28c6fc58b77f7b94402ffbb10e79d92760fb9961e7d9dbcb201027e3d13
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 91E08C3220422AABEF109E909C04EEB3B6CEB003A0F014432FD26E6050D271E9319BA4
                                                                                                                                                                                                                        Function 004060B4 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,00000000,00000004,00000004,00000000,000000FF,?,004034D1,00000000,00000000,00403328,000000FF,00000004,00000000,00000000,00000000), ref: 004060C8
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FileRead
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2738559852-0
                                                                                                                                                                                                                        • Opcode ID: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
                                                                                                                                                                                                                        • Instruction ID: 0a9ed9335d9fcbf33a9b7557f86da276afb46ac39f2db62fb679b5cfb923300a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 076a4193e787d8b2f8fcded04b516b0b1a94860d7d4352c54bed072072f3bbd3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C1E0BF32250269ABDF109E559C00AAB775CEB05251F014436B955E7150D671E92197A4
                                                                                                                                                                                                                        Function 004063AE Relevance: 1.5, APIs: 1, Instructions: 19registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RegOpenKeyExW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,0040643C,?,?,?,?,Delete on reboot: ,?,00000000), ref: 004063D2
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Open
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 71445658-0
                                                                                                                                                                                                                        • Opcode ID: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
                                                                                                                                                                                                                        • Instruction ID: 160c38975f312424f4866d14917befa5dd24af40cdf73f4d33e28196d90f96f9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8ee5b0d2344bda13eae74e7442d869633e0228d129a7f9cdea9876c3f2a2c01f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 44D0123204020EBBDF115E90ED01FAB3B1DAB08350F014426FE06E40A0D775D534A754
                                                                                                                                                                                                                        Function 00406301 Relevance: 1.5, APIs: 1, Instructions: 13COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • MoveFileExW.KERNEL32(?,?,00000005,00405DFF,?,00000000,000000F1,?,?,?,?,?), ref: 0040630B
                                                                                                                                                                                                                          • Part of subcall function 00406187: CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406322,?,?), ref: 004061C2
                                                                                                                                                                                                                          • Part of subcall function 00406187: GetShortPathNameW.KERNEL32(?,004265A8,00000400), ref: 004061CB
                                                                                                                                                                                                                          • Part of subcall function 00406187: GetShortPathNameW.KERNEL32(?,00426DA8,00000400), ref: 004061E8
                                                                                                                                                                                                                          • Part of subcall function 00406187: wsprintfA.USER32 ref: 00406206
                                                                                                                                                                                                                          • Part of subcall function 00406187: GetFileSize.KERNEL32(00000000,00000000,00426DA8,C0000000,00000004,00426DA8,?,?,?,?,?), ref: 00406241
                                                                                                                                                                                                                          • Part of subcall function 00406187: GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406250
                                                                                                                                                                                                                          • Part of subcall function 00406187: lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406288
                                                                                                                                                                                                                          • Part of subcall function 00406187: SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,004261A8,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004062DE
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: File$NamePathShort$AllocCloseGlobalHandleMovePointerSizelstrcpywsprintf
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1930046112-0
                                                                                                                                                                                                                        • Opcode ID: 87c926fc95ae7938b81539e09e99e95bbb55a93a973ed36a8b4e4a1904159c3b
                                                                                                                                                                                                                        • Instruction ID: 54492c16842c77241f43bce0bfba16d72431ff9e8cb3ec7b1b4de0b7cf925a5c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 87c926fc95ae7938b81539e09e99e95bbb55a93a973ed36a8b4e4a1904159c3b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 62D09E35108241BEDA111B50DD05A1B7BA1FB54355F11842EF595540B5D7318461DB05
                                                                                                                                                                                                                        Function 004044C0 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SetDlgItemTextW.USER32(?,?,00000000), ref: 004044DA
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ItemText
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3367045223-0
                                                                                                                                                                                                                        • Opcode ID: 9f5f9317995870dd68fcf34551989b3f9c33a874f6e62bdf9e4bbf2fb329bfe5
                                                                                                                                                                                                                        • Instruction ID: 618a4d147dc132ed767a0170a37b1b1b02e02631c050cf9c70678d3d8149d648
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9f5f9317995870dd68fcf34551989b3f9c33a874f6e62bdf9e4bbf2fb329bfe5
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0CC08C31008300BFD241AB54DC02F1FB7A9EFA0315F00C42EB05CA10D1C63494308A2A
                                                                                                                                                                                                                        Function 0040450C Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00000000,00000000,00000000), ref: 0040451E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3850602802-0
                                                                                                                                                                                                                        • Opcode ID: c543a5305144ba01004fe0d35289a86565b01ad173ebec7ef44f324a9b2ac024
                                                                                                                                                                                                                        • Instruction ID: 43b4292f00af6435b8222dbb4ed8e84b3d95e84959177ba0714352b3dfcaa9b9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c543a5305144ba01004fe0d35289a86565b01ad173ebec7ef44f324a9b2ac024
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 40C09BF17413017BDA209B509E45F1777989795701F15453D7350F50E0CBB4E450D61D
                                                                                                                                                                                                                        Function 004034D4 Relevance: 1.5, APIs: 1, Instructions: 6COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00403267,?), ref: 004034E2
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FilePointer
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 973152223-0
                                                                                                                                                                                                                        • Opcode ID: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
                                                                                                                                                                                                                        • Instruction ID: 1f5c7ae16c2334422adcad36111bde95194575cbdac9b1f52e29a9f6e91cc98e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9851be0de28bb9513f6e500a0df6ea838ed72b99fd7baa621d8f85bec57c8f40
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 34B01271240300BFDA214F00DF09F057B21ABA0700F10C034B388380F086711035EB0D
                                                                                                                                                                                                                        Function 004044F5 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SendMessageW.USER32(00000028,?,00000001,00404320), ref: 00404503
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: MessageSend
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3850602802-0
                                                                                                                                                                                                                        • Opcode ID: 0b5dc737e690c2697fce459c5807109f7a0ee7b6821d5e504b87bae23edcb368
                                                                                                                                                                                                                        • Instruction ID: a1e91a2b22b377b77c28deac9acb262fc7b3ebada01c3a2f9bc193e64980b6bc
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0b5dc737e690c2697fce459c5807109f7a0ee7b6821d5e504b87bae23edcb368
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E9B09236690A40AADA215B00DE09F867B62A7A8701F008438B240640B0CAB204A1DB08
                                                                                                                                                                                                                        Function 004044E2 Relevance: 1.5, APIs: 1, Instructions: 4COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • KiUserCallbackDispatcher.NTDLL(?,004042B9), ref: 004044EC
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CallbackDispatcherUser
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2492992576-0
                                                                                                                                                                                                                        • Opcode ID: 1338f86397f00e2d38996c3f1ae94053e56d426343b35a23e1e428530b57d47f
                                                                                                                                                                                                                        • Instruction ID: bf70c606a766814dc6d2ff6c1013b69bc1ca18b78975ad7518874070628387b3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1338f86397f00e2d38996c3f1ae94053e56d426343b35a23e1e428530b57d47f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BEA00176544900ABCA16AB50EF0980ABB72BBA8701B528879A285510388B725921FB19
                                                                                                                                                                                                                        Function 00401FC9 Relevance: 1.3, APIs: 1, Instructions: 37COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 004055C6: lstrlenW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,00000000,00418EC0,00000000,?,?,?,?,?,?,?,?,?,00403412,00000000,?), ref: 004055FE
                                                                                                                                                                                                                          • Part of subcall function 004055C6: lstrlenW.KERNEL32(00403412,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,00000000,00418EC0,00000000,?,?,?,?,?,?,?,?,?,00403412,00000000), ref: 0040560E
                                                                                                                                                                                                                          • Part of subcall function 004055C6: lstrcatW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,00403412,00403412,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,00000000,00418EC0,00000000), ref: 00405621
                                                                                                                                                                                                                          • Part of subcall function 004055C6: SetWindowTextW.USER32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\), ref: 00405633
                                                                                                                                                                                                                          • Part of subcall function 004055C6: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405659
                                                                                                                                                                                                                          • Part of subcall function 004055C6: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405673
                                                                                                                                                                                                                          • Part of subcall function 004055C6: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405681
                                                                                                                                                                                                                          • Part of subcall function 00405B24: CreateProcessW.KERNEL32(00000000,0042C800,00000000,00000000,00000000,04000000,00000000,00000000,00425F10,?,?,?,0042C800,?), ref: 00405B4D
                                                                                                                                                                                                                          • Part of subcall function 00405B24: CloseHandle.KERNEL32(?,?,?,0042C800,?), ref: 00405B5A
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00402010
                                                                                                                                                                                                                          • Part of subcall function 004069E0: WaitForSingleObject.KERNEL32(?,00000064), ref: 004069F1
                                                                                                                                                                                                                          • Part of subcall function 004069E0: GetExitCodeProcess.KERNEL32(?,?), ref: 00406A13
                                                                                                                                                                                                                          • Part of subcall function 00406488: wsprintfW.USER32 ref: 00406495
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2972824698-0
                                                                                                                                                                                                                        • Opcode ID: 2d607f1bf2ca170bc3d6f64f92f6dd8aeb75856f7c63c06f009c06d0601a611c
                                                                                                                                                                                                                        • Instruction ID: 2b527fce213089fa12a92f7baeb69a5519dacc7bd52e038cdd259e112745fe09
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2d607f1bf2ca170bc3d6f64f92f6dd8aeb75856f7c63c06f009c06d0601a611c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D0F09632904611ABDF30BBA59A895DF76B49F0035CF21413FE202B25D5C6BD4E41E76E
                                                                                                                                                                                                                        Function 004014D7 Relevance: 1.3, APIs: 1, Instructions: 19sleepCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Sleep
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3472027048-0
                                                                                                                                                                                                                        • Opcode ID: 9a1b5a27ba3911e60aaf45add60389551514325057df3a3a6d7f456cd2b0b035
                                                                                                                                                                                                                        • Instruction ID: e6b49e8a87e12584c98259587c1c339c470cc3bab6c16d9c19951aa04c657e62
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9a1b5a27ba3911e60aaf45add60389551514325057df3a3a6d7f456cd2b0b035
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E1D05E73A146009BD754EBB8BE8549F73A8EA50319320483BD102E1091E6788902461C

                                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                                        Function 053F6E01 Relevance: 2.9, Strings: 2, Instructions: 433COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, Offset: 053EF000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_53e6000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: k`p$43
                                                                                                                                                                                                                        • API String ID: 0-2465762537
                                                                                                                                                                                                                        • Opcode ID: 479f6a9b77305a649e0c0b50eaa8ab8419653e25daa7d702ab6a3c53642dfe1c
                                                                                                                                                                                                                        • Instruction ID: 41343066151eb881bc7ed233c61f126c505cd8ca1df2a71ef505ca398082910f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 479f6a9b77305a649e0c0b50eaa8ab8419653e25daa7d702ab6a3c53642dfe1c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 90F1036251E3D29FD7138B7498A67827FB0AF17214B1E49EBC1C0CF5A3D259984AC723
                                                                                                                                                                                                                        Function 053F6F7F Relevance: 2.8, Strings: 2, Instructions: 269COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, Offset: 053EF000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_53e6000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: 43$?
                                                                                                                                                                                                                        • API String ID: 0-981363128
                                                                                                                                                                                                                        • Opcode ID: 64594f9667371af8addbca8b19af50cc6c19669cd64d59dd817d5fda81b8da8e
                                                                                                                                                                                                                        • Instruction ID: 58d047a740755d1bcc05950a35d6d3968fd3c103515293efd13e5aed1a11a974
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 64594f9667371af8addbca8b19af50cc6c19669cd64d59dd817d5fda81b8da8e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 53B1E06251E3D29FD7538B7498A6A853FB0AF27211B0E44EBC1C0CF1E3D259984AD723
                                                                                                                                                                                                                        Function 00402930 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 0040293F
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FileFindFirst
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1974802433-0
                                                                                                                                                                                                                        • Opcode ID: 79cd65a6ba4c4f8614d2d44d2a0d076d8c5b6b6456474cad0f31bdfcd7c7fe30
                                                                                                                                                                                                                        • Instruction ID: 9ac6bcba1e22606d8a3f98507846f809c14ae5b1cd4137618ecf9cbbc0e374ac
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 79cd65a6ba4c4f8614d2d44d2a0d076d8c5b6b6456474cad0f31bdfcd7c7fe30
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D6F08C71A04115AFD710EBA4DA499AEB378EF14328F6001BBE116F31E5D7B88E419B29
                                                                                                                                                                                                                        Function 053E687D Relevance: .4, Instructions: 367COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmp, Offset: 053E6000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_53e6000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 6087be7c1e657e5b8193f2e6c72c8170b56608663052a66c9d97cf33bedee574
                                                                                                                                                                                                                        • Instruction ID: 416d8c13ec6795820919c19abadf674ebc9ab9f75bd2c91040e4924adfda893f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6087be7c1e657e5b8193f2e6c72c8170b56608663052a66c9d97cf33bedee574
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C0B1039A80E7C01FE7138B70AC267D17FA1AB23219F0F45DBC0C59A0E3E459598AD762
                                                                                                                                                                                                                        Function 053F5F84 Relevance: .1, Instructions: 82COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, Offset: 053EF000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_53e6000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: 59155ed3ff10a8f5a09c60ed6abf8a59aa44decd34b25c72b8c5bf8944181f0c
                                                                                                                                                                                                                        • Instruction ID: 0b546402c46048ed0dfb25570d9816e5c8b9624ac4bc2b873b73a36d133e44c4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 59155ed3ff10a8f5a09c60ed6abf8a59aa44decd34b25c72b8c5bf8944181f0c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D231E5B244A3C08FD3474B34C8627913FB1AF57621B5A44EBC585DF6B3C22A580ADB62
                                                                                                                                                                                                                        Function 053F5F84 Relevance: .1, Instructions: 82COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, Offset: 053E6000, based on PE: false
                                                                                                                                                                                                                        • Associated: 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_53e6000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID:
                                                                                                                                                                                                                        • Opcode ID: d7aa4d1540abc94c9f13e5c10967d55ed1705b8050e894a3af424611291fda53
                                                                                                                                                                                                                        • Instruction ID: 0b546402c46048ed0dfb25570d9816e5c8b9624ac4bc2b873b73a36d133e44c4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d7aa4d1540abc94c9f13e5c10967d55ed1705b8050e894a3af424611291fda53
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D231E5B244A3C08FD3474B34C8627913FB1AF57621B5A44EBC585DF6B3C22A580ADB62
                                                                                                                                                                                                                        Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
                                                                                                                                                                                                                        • BeginPaint.USER32(?,?), ref: 00401047
                                                                                                                                                                                                                        • GetClientRect.USER32(?,?), ref: 0040105B
                                                                                                                                                                                                                        • CreateBrushIndirect.GDI32(00000000), ref: 004010CF
                                                                                                                                                                                                                        • FillRect.USER32(00000000,?,00000000), ref: 004010E4
                                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 004010ED
                                                                                                                                                                                                                        • CreateFontIndirectW.GDI32(?), ref: 00401105
                                                                                                                                                                                                                        • SetBkMode.GDI32(00000000,00000001), ref: 00401126
                                                                                                                                                                                                                        • SetTextColor.GDI32(00000000,000000FF), ref: 00401130
                                                                                                                                                                                                                        • SelectObject.GDI32(00000000,?), ref: 00401140
                                                                                                                                                                                                                        • DrawTextW.USER32(00000000,00428A20,000000FF,00000010,00000820), ref: 00401156
                                                                                                                                                                                                                        • SelectObject.GDI32(00000000,00000000), ref: 00401160
                                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 00401165
                                                                                                                                                                                                                        • EndPaint.USER32(?,?), ref: 0040116E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
                                                                                                                                                                                                                        • String ID: F
                                                                                                                                                                                                                        • API String ID: 941294808-1304234792
                                                                                                                                                                                                                        • Opcode ID: fcc37e75e13d0dca8524aaa06a8ee829d240d30c68f9aadea354bd02ab1c226a
                                                                                                                                                                                                                        • Instruction ID: d1034cbb9d528375343357a353c0022e70e8214492c202610c441178c5bfc5cd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fcc37e75e13d0dca8524aaa06a8ee829d240d30c68f9aadea354bd02ab1c226a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FC417B71800249AFCB058FA5DE459AFBBB9FF45314F00802EF592AA1A0CB74DA55DFA4
                                                                                                                                                                                                                        Function 00406187 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,00406322,?,?), ref: 004061C2
                                                                                                                                                                                                                        • GetShortPathNameW.KERNEL32(?,004265A8,00000400), ref: 004061CB
                                                                                                                                                                                                                          • Part of subcall function 00405F96: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040627B,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA6
                                                                                                                                                                                                                          • Part of subcall function 00405F96: lstrlenA.KERNEL32(00000000,?,00000000,0040627B,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD8
                                                                                                                                                                                                                        • GetShortPathNameW.KERNEL32(?,00426DA8,00000400), ref: 004061E8
                                                                                                                                                                                                                        • wsprintfA.USER32 ref: 00406206
                                                                                                                                                                                                                        • GetFileSize.KERNEL32(00000000,00000000,00426DA8,C0000000,00000004,00426DA8,?,?,?,?,?), ref: 00406241
                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00406250
                                                                                                                                                                                                                        • lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406288
                                                                                                                                                                                                                        • SetFilePointer.KERNEL32(0040A580,00000000,00000000,00000000,00000000,004261A8,00000000,-0000000A,0040A580,00000000,[Rename],00000000,00000000,00000000), ref: 004062DE
                                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 004062EF
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 004062F6
                                                                                                                                                                                                                          • Part of subcall function 00406031: GetFileAttributesW.KERNEL32(00000003,004030E2,C:\Users\user\Desktop\GlassWireSetup.exe,80000000,00000003), ref: 00406035
                                                                                                                                                                                                                          • Part of subcall function 00406031: CreateFileW.KERNEL32(?,?,00000001,00000000,?,00000001,00000000), ref: 00406057
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
                                                                                                                                                                                                                        • String ID: %ls=%ls$[Rename]
                                                                                                                                                                                                                        • API String ID: 2171350718-461813615
                                                                                                                                                                                                                        • Opcode ID: ad23c2c12608704314c1a1c2d98a70ea5e027cecb5ac03fef5858bd56b87dd73
                                                                                                                                                                                                                        • Instruction ID: 01145b8f81eafc368a5e669bb7cc9688017d9d0d23ed4dcd6a8783cd941829b9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ad23c2c12608704314c1a1c2d98a70ea5e027cecb5ac03fef5858bd56b87dd73
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DF31353060072ABBD6207B659D49F2B3A5CDF41754F12007EF902F62D2EA3D9C2586BD
                                                                                                                                                                                                                        Function 004055C6 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72stringwindowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,00000000,00418EC0,00000000,?,?,?,?,?,?,?,?,?,00403412,00000000,?), ref: 004055FE
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(00403412,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,00000000,00418EC0,00000000,?,?,?,?,?,?,?,?,?,00403412,00000000), ref: 0040560E
                                                                                                                                                                                                                        • lstrcatW.KERNEL32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,00403412,00403412,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,00000000,00418EC0,00000000), ref: 00405621
                                                                                                                                                                                                                        • SetWindowTextW.USER32(Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\,Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\), ref: 00405633
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405659
                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 00405673
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001013,?,00000000), ref: 00405681
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: MessageSend$lstrlen$TextWindowlstrcat
                                                                                                                                                                                                                        • String ID: Delete on reboot: C:\Users\user\AppData\Local\Temp\nsx9694.tmp\
                                                                                                                                                                                                                        • API String ID: 2531174081-239941496
                                                                                                                                                                                                                        • Opcode ID: a9fafcf7327b9621bb894f8e2d9ac48d1397335c234e36f420f2517ccdad5277
                                                                                                                                                                                                                        • Instruction ID: 832834c51e0bf9a0f82df7ca1b5cea98aaac4e2da268f37eaeed00ca70cd3c8d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a9fafcf7327b9621bb894f8e2d9ac48d1397335c234e36f420f2517ccdad5277
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BA21A175900558BACB119FA5DD84DCFBF79EF45350F50843AF904B22A0C77A4A41CF58
                                                                                                                                                                                                                        Function 004067EF Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CharNextW.USER32(?,*?|<>/":,00000000,"C:\Users\user\Desktop\GlassWireSetup.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,004034F7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806,?,00000008,0000000A,0000000C), ref: 00406852
                                                                                                                                                                                                                        • CharNextW.USER32(?,?,?,00000000,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00406861
                                                                                                                                                                                                                        • CharNextW.USER32(?,"C:\Users\user\Desktop\GlassWireSetup.exe",74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,004034F7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806,?,00000008,0000000A,0000000C), ref: 00406866
                                                                                                                                                                                                                        • CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,00000000,004034F7,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806,?,00000008,0000000A,0000000C), ref: 00406879
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • *?|<>/":, xrefs: 00406841
                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 004067F0
                                                                                                                                                                                                                        • "C:\Users\user\Desktop\GlassWireSetup.exe", xrefs: 00406833
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Char$Next$Prev
                                                                                                                                                                                                                        • String ID: "C:\Users\user\Desktop\GlassWireSetup.exe"$*?|<>/":$C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                        • API String ID: 589700163-1362693309
                                                                                                                                                                                                                        • Opcode ID: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
                                                                                                                                                                                                                        • Instruction ID: 55fd55a6259970f18c414665dfb8d2eb8684f68ced2253b2c35ece4a8e009edc
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d9890b2689dddc4776a4db6af1629ac80bd1bcc56ba6148264ccbff8cf15ab87
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0E11E61780221295DB303B15CC40ABB62E8EF54750F16C43FE999732C0E77C4C9286BD
                                                                                                                                                                                                                        Function 00404527 Relevance: 12.1, APIs: 8, Instructions: 68COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000EB), ref: 00404544
                                                                                                                                                                                                                        • GetSysColor.USER32(00000000), ref: 00404582
                                                                                                                                                                                                                        • SetTextColor.GDI32(?,00000000), ref: 0040458E
                                                                                                                                                                                                                        • SetBkMode.GDI32(?,?), ref: 0040459A
                                                                                                                                                                                                                        • GetSysColor.USER32(?), ref: 004045AD
                                                                                                                                                                                                                        • SetBkColor.GDI32(?,?), ref: 004045BD
                                                                                                                                                                                                                        • DeleteObject.GDI32(?), ref: 004045D7
                                                                                                                                                                                                                        • CreateBrushIndirect.GDI32(?), ref: 004045E1
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2320649405-0
                                                                                                                                                                                                                        • Opcode ID: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
                                                                                                                                                                                                                        • Instruction ID: d41769c693a3b03867a7fa47e0dc02698e8003aaa16d7874add0ef0652afaaee
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9dba601b91aff6ac4bf2e5f3eaee39d76022ea5146a5c84035e03d3d84c8d27c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5A2195B1500704BFCB349F39DD08A477BF8AF41714B00892EEA96A22E0DB38DA44CB54
                                                                                                                                                                                                                        Function 00402711 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ReadFile.KERNEL32(?,?,?,?), ref: 0040277D
                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004027B8
                                                                                                                                                                                                                        • SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004027DB
                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004027F1
                                                                                                                                                                                                                          • Part of subcall function 00406112: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00406128
                                                                                                                                                                                                                        • SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040289D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: File$Pointer$ByteCharMultiWide$Read
                                                                                                                                                                                                                        • String ID: 9
                                                                                                                                                                                                                        • API String ID: 163830602-2366072709
                                                                                                                                                                                                                        • Opcode ID: 91519286727b7715e667a28de049f7dc24ed8e1d9bfc14afdf41a8c3697f6d43
                                                                                                                                                                                                                        • Instruction ID: 7b917313dc97d271e667d5624dbaf811d8953be2b726cd25112f37da0e7500b1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 91519286727b7715e667a28de049f7dc24ed8e1d9bfc14afdf41a8c3697f6d43
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 35511E75D04119AADF20EFD4CA84AAEB779FF44304F14817BE501B62D0D7B89D828B58
                                                                                                                                                                                                                        Function 00404E7B Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404E96
                                                                                                                                                                                                                        • GetMessagePos.USER32 ref: 00404E9E
                                                                                                                                                                                                                        • ScreenToClient.USER32(?,?), ref: 00404EB8
                                                                                                                                                                                                                        • SendMessageW.USER32(?,00001111,00000000,?), ref: 00404ECA
                                                                                                                                                                                                                        • SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404EF0
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Message$Send$ClientScreen
                                                                                                                                                                                                                        • String ID: f
                                                                                                                                                                                                                        • API String ID: 41195575-1993550816
                                                                                                                                                                                                                        • Opcode ID: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
                                                                                                                                                                                                                        • Instruction ID: 6d9709cdd774db07ceaeaaa3ef1e8ea5a4c7015a7cc254b2929396571b15d8ef
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3b05e908374c5eb3ed0cc07743cf8bdf4b6f619b857b2f4ef42225a5e6fc1927
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7E015E71900218BADB00DB94DD85BFEBBBCAF95B11F10412BBB51B61D0C7B49A418BA4
                                                                                                                                                                                                                        Function 00401E73 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetDC.USER32(?), ref: 00401E76
                                                                                                                                                                                                                        • GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401E90
                                                                                                                                                                                                                        • MulDiv.KERNEL32(00000000,00000000), ref: 00401E98
                                                                                                                                                                                                                        • ReleaseDC.USER32(?,00000000), ref: 00401EA9
                                                                                                                                                                                                                        • CreateFontIndirectW.GDI32(0040CDC8), ref: 00401EF8
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CapsCreateDeviceFontIndirectRelease
                                                                                                                                                                                                                        • String ID: MS Shell Dlg
                                                                                                                                                                                                                        • API String ID: 3808545654-76309092
                                                                                                                                                                                                                        • Opcode ID: ef63408107684041e4866229634915ac86451c59f948bd83cb9cb27aef798f6a
                                                                                                                                                                                                                        • Instruction ID: 1d77b42acd886a27ae9f5cf53f8bcf428a8cf24ec4295262a5ba191a384267e2
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ef63408107684041e4866229634915ac86451c59f948bd83cb9cb27aef798f6a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9E01B171950250EFEB005BB4AE8AADD3FB0AF59300F10497AF142BA1E2CAB804049B2C
                                                                                                                                                                                                                        Function 00402FB8 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402FD6
                                                                                                                                                                                                                        • MulDiv.KERNEL32(0002A200,00000064,04FAD2F0), ref: 00403001
                                                                                                                                                                                                                        • wsprintfW.USER32 ref: 00403011
                                                                                                                                                                                                                        • SetWindowTextW.USER32(?,?), ref: 00403021
                                                                                                                                                                                                                        • SetDlgItemTextW.USER32(?,00000406,?), ref: 00403033
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • verifying installer: %d%%, xrefs: 0040300B
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Text$ItemTimerWindowwsprintf
                                                                                                                                                                                                                        • String ID: verifying installer: %d%%
                                                                                                                                                                                                                        • API String ID: 1451636040-82062127
                                                                                                                                                                                                                        • Opcode ID: 7c72eb226873640f15370cd8631d515f33e7e0e766319f11269e715f4bf9c46b
                                                                                                                                                                                                                        • Instruction ID: 92b1fa929db6ad6423e495ae3c8b7d5051599f53ef0535b5d141126ce54988b0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7c72eb226873640f15370cd8631d515f33e7e0e766319f11269e715f4bf9c46b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 41014F70640208BBEF209F60DD49FEE3B69BB04345F008039FA02A51D0DBB99A559F58
                                                                                                                                                                                                                        Function 00402975 Relevance: 9.1, APIs: 6, Instructions: 91memoryfileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 004029D6
                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004029F2
                                                                                                                                                                                                                        • GlobalFree.KERNEL32(?), ref: 00402A2B
                                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 00402A3E
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?,?,?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A5A
                                                                                                                                                                                                                        • DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,000000F0), ref: 00402A6D
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Global$AllocFree$CloseDeleteFileHandle
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2667972263-0
                                                                                                                                                                                                                        • Opcode ID: b07bb42a36a53ac2b652948ec131e563e6f6be8de0f89c4bf93d81cf64cebf1f
                                                                                                                                                                                                                        • Instruction ID: 30dd54c89a4cddf194586c2a2fc5346a944fd6f702074eaf72055d986495362b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b07bb42a36a53ac2b652948ec131e563e6f6be8de0f89c4bf93d81cf64cebf1f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0C31B171D00128BBCF21AFA5DE49D9E7E79AF44324F20423AF415762E1CB798D418FA8
                                                                                                                                                                                                                        Function 00402ECE Relevance: 7.6, APIs: 5, Instructions: 84registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RegEnumValueW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,00100020,?,?,?), ref: 00402F22
                                                                                                                                                                                                                        • RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402F6E
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F77
                                                                                                                                                                                                                        • RegDeleteKeyW.ADVAPI32(?,?), ref: 00402F8E
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?), ref: 00402F99
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseEnum$DeleteValue
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1354259210-0
                                                                                                                                                                                                                        • Opcode ID: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
                                                                                                                                                                                                                        • Instruction ID: d442e96e729bea3163a88d870f4d25619929b9fa7009ff0cba57fd90435ded5e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2404979ab5d72bd1f47e4c5d2100d154d2dcf156ce7fec90999c2a50aae3b712
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8B212A7150010ABFDF129F94CE89EEF7A7DEB54388F110076B909B21A0D7B58E54AA68
                                                                                                                                                                                                                        Function 00405EBB Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CharNextW.USER32(?,?,C:\,?,00405F2F,C:\,C:\,74DF3420,?,C:\Users\user\AppData\Local\Temp\,00405C6D,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\Desktop\GlassWireSetup.exe"), ref: 00405EC9
                                                                                                                                                                                                                        • CharNextW.USER32(00000000), ref: 00405ECE
                                                                                                                                                                                                                        • CharNextW.USER32(00000000), ref: 00405EE6
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CharNext
                                                                                                                                                                                                                        • String ID: C:\
                                                                                                                                                                                                                        • API String ID: 3213498283-3404278061
                                                                                                                                                                                                                        • Opcode ID: a019630038ff328a8ec37a6ad8a5e0fa1ea3fa9b42c133706ff5938ffc5cdd25
                                                                                                                                                                                                                        • Instruction ID: c2ae64a9e281e0169ab0b3f813724322829f62ec5c7d6721859fffd7401bb401
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a019630038ff328a8ec37a6ad8a5e0fa1ea3fa9b42c133706ff5938ffc5cdd25
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3AF0F631920A1296DB31B7548C58E7752BCEB94350B00843BD281B32C1D7FC49C18EED
                                                                                                                                                                                                                        Function 00405E10 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00403509,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806,?,00000008,0000000A,0000000C), ref: 00405E16
                                                                                                                                                                                                                        • CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,00403509,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,00403806,?,00000008,0000000A,0000000C), ref: 00405E20
                                                                                                                                                                                                                        • lstrcatW.KERNEL32(?,0040A014,?,00000008,0000000A,0000000C,?,?,?,?,?,?,?,?), ref: 00405E32
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • C:\Users\user\AppData\Local\Temp\, xrefs: 00405E10
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CharPrevlstrcatlstrlen
                                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\
                                                                                                                                                                                                                        • API String ID: 2659869361-3081826266
                                                                                                                                                                                                                        • Opcode ID: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
                                                                                                                                                                                                                        • Instruction ID: 6241345b1480893618f3385b5901a002ffa6f457481071e3b6de6f74fd74f6f8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1ad634ba4b40e47f3a67f9c69e663da68b942b7adec5edae9754e9c2c01f4b37
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 00D05E71101634AAC2117B48AC08CDF62AC9E46344341402AF141B20A5C7785A5186ED
                                                                                                                                                                                                                        Function 00402663 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 65stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\nsx9694.tmp\System.dll), ref: 004026BA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: lstrlen
                                                                                                                                                                                                                        • String ID: C:\Users\user\AppData\Local\Temp\nsx9694.tmp$C:\Users\user\AppData\Local\Temp\nsx9694.tmp\System.dll
                                                                                                                                                                                                                        • API String ID: 1659193697-2939661776
                                                                                                                                                                                                                        • Opcode ID: 581e924386a125687160958282dd6cfcb583c7f50f83c58c9207917b094514fd
                                                                                                                                                                                                                        • Instruction ID: a3276bd60f4d5d6bb2aa79b2f1cf5674750ecc9aad51c5d7eefbc562b3e224a1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 581e924386a125687160958282dd6cfcb583c7f50f83c58c9207917b094514fd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7B112B71A10211BBCB00BBB19E469AE3B61AF50348F20443FF402B61C1DAFD8851631E
                                                                                                                                                                                                                        Function 0040303E Relevance: 6.0, APIs: 4, Instructions: 33COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • DestroyWindow.USER32(00000000,00000000,0040321C,00000001), ref: 00403051
                                                                                                                                                                                                                        • GetTickCount.KERNEL32 ref: 0040306F
                                                                                                                                                                                                                        • CreateDialogParamW.USER32(0000006F,00000000,00402FB8,00000000), ref: 0040308C
                                                                                                                                                                                                                        • ShowWindow.USER32(00000000,00000005), ref: 0040309A
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Window$CountCreateDestroyDialogParamShowTick
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2102729457-0
                                                                                                                                                                                                                        • Opcode ID: 33eae82cd865283ad0f9b1d758b5427aa2cdbcf5f418f2cf2359be72f6e08548
                                                                                                                                                                                                                        • Instruction ID: 1fe6cbc8f6a725ad0ac4e372fd1d3cf1f1d396d39c9c490f6de0fad46aa3fa9f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 33eae82cd865283ad0f9b1d758b5427aa2cdbcf5f418f2cf2359be72f6e08548
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1CF05431602621ABC6316F54FD08A9B7BA9FB44B13F41087AF045B11A9CB7948828B9C
                                                                                                                                                                                                                        Function 00405E5C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(80000000,C:\Users\user\Desktop,0040310E,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\GlassWireSetup.exe,C:\Users\user\Desktop\GlassWireSetup.exe,80000000,00000003), ref: 00405E62
                                                                                                                                                                                                                        • CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\Desktop,0040310E,C:\Users\user\Desktop,C:\Users\user\Desktop,C:\Users\user\Desktop\GlassWireSetup.exe,C:\Users\user\Desktop\GlassWireSetup.exe,80000000,00000003), ref: 00405E72
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CharPrevlstrlen
                                                                                                                                                                                                                        • String ID: C:\Users\user\Desktop
                                                                                                                                                                                                                        • API String ID: 2709904686-224404859
                                                                                                                                                                                                                        • Opcode ID: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
                                                                                                                                                                                                                        • Instruction ID: b9e9e75b8ba1df67f9f167ecd7c14c3df7ff164ad8267efb590a8552da577330
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4d9a109f9f2e29ac56c0736ccbd4fa6bf3a04a93e1f4050107f2eb61dc35f761
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 81D0A7B3400930DAC3127718EC04D9F77ACEF1634074A443AE580B7165D7785D8186EC
                                                                                                                                                                                                                        Function 053F4CA1 Relevance: 5.2, Strings: 4, Instructions: 190COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, Offset: 053EF000, based on PE: false
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_53e6000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: kpK$3k7$3m7$3n7
                                                                                                                                                                                                                        • API String ID: 0-161137581
                                                                                                                                                                                                                        • Opcode ID: 756af1166bc6e87d4adc31f16ed3251b0cbaabc3c490515c61052d4246f94988
                                                                                                                                                                                                                        • Instruction ID: 162b79fed37f5b867acc210c8b7ec287284ff0c0181a2e66a324dba43cbc7492
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 756af1166bc6e87d4adc31f16ed3251b0cbaabc3c490515c61052d4246f94988
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E871B06640E7D19FD7138B3088A67817FB0AF17211B4E89EBC5C4CF2A7D219994AD723
                                                                                                                                                                                                                        Function 053F4CA1 Relevance: 5.2, Strings: 4, Instructions: 190COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000003.2557586459.00000000053EF000.00000004.00000020.00020000.00000000.sdmp, Offset: 053E6000, based on PE: false
                                                                                                                                                                                                                        • Associated: 00000000.00000003.2556467013.00000000053E6000.00000004.00000020.00020000.00000000.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_3_53e6000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: kpK$3k7$3m7$3n7
                                                                                                                                                                                                                        • API String ID: 0-161137581
                                                                                                                                                                                                                        • Opcode ID: e529abb7c61a23362fadd2c0a11a0aa8e8d551bcd6912593eadd6f766ae6cf9c
                                                                                                                                                                                                                        • Instruction ID: 162b79fed37f5b867acc210c8b7ec287284ff0c0181a2e66a324dba43cbc7492
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e529abb7c61a23362fadd2c0a11a0aa8e8d551bcd6912593eadd6f766ae6cf9c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E871B06640E7D19FD7138B3088A67817FB0AF17211B4E89EBC5C4CF2A7D219994AD723
                                                                                                                                                                                                                        Function 00405F96 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,0040627B,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA6
                                                                                                                                                                                                                        • lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405FBE
                                                                                                                                                                                                                        • CharNextA.USER32(00000000,?,00000000,0040627B,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FCF
                                                                                                                                                                                                                        • lstrlenA.KERNEL32(00000000,?,00000000,0040627B,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FD8
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000000.00000002.2561160426.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561092855.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561196409.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000414000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000427000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.000000000042F000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000434000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000439000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561235421.0000000000441000.00000004.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000000.00000002.2561576372.0000000000465000.00000002.00000001.01000000.00000003.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_0_2_400000_GlassWireSetup.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: lstrlen$CharNextlstrcmpi
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 190613189-0
                                                                                                                                                                                                                        • Opcode ID: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
                                                                                                                                                                                                                        • Instruction ID: c3aaa261a9e4bb9915bd58c77e7651ea6c0a11e303954dac61c17192ece284d7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2e04212541fd7d2d0fc4f715182178ccf0de62a07a1c27cf83518a5c6c9cf375
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F7F06231105459EFDB029BA5DD00D9EBBA8EF15254B2540BAE840F7250D678DE019B69

                                                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                                                        Function 005B3BC3 Relevance: 45.8, APIs: 23, Strings: 3, Instructions: 311fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 516 5b3bc3-5b3c50 call 5df670 * 2 GetFileAttributesW 521 5b3c52-5b3c6d GetLastError 516->521 522 5b3c84-5b3c87 516->522 521->522 523 5b3c6f-5b3c70 521->523 524 5b3c8d-5b3c90 522->524 525 5b3fd3 522->525 526 5b3c75-5b3c7f call 5b37d3 523->526 528 5b3cc9-5b3cd0 524->528 529 5b3c92-5b3ca5 SetFileAttributesW 524->529 527 5b3fd8-5b3fe1 525->527 533 5b3fea-5b3ff1 526->533 527->533 534 5b3fe3-5b3fe4 FindClose 527->534 530 5b3cdf-5b3ce7 528->530 531 5b3cd2-5b3cd9 528->531 529->528 535 5b3ca7-5b3cc7 GetLastError 529->535 537 5b3ce9-5b3cfd GetTempPathW 530->537 538 5b3d24-5b3d3f call 5b2d79 530->538 531->530 536 5b3f57 531->536 540 5b3ffe-5b4010 call 5dde36 533->540 541 5b3ff3-5b3ff9 call 5f54ef 533->541 534->533 535->526 546 5b3f5d-5b3f6b RemoveDirectoryW 536->546 537->538 542 5b3cff-5b3d1f GetLastError 537->542 538->533 552 5b3d45-5b3d61 FindFirstFileW 538->552 541->540 542->526 546->527 547 5b3f6d-5b3f83 GetLastError 546->547 550 5b3f9f-5b3fa1 547->550 551 5b3f85-5b3f87 547->551 550->527 554 5b3fa3-5b3fa9 550->554 553 5b3f89-5b3f9b MoveFileExW 551->553 551->554 555 5b3d88-5b3d92 552->555 556 5b3d63-5b3d7e GetLastError 552->556 553->554 557 5b3f9d 553->557 558 5b3ef9-5b3f03 call 5b37d3 554->558 559 5b3db9-5b3ddf call 5b2d79 555->559 560 5b3d94-5b3d9d 555->560 556->555 557->550 558->527 559->527 570 5b3de5-5b3df2 559->570 562 5b3ebc-5b3ecc FindNextFileW 560->562 563 5b3da3-5b3daa 560->563 566 5b3ece-5b3ed4 562->566 567 5b3f4c-5b3f51 GetLastError 562->567 563->559 569 5b3dac-5b3db3 563->569 566->555 571 5b3fae-5b3fce GetLastError 567->571 572 5b3f53-5b3f55 567->572 569->559 569->562 573 5b3e21-5b3e28 570->573 574 5b3df4-5b3df6 570->574 571->558 572->546 576 5b3e2e-5b3e30 573->576 577 5b3eb6 573->577 574->573 575 5b3df8-5b3e08 call 5b2b2e 574->575 575->527 584 5b3e0e-5b3e17 call 5b3bc3 575->584 579 5b3e4b-5b3e59 DeleteFileW 576->579 580 5b3e32-5b3e45 SetFileAttributesW 576->580 577->562 579->577 583 5b3e5b-5b3e5d 579->583 580->579 582 5b3ed9-5b3ef4 GetLastError 580->582 582->558 585 5b3f2a-5b3f4a GetLastError 583->585 586 5b3e63-5b3e80 GetTempFileNameW 583->586 592 5b3e1c 584->592 585->558 588 5b3f08-5b3f28 GetLastError 586->588 589 5b3e86-5b3ea3 MoveFileExW 586->589 588->558 590 5b3eae 589->590 591 5b3ea5-5b3eac 589->591 593 5b3eb4 MoveFileExW 590->593 591->593 592->577 593->577
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetFileAttributesW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 005B3C3F
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 005B3C52
                                                                                                                                                                                                                        • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,00000001,00000000,?), ref: 005B3C9D
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 005B3CA7
                                                                                                                                                                                                                        • GetTempPathW.KERNEL32(00000104,?,?,?,?,00000001,00000000,?), ref: 005B3CF5
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 005B3CFF
                                                                                                                                                                                                                        • FindFirstFileW.KERNELBASE(?,?,?,*.*,?,?,?,?,00000001,00000000,?), ref: 005B3D52
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 005B3D63
                                                                                                                                                                                                                        • SetFileAttributesW.KERNEL32(?,00000080,?,?,?,?,?,?,00000001,00000000,?), ref: 005B3E3D
                                                                                                                                                                                                                        • DeleteFileW.KERNELBASE(?,?,?,?,?,?,?,00000001,00000000,?), ref: 005B3E51
                                                                                                                                                                                                                        • GetTempFileNameW.KERNEL32(?,DEL,00000000,?,?,?,?,00000001,00000000,?), ref: 005B3E78
                                                                                                                                                                                                                        • MoveFileExW.KERNEL32(?,?,00000001,?,?,?,00000001,00000000,?), ref: 005B3E9B
                                                                                                                                                                                                                        • MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 005B3EB4
                                                                                                                                                                                                                        • FindNextFileW.KERNELBASE(000000FF,?,?,?,?,?,?,?,00000001,00000000,?), ref: 005B3EC4
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 005B3ED9
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 005B3F08
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 005B3F2A
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 005B3F4C
                                                                                                                                                                                                                        • RemoveDirectoryW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 005B3F63
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 005B3F6D
                                                                                                                                                                                                                        • MoveFileExW.KERNEL32(?,00000000,00000004,?,?,?,00000001,00000000,?), ref: 005B3F93
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 005B3FAE
                                                                                                                                                                                                                        • FindClose.KERNEL32(000000FF,?,?,?,00000001,00000000,?), ref: 005B3FE4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorFileLast$AttributesFindMove$Temp$CloseDeleteDirectoryFirstNameNextPathRemove
                                                                                                                                                                                                                        • String ID: *.*$DEL$dirutil.cpp
                                                                                                                                                                                                                        • API String ID: 1544372074-1252831301
                                                                                                                                                                                                                        • Opcode ID: dd7296f2765a4b9f0287be4dcc78f691ec31624bd0b7d8943a273fa056e16abb
                                                                                                                                                                                                                        • Instruction ID: 440b8d9986083b35f1bd86b09ff05daf89702be34f3cd4d515463bd01005da31
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dd7296f2765a4b9f0287be4dcc78f691ec31624bd0b7d8943a273fa056e16abb
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0BB1B871E40235EAEB305A758C45BF6BAA9BF54750F0102A5ED08F7190D735AE84DBA0
                                                                                                                                                                                                                        Function 005B1070 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 77fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005B33D7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,005B10DD,?,00000000), ref: 005B33F8
                                                                                                                                                                                                                        • CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 005B10F6
                                                                                                                                                                                                                          • Part of subcall function 005B1174: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,005B111A,cabinet.dll,00000009,?,?,00000000), ref: 005B1185
                                                                                                                                                                                                                          • Part of subcall function 005B1174: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,005B111A,cabinet.dll,00000009,?,?,00000000), ref: 005B1190
                                                                                                                                                                                                                          • Part of subcall function 005B1174: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 005B119E
                                                                                                                                                                                                                          • Part of subcall function 005B1174: GetLastError.KERNEL32(?,?,?,?,005B111A,cabinet.dll,00000009,?,?,00000000), ref: 005B11B9
                                                                                                                                                                                                                          • Part of subcall function 005B1174: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 005B11C1
                                                                                                                                                                                                                          • Part of subcall function 005B1174: GetLastError.KERNEL32(?,?,?,?,005B111A,cabinet.dll,00000009,?,?,00000000), ref: 005B11D6
                                                                                                                                                                                                                        • CloseHandle.KERNELBASE(?,?,?,?,005FB4C0,?,cabinet.dll,00000009,?,?,00000000), ref: 005B1131
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
                                                                                                                                                                                                                        • String ID: cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
                                                                                                                                                                                                                        • API String ID: 3687706282-3151496603
                                                                                                                                                                                                                        • Opcode ID: ef3ecf7e9cc422294a86cc115d4bdb0bbeb4ded29bfd54d551e905c738af4bf9
                                                                                                                                                                                                                        • Instruction ID: 5f239a3ff6358086a14e2140167ed8996c3cc80c16e761616af106a5d7ebc2c3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ef3ecf7e9cc422294a86cc115d4bdb0bbeb4ded29bfd54d551e905c738af4bf9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FD216F7190020DAAEB10AFA9CD0DBEEBFF9BB44310F504115EA10B6281DB749508CBA4
                                                                                                                                                                                                                        Function 005C9EB7 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 51COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed create working folder., xrefs: 005C9EEA
                                                                                                                                                                                                                        • Failed to calculate working folder to ensure it exists., xrefs: 005C9ED4
                                                                                                                                                                                                                        • =S[, xrefs: 005C9EB7
                                                                                                                                                                                                                        • Failed to copy working folder., xrefs: 005C9F12
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CurrentDirectoryErrorLastProcessWindows
                                                                                                                                                                                                                        • String ID: =S[$Failed create working folder.$Failed to calculate working folder to ensure it exists.$Failed to copy working folder.
                                                                                                                                                                                                                        • API String ID: 3841436932-3753595968
                                                                                                                                                                                                                        • Opcode ID: 487d5df22e37f2b6f860f0d4210cbb02fcfc6a4600d5db4ae911331171e3087d
                                                                                                                                                                                                                        • Instruction ID: 32453d69be4ac18bd907bcfa0230c916bea1222f5c68764f7b27c24fd52a7fb7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 487d5df22e37f2b6f860f0d4210cbb02fcfc6a4600d5db4ae911331171e3087d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CE01B532D44629BB9B236B94CC0DDAF7F69FF90B20B11019DF900A6251DB319E10EAD0
                                                                                                                                                                                                                        Function 005E4812 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000000,?,005E47E8,00000000,00617CF8,0000000C,005E493F,00000000,00000002,00000000), ref: 005E4833
                                                                                                                                                                                                                        • TerminateProcess.KERNEL32(00000000,?,005E47E8,00000000,00617CF8,0000000C,005E493F,00000000,00000002,00000000), ref: 005E483A
                                                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 005E484C
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Process$CurrentExitTerminate
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1703294689-0
                                                                                                                                                                                                                        • Opcode ID: 1865ad38563cc6ceb7434ac0dfb0b091d383595568f30e3addfdbebdc519acc2
                                                                                                                                                                                                                        • Instruction ID: abf9bc1b8293f053f6efe3fe57149f36074fe50a13678e32069588ed8c4700e4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1865ad38563cc6ceb7434ac0dfb0b091d383595568f30e3addfdbebdc519acc2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 12E04631400688EBCF056F12DC0DA6A3F29FB50341F040024F8888B132CB39EC42EA80
                                                                                                                                                                                                                        Function 005B38D4 Relevance: 3.0, APIs: 2, Instructions: 13memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetProcessHeap.KERNEL32(?,000001C7,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38E5
                                                                                                                                                                                                                        • RtlAllocateHeap.NTDLL(00000000,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38EC
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Heap$AllocateProcess
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1357844191-0
                                                                                                                                                                                                                        • Opcode ID: 2c1b5f45a00c0db472af73492ddbcbdc622b3bb0beea85ee13be8ef740c335e3
                                                                                                                                                                                                                        • Instruction ID: ef90a36f7c21a3921a82aaccf910d8c030d04cab1218ea3865b3e5a5687315b2
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2c1b5f45a00c0db472af73492ddbcbdc622b3bb0beea85ee13be8ef740c335e3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FEC01232190208E78B005FF4DC0DC69379CA724602B008400B505C2110C73CE128D760
                                                                                                                                                                                                                        Function 005BF86E Relevance: 117.7, APIs: 3, Strings: 64, Instructions: 445COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 0 5bf86e-5bf8a4 call 5f388a 3 5bf8b8-5bf8d1 call 5f31c7 0->3 4 5bf8a6-5bf8b3 call 5f012f 0->4 10 5bf8dd-5bf8f2 call 5f31c7 3->10 11 5bf8d3-5bf8d8 3->11 9 5bfda0-5bfda5 4->9 12 5bfdad-5bfdb2 9->12 13 5bfda7-5bfda9 9->13 20 5bf8fe-5bf90b call 5be936 10->20 21 5bf8f4-5bf8f9 10->21 14 5bfd97-5bfd9e call 5f012f 11->14 18 5bfdba-5bfdbf 12->18 19 5bfdb4-5bfdb6 12->19 13->12 28 5bfd9f 14->28 23 5bfdc1-5bfdc3 18->23 24 5bfdc7-5bfdcb 18->24 19->18 31 5bf90d-5bf912 20->31 32 5bf917-5bf92c call 5f31c7 20->32 21->14 23->24 25 5bfdcd-5bfdd0 call 5f54ef 24->25 26 5bfdd5-5bfddc 24->26 25->26 28->9 31->14 35 5bf938-5bf94a call 5f4b5a 32->35 36 5bf92e-5bf933 32->36 39 5bf959-5bf96e call 5f31c7 35->39 40 5bf94c-5bf954 35->40 36->14 45 5bf97a-5bf98f call 5f31c7 39->45 46 5bf970-5bf975 39->46 41 5bfc23-5bfc2c call 5f012f 40->41 41->28 50 5bf99b-5bf9ad call 5f33db 45->50 51 5bf991-5bf996 45->51 46->14 54 5bf9b9-5bf9cf call 5f388a 50->54 55 5bf9af-5bf9b4 50->55 51->14 58 5bfc7e-5bfc98 call 5bebb2 54->58 59 5bf9d5-5bf9d7 54->59 55->14 66 5bfc9a-5bfc9f 58->66 67 5bfca4-5bfcbc call 5f388a 58->67 61 5bf9d9-5bf9de 59->61 62 5bf9e3-5bf9f8 call 5f33db 59->62 61->14 68 5bf9fa-5bf9ff 62->68 69 5bfa04-5bfa19 call 5f31c7 62->69 66->14 74 5bfcc2-5bfcc4 67->74 75 5bfd86-5bfd87 call 5befe5 67->75 68->14 76 5bfa1b-5bfa1d 69->76 77 5bfa29-5bfa3e call 5f31c7 69->77 78 5bfcd0-5bfcee call 5f31c7 74->78 79 5bfcc6-5bfccb 74->79 81 5bfd8c-5bfd90 75->81 76->77 82 5bfa1f-5bfa24 76->82 88 5bfa4e-5bfa63 call 5f31c7 77->88 89 5bfa40-5bfa42 77->89 90 5bfcfa-5bfd12 call 5f31c7 78->90 91 5bfcf0-5bfcf5 78->91 79->14 81->28 85 5bfd92 81->85 82->14 85->14 97 5bfa73-5bfa88 call 5f31c7 88->97 98 5bfa65-5bfa67 88->98 89->88 92 5bfa44-5bfa49 89->92 99 5bfd1f-5bfd37 call 5f31c7 90->99 100 5bfd14-5bfd16 90->100 91->14 92->14 109 5bfa8a-5bfa8c 97->109 110 5bfa98-5bfaad call 5f31c7 97->110 98->97 102 5bfa69-5bfa6e 98->102 107 5bfd39-5bfd3b 99->107 108 5bfd44-5bfd5c call 5f31c7 99->108 100->99 101 5bfd18-5bfd1d 100->101 101->14 102->14 107->108 111 5bfd3d-5bfd42 107->111 117 5bfd5e-5bfd63 108->117 118 5bfd65-5bfd7d call 5f31c7 108->118 109->110 112 5bfa8e-5bfa93 109->112 119 5bfaaf-5bfab1 110->119 120 5bfabd-5bfad2 call 5f31c7 110->120 111->14 112->14 117->14 118->75 126 5bfd7f-5bfd84 118->126 119->120 122 5bfab3-5bfab8 119->122 127 5bfae2-5bfaf7 call 5f31c7 120->127 128 5bfad4-5bfad6 120->128 122->14 126->14 132 5bfaf9-5bfafb 127->132 133 5bfb07-5bfb1c call 5f31c7 127->133 128->127 129 5bfad8-5bfadd 128->129 129->14 132->133 134 5bfafd-5bfb02 132->134 137 5bfb1e-5bfb20 133->137 138 5bfb2c-5bfb44 call 5f31c7 133->138 134->14 137->138 139 5bfb22-5bfb27 137->139 142 5bfb46-5bfb48 138->142 143 5bfb54-5bfb6c call 5f31c7 138->143 139->14 142->143 145 5bfb4a-5bfb4f 142->145 147 5bfb6e-5bfb70 143->147 148 5bfb7c-5bfb91 call 5f31c7 143->148 145->14 147->148 149 5bfb72-5bfb77 147->149 152 5bfc31-5bfc33 148->152 153 5bfb97-5bfbb4 CompareStringW 148->153 149->14 154 5bfc3e-5bfc40 152->154 155 5bfc35-5bfc3c 152->155 156 5bfbbe-5bfbd3 CompareStringW 153->156 157 5bfbb6-5bfbbc 153->157 158 5bfc4c-5bfc64 call 5f33db 154->158 159 5bfc42-5bfc47 154->159 155->154 161 5bfbe1-5bfbf6 CompareStringW 156->161 162 5bfbd5-5bfbdf 156->162 160 5bfbff-5bfc04 157->160 158->58 169 5bfc66-5bfc68 158->169 159->14 160->154 164 5bfbf8 161->164 165 5bfc06-5bfc1e call 5b37d3 161->165 162->160 164->160 165->41 170 5bfc6a-5bfc6f 169->170 171 5bfc74 169->171 170->14 171->58
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: =S[$AboutUrl$Arp$Classification$Comments$Contact$Department$DisableModify$DisableRemove$DisplayName$DisplayVersion$ExecutableName$Failed to get @AboutUrl.$Failed to get @Classification.$Failed to get @Comments.$Failed to get @Contact.$Failed to get @Department.$Failed to get @DisableModify.$Failed to get @DisableRemove.$Failed to get @DisplayName.$Failed to get @DisplayVersion.$Failed to get @ExecutableName.$Failed to get @HelpLink.$Failed to get @HelpTelephone.$Failed to get @Id.$Failed to get @Manufacturer.$Failed to get @Name.$Failed to get @ParentDisplayName.$Failed to get @PerMachine.$Failed to get @ProductFamily.$Failed to get @ProviderKey.$Failed to get @Publisher.$Failed to get @Register.$Failed to get @Tag.$Failed to get @UpdateUrl.$Failed to get @Version.$Failed to parse @Version: %ls$Failed to parse related bundles$Failed to parse software tag.$Failed to select ARP node.$Failed to select Update node.$Failed to select registration node.$Failed to set registration paths.$HelpLink$HelpTelephone$Invalid modify disabled type: %ls$Manufacturer$Name$ParentDisplayName$PerMachine$ProductFamily$ProviderKey$Publisher$Register$Registration$Tag$Update$UpdateUrl$Version$button$clbcatq.dll$msasn1.dll$registration.cpp$yes
                                                                                                                                                                                                                        • API String ID: 0-2252639889
                                                                                                                                                                                                                        • Opcode ID: 7d33df47654c3d1fda7ccbead129486a63ac5cce57e6dd21b12e80f04f76d156
                                                                                                                                                                                                                        • Instruction ID: edb34dd34f7b65090aba909569b7035d59f2a8099683a814bf0d6c28e24818a3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7d33df47654c3d1fda7ccbead129486a63ac5cce57e6dd21b12e80f04f76d156
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 27E1A532E8066ABFDB19A6A0CC42EFE7E65BB00750F124675FD11BB1D1D7617E40A780
                                                                                                                                                                                                                        Function 005BB389 Relevance: 93.3, APIs: 24, Strings: 29, Instructions: 565fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 172 5bb389-5bb3fd call 5df670 * 2 177 5bb3ff-5bb42a GetLastError call 5b37d3 172->177 178 5bb435-5bb450 SetFilePointerEx 172->178 189 5bb42f-5bb430 177->189 180 5bb452-5bb482 GetLastError call 5b37d3 178->180 181 5bb484-5bb49e ReadFile 178->181 180->189 182 5bb4a0-5bb4d0 GetLastError call 5b37d3 181->182 183 5bb4d5-5bb4dc 181->183 182->189 187 5bbad3-5bbae7 call 5b37d3 183->187 188 5bb4e2-5bb4eb 183->188 199 5bbaec 187->199 188->187 192 5bb4f1-5bb501 SetFilePointerEx 188->192 193 5bbaed-5bbaf3 call 5f012f 189->193 196 5bb538-5bb550 ReadFile 192->196 197 5bb503-5bb52e GetLastError call 5b37d3 192->197 206 5bbaf4-5bbb06 call 5dde36 193->206 202 5bb552-5bb57d GetLastError call 5b37d3 196->202 203 5bb587-5bb58e 196->203 197->196 199->193 202->203 204 5bbab8-5bbad1 call 5b37d3 203->204 205 5bb594-5bb59e 203->205 204->199 205->204 209 5bb5a4-5bb5c7 SetFilePointerEx 205->209 213 5bb5c9-5bb5f4 GetLastError call 5b37d3 209->213 214 5bb5fe-5bb616 ReadFile 209->214 213->214 218 5bb618-5bb643 GetLastError call 5b37d3 214->218 219 5bb64d-5bb665 ReadFile 214->219 218->219 222 5bb69c-5bb6b7 SetFilePointerEx 219->222 223 5bb667-5bb692 GetLastError call 5b37d3 219->223 224 5bb6b9-5bb6e7 GetLastError call 5b37d3 222->224 225 5bb6f1-5bb710 ReadFile 222->225 223->222 224->225 229 5bba79-5bbaad GetLastError call 5b37d3 225->229 230 5bb716-5bb718 225->230 239 5bbaae-5bbab6 call 5f012f 229->239 234 5bb719-5bb720 230->234 236 5bb726-5bb732 234->236 237 5bba54-5bba71 call 5b37d3 234->237 240 5bb73d-5bb746 236->240 241 5bb734-5bb73b 236->241 247 5bba76-5bba77 237->247 239->206 245 5bb74c-5bb772 ReadFile 240->245 246 5bba17-5bba2e call 5b37d3 240->246 241->240 244 5bb780-5bb787 241->244 251 5bb789-5bb7ab call 5b37d3 244->251 252 5bb7b0-5bb7c7 call 5b38d4 244->252 245->229 250 5bb778-5bb77e 245->250 258 5bba33-5bba39 call 5f012f 246->258 247->239 250->234 251->247 259 5bb7eb-5bb800 SetFilePointerEx 252->259 260 5bb7c9-5bb7e6 call 5b37d3 252->260 268 5bba3f-5bba40 258->268 263 5bb802-5bb830 GetLastError call 5b37d3 259->263 264 5bb840-5bb865 ReadFile 259->264 260->193 280 5bb835-5bb83b call 5f012f 263->280 269 5bb89c-5bb8a8 264->269 270 5bb867-5bb89a GetLastError call 5b37d3 264->270 275 5bba41-5bba43 268->275 272 5bb8cb-5bb8cf 269->272 273 5bb8aa-5bb8c6 call 5b37d3 269->273 270->280 278 5bb90a-5bb91d call 5f48cb 272->278 279 5bb8d1-5bb905 call 5b37d3 call 5f012f 272->279 273->258 275->206 281 5bba49-5bba4f call 5b3999 275->281 292 5bb929-5bb933 278->292 293 5bb91f-5bb924 278->293 279->275 280->268 281->206 294 5bb93d-5bb945 292->294 295 5bb935-5bb93b 292->295 293->280 298 5bb951-5bb954 294->298 299 5bb947-5bb94f 294->299 297 5bb956-5bb9b6 call 5b38d4 295->297 302 5bb9da-5bb9fb call 5df0f0 call 5bb106 297->302 303 5bb9b8-5bb9d4 call 5b37d3 297->303 298->297 299->297 302->275 310 5bb9fd-5bba0d call 5b37d3 302->310 303->302 310->246
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 005BB3FF
                                                                                                                                                                                                                        • SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 005BB44C
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 005BB452
                                                                                                                                                                                                                        • ReadFile.KERNELBASE(00000000,\C[H,00000040,?,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 005BB49A
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 005BB4A0
                                                                                                                                                                                                                        • SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 005BB4FD
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 005BB503
                                                                                                                                                                                                                        • ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 005BB54C
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 005BB552
                                                                                                                                                                                                                        • SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 005BB5C3
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 005BB5C9
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$File$Pointer$Read
                                                                                                                                                                                                                        • String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to engine process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$\C[H$burn$section.cpp
                                                                                                                                                                                                                        • API String ID: 2600052162-409364938
                                                                                                                                                                                                                        • Opcode ID: fc3e25a3efc0604d87cf15a7a4461c7bd61404532d32fdd7eb20a36b513c69cb
                                                                                                                                                                                                                        • Instruction ID: bd2a4d27d3635deaf3d750fbdc4c4020468b79cbcb82bd3f399a29055598309d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fc3e25a3efc0604d87cf15a7a4461c7bd61404532d32fdd7eb20a36b513c69cb
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A11295B1A40329ABFB209A25CC46FF77EA9FF44700F014165BA09F7591DBB59E40CBA1
                                                                                                                                                                                                                        Function 005BCCB6 Relevance: 86.1, APIs: 3, Strings: 46, Instructions: 366COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 313 5bccb6-5bcce2 call 5f3803 316 5bccf6-5bcd07 313->316 317 5bcce4 313->317 321 5bcd09-5bcd0e 316->321 322 5bcd10-5bcd15 316->322 318 5bcce9-5bccf1 call 5f012f 317->318 324 5bd04b-5bd050 318->324 321->318 322->324 325 5bcd1b-5bcd2e call 5b38d4 322->325 326 5bd058-5bd05d 324->326 327 5bd052-5bd054 324->327 332 5bcd30-5bcd4f call 5b37d3 call 5f012f 325->332 333 5bcd54-5bcd61 325->333 329 5bd05f-5bd061 326->329 330 5bd065-5bd069 326->330 327->326 329->330 334 5bd06b-5bd06e call 5f54ef 330->334 335 5bd073-5bd079 330->335 344 5bd04a 332->344 338 5bd047 333->338 339 5bcd67-5bcd69 333->339 334->335 340 5bd049 338->340 342 5bcd6c-5bcd82 call 5f3760 339->342 340->344 348 5bcd88-5bcd9a call 5f31c7 342->348 349 5bd121 342->349 344->324 354 5bd11a-5bd11f 348->354 355 5bcda0-5bcdac call 5f31c7 348->355 351 5bd126-5bd12e call 5f012f 349->351 351->340 354->351 358 5bcdb1-5bcdb5 355->358 359 5bcdbb-5bcdd0 call 5f31c7 358->359 360 5bd113-5bd118 358->360 363 5bd10c-5bd111 359->363 364 5bcdd6-5bcdf1 CompareStringW 359->364 360->351 363->351 365 5bcdfc-5bce11 CompareStringW 364->365 366 5bcdf3-5bcdfa 364->366 368 5bce18-5bce2d CompareStringW 365->368 369 5bce13-5bce16 365->369 367 5bce3a-5bce3e 366->367 372 5bce82-5bce9b call 5f33db 367->372 373 5bce40-5bce59 call 5f31c7 367->373 370 5bce33 368->370 371 5bd0f1-5bd0f9 368->371 369->367 370->367 376 5bd0fe-5bd107 call 5f012f 371->376 382 5bce9d-5bce9f 372->382 383 5bcea5-5bcebe call 5f31c7 372->383 380 5bce5b-5bce5f 373->380 381 5bce61-5bce63 373->381 376->340 380->372 380->381 385 5bce69-5bce7c call 5bc0a9 381->385 386 5bd086-5bd08b 381->386 382->383 387 5bd090-5bd095 382->387 391 5bcec0-5bcec4 383->391 392 5bcec6-5bcec8 383->392 385->372 396 5bd07c-5bd084 385->396 386->351 387->351 391->392 394 5bcece-5bcee7 call 5f31c7 391->394 392->394 395 5bd0ea-5bd0ef 392->395 399 5bcee9-5bceed 394->399 400 5bceef-5bcef1 394->400 395->351 396->376 399->400 401 5bcef7-5bcf10 call 5f31c7 399->401 400->401 402 5bd0e3-5bd0e8 400->402 405 5bcf32-5bcf4b call 5f31c7 401->405 406 5bcf12-5bcf14 401->406 402->351 412 5bcf6f-5bcf88 call 5f31c7 405->412 413 5bcf4d-5bcf4f 405->413 408 5bcf1a-5bcf2c call 5b2a22 406->408 409 5bd0a4-5bd0a9 406->409 408->405 418 5bd09a-5bd09f 408->418 409->351 422 5bcf8a-5bcf8c 412->422 423 5bcfac-5bcfc1 call 5f31c7 412->423 415 5bd0b2-5bd0b7 413->415 416 5bcf55-5bcf69 call 5b200b 413->416 415->351 416->412 424 5bd0ab-5bd0b0 416->424 418->351 425 5bcf92-5bcfa6 call 5b200b 422->425 426 5bd0c0-5bd0c5 422->426 430 5bd0dc-5bd0e1 423->430 431 5bcfc7-5bcfdb call 5b200b 423->431 424->351 425->423 434 5bd0b9-5bd0be 425->434 426->351 430->351 436 5bcfe1-5bcffa call 5f31c7 431->436 437 5bd0d5-5bd0da 431->437 434->351 440 5bd01d-5bd022 436->440 441 5bcffc-5bcffe 436->441 437->351 444 5bd02e-5bd041 440->444 445 5bd024-5bd02a 440->445 442 5bd0ce-5bd0d3 441->442 443 5bd004-5bd017 call 5bc780 441->443 442->351 443->440 449 5bd0c7-5bd0cc 443->449 444->338 444->342 445->444 449->351
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: GetProcessHeap.KERNEL32(?,000001C7,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38E5
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: RtlAllocateHeap.NTDLL(00000000,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38EC
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,download,000000FF,00000000,Packaging,00000000,00000000,FilePath,comres.dll,00000000,005FCA64,?,00000000), ref: 005BCDEC
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Heap$AllocateCompareProcessString
                                                                                                                                                                                                                        • String ID: Catalog$CertificateRootPublicKeyIdentifier$CertificateRootThumbprint$Container$DownloadUrl$Failed to allocate memory for payload structs.$Failed to find catalog.$Failed to get @Catalog.$Failed to get @CertificateRootPublicKeyIdentifier.$Failed to get @CertificateRootThumbprint.$Failed to get @Container.$Failed to get @DownloadUrl.$Failed to get @FilePath.$Failed to get @FileSize.$Failed to get @Hash.$Failed to get @Id.$Failed to get @LayoutOnly.$Failed to get @Packaging.$Failed to get @SourcePath.$Failed to get next node.$Failed to get payload node count.$Failed to hex decode @CertificateRootPublicKeyIdentifier.$Failed to hex decode @CertificateRootThumbprint.$Failed to hex decode the Payload/@Hash.$Failed to parse @FileSize.$Failed to select payload nodes.$Failed to to find container: %ls$FilePath$FileSize$Hash$Invalid value for @Packaging: %ls$LayoutOnly$Packaging$Payload$SourcePath$cabinet.dll$comres.dll$download$embedded$external$feclient.dll$msasn1.dll$msi.dll$payload.cpp$version.dll$wininet.dll
                                                                                                                                                                                                                        • API String ID: 1171520630-1949177747
                                                                                                                                                                                                                        • Opcode ID: 2c6a4a4ea011cb89f2d4348bbc846625e35cce41613803a95870298e99db79c1
                                                                                                                                                                                                                        • Instruction ID: e3eabf965a4ecdaeae60b3726694fb812666c140a0e491e51a36a71413328593
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2c6a4a4ea011cb89f2d4348bbc846625e35cce41613803a95870298e99db79c1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 99C19F3294162EBBDB21AB54CC49EFEBF74BF04760F100665FA00A6590E779BE01D7A4
                                                                                                                                                                                                                        Function 005D0A77 Relevance: 54.5, APIs: 20, Strings: 11, Instructions: 288synchronizationCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 450 5d0a77-5d0a90 SetEvent 451 5d0aca-5d0ad6 WaitForSingleObject 450->451 452 5d0a92-5d0ac5 GetLastError call 5b37d3 450->452 454 5d0ad8-5d0b0b GetLastError call 5b37d3 451->454 455 5d0b10-5d0b1b ResetEvent 451->455 460 5d0e25-5d0e26 call 5f012f 452->460 454->460 458 5d0b1d-5d0b50 GetLastError call 5b37d3 455->458 459 5d0b55-5d0b5b 455->459 458->460 463 5d0b5d-5d0b60 459->463 464 5d0b96-5d0baf call 5b21bc 459->464 470 5d0e2b-5d0e2c 460->470 468 5d0b8c-5d0b91 463->468 469 5d0b62-5d0b87 call 5b37d3 call 5f012f 463->469 475 5d0bca-5d0bd5 SetEvent 464->475 476 5d0bb1-5d0bc5 call 5f012f 464->476 471 5d0e2d-5d0e2f 468->471 469->470 470->471 474 5d0e30-5d0e40 471->474 480 5d0bd7-5d0bf6 GetLastError 475->480 481 5d0c00-5d0c0c WaitForSingleObject 475->481 476->471 480->481 484 5d0c0e-5d0c2d GetLastError 481->484 485 5d0c37-5d0c42 ResetEvent 481->485 484->485 486 5d0c6d-5d0c74 485->486 487 5d0c44-5d0c63 GetLastError 485->487 488 5d0c76-5d0c79 486->488 489 5d0ce3-5d0d05 CreateFileW 486->489 487->486 492 5d0c7b-5d0c7e 488->492 493 5d0ca0-5d0ca7 call 5b38d4 488->493 490 5d0d07-5d0d38 GetLastError call 5b37d3 489->490 491 5d0d42-5d0d57 SetFilePointerEx 489->491 490->491 497 5d0d59-5d0d8c GetLastError call 5b37d3 491->497 498 5d0d91-5d0d9c SetEndOfFile 491->498 495 5d0c99-5d0c9b 492->495 496 5d0c80-5d0c83 492->496 505 5d0cac-5d0cb1 493->505 495->474 496->468 501 5d0c89-5d0c8f 496->501 497->460 503 5d0d9e-5d0dd1 GetLastError call 5b37d3 498->503 504 5d0dd3-5d0df0 SetFilePointerEx 498->504 501->495 503->460 504->471 510 5d0df2-5d0e20 GetLastError call 5b37d3 504->510 508 5d0cb3-5d0ccd call 5b37d3 505->508 509 5d0cd2-5d0cde 505->509 508->460 509->471 510->460
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SetEvent.KERNEL32(?,?,?,?,00000000,00000000,?,005D0621,?,?), ref: 005D0A85
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000000,00000000,?,005D0621,?,?), ref: 005D0A92
                                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,?,?,?,?,00000000,00000000,?,005D0621,?,?), ref: 005D0ACE
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,00000000,00000000,?,005D0621,?,?), ref: 005D0AD8
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$EventObjectSingleWait
                                                                                                                                                                                                                        • String ID: Failed to allocate buffer for stream.$Failed to copy stream name: %ls$Failed to create file: %ls$Failed to reset begin operation event.$Failed to set end of file.$Failed to set file pointer to beginning of file.$Failed to set file pointer to end of file.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
                                                                                                                                                                                                                        • API String ID: 3600396749-2104912459
                                                                                                                                                                                                                        • Opcode ID: 298a8cfe505d02d004e37820feb5195ab4bec1f5450268f2fea0c16f6d47ac16
                                                                                                                                                                                                                        • Instruction ID: f682bfff3706c381b40f178c29ecad97f52ad7a166f575d618182e22b7cdb6b7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 298a8cfe505d02d004e37820feb5195ab4bec1f5450268f2fea0c16f6d47ac16
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9C91D072B80722BBF7206ABD8D49B673AD9FF04750F024227BD05EA6E0D7659C00D6D1
                                                                                                                                                                                                                        Function 005B508D Relevance: 44.1, APIs: 5, Strings: 20, Instructions: 322COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 594 5b508d-5b513b call 5df670 * 2 GetModuleHandleW call 5f03f0 call 5f05a2 call 5b1209 605 5b513d 594->605 606 5b5151-5b5162 call 5b41d2 594->606 607 5b5142-5b514c call 5f012f 605->607 611 5b516b-5b5187 call 5b5525 CoInitializeEx 606->611 612 5b5164-5b5169 606->612 615 5b53cc-5b53d3 607->615 619 5b5189-5b518e 611->619 620 5b5190-5b519c call 5efbad 611->620 612->607 617 5b53e0-5b53e2 615->617 618 5b53d5-5b53db call 5f54ef 615->618 622 5b5407-5b5425 call 5bd723 call 5ca6d0 call 5ca91e 617->622 623 5b53e4-5b53eb 617->623 618->617 619->607 631 5b519e 620->631 632 5b51b0-5b51bf call 5f0cd1 620->632 644 5b5453-5b5466 call 5b4e9c 622->644 645 5b5427-5b542f 622->645 623->622 626 5b53ed-5b5402 call 5f041b 623->626 626->622 634 5b51a3-5b51ab call 5f012f 631->634 641 5b51c8-5b51d7 call 5f29b3 632->641 642 5b51c1-5b51c6 632->642 634->615 650 5b51d9-5b51de 641->650 651 5b51e0-5b51ef call 5f343b 641->651 642->634 653 5b5468 call 5f3911 644->653 654 5b546d-5b5474 644->654 645->644 648 5b5431-5b5434 645->648 648->644 652 5b5436-5b5451 call 5c416a call 5b550f 648->652 650->634 663 5b51f8-5b5217 GetVersionExW 651->663 664 5b51f1-5b51f6 651->664 652->644 653->654 658 5b547b-5b5482 654->658 659 5b5476 call 5f2dd0 654->659 665 5b5489-5b5490 658->665 666 5b5484 call 5f1317 658->666 659->658 668 5b5219-5b524c GetLastError call 5b37d3 663->668 669 5b5251-5b5296 call 5b33d7 call 5b550f 663->669 664->634 671 5b5492 call 5efcbc 665->671 672 5b5497-5b5499 665->672 666->665 668->634 690 5b52a9-5b52b9 call 5c7337 669->690 691 5b5298-5b52a3 call 5f54ef 669->691 671->672 677 5b549b CoUninitialize 672->677 678 5b54a1-5b54a8 672->678 677->678 679 5b54aa-5b54ac 678->679 680 5b54e3-5b54ec call 5f000b 678->680 683 5b54ae-5b54b0 679->683 684 5b54b2-5b54b8 679->684 693 5b54ee call 5b44e9 680->693 694 5b54f3-5b550c call 5f06f5 call 5dde36 680->694 688 5b54ba-5b54d3 call 5c3c30 call 5b550f 683->688 684->688 688->680 709 5b54d5-5b54e2 call 5b550f 688->709 705 5b52bb 690->705 706 5b52c5-5b52ce 690->706 691->690 693->694 705->706 710 5b5396-5b53a3 call 5b4c33 706->710 711 5b52d4-5b52d7 706->711 709->680 717 5b53a8-5b53ac 710->717 714 5b536e-5b538a call 5b49df 711->714 715 5b52dd-5b52e0 711->715 722 5b53b8-5b53ca 714->722 727 5b538c 714->727 719 5b52e2-5b52e5 715->719 720 5b5346-5b5362 call 5b47e9 715->720 717->722 723 5b53ae 717->723 725 5b531e-5b533a call 5b4982 719->725 726 5b52e7-5b52ea 719->726 720->722 734 5b5364 720->734 722->615 723->722 725->722 736 5b533c 725->736 730 5b52fb-5b530e call 5b4b80 726->730 731 5b52ec-5b52f1 726->731 727->710 730->722 737 5b5314 730->737 731->730 734->714 736->720 737->725
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 005B510F
                                                                                                                                                                                                                          • Part of subcall function 005F03F0: InitializeCriticalSection.KERNEL32(0061B60C,?,005B511B,00000000,?,?,?,?,?,?), ref: 005F0407
                                                                                                                                                                                                                          • Part of subcall function 005B1209: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,005B5137,00000000,?), ref: 005B1247
                                                                                                                                                                                                                          • Part of subcall function 005B1209: GetLastError.KERNEL32(?,?,?,005B5137,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 005B1251
                                                                                                                                                                                                                        • CoInitializeEx.COMBASE(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 005B517D
                                                                                                                                                                                                                          • Part of subcall function 005F0CD1: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 005F0CF2
                                                                                                                                                                                                                        • GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 005B520F
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 005B5219
                                                                                                                                                                                                                        • CoUninitialize.COMBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 005B549B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
                                                                                                                                                                                                                        • String ID: 3.10.4.4718$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$Setup$_Failed$engine.cpp$txt
                                                                                                                                                                                                                        • API String ID: 3262001429-867073019
                                                                                                                                                                                                                        • Opcode ID: 7253db8c79780b14f700abc62c51778a6db089ff153802b347316b650ba1b53c
                                                                                                                                                                                                                        • Instruction ID: 789a836b82d653d1667fa90e263647089d30ea4314e4c341d80ad743dd4ba884
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7253db8c79780b14f700abc62c51778a6db089ff153802b347316b650ba1b53c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D2B1A771D41A2D9BEB369F64CC4ABFD7EA8BB44301F040095FA45A6241E774AE80DF91
                                                                                                                                                                                                                        Function 005B4C33 Relevance: 38.7, APIs: 6, Strings: 16, Instructions: 219COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 843 5b4c33-5b4c7b call 5df670 call 5b33d7 848 5b4c8f-5b4c99 call 5c96f2 843->848 849 5b4c7d-5b4c8a call 5f012f 843->849 854 5b4c9b-5b4ca0 848->854 855 5b4ca2-5b4cb1 call 5c96f8 848->855 856 5b4e2b-5b4e35 849->856 857 5b4cd7-5b4cf2 call 5b1f20 854->857 863 5b4cb6-5b4cba 855->863 859 5b4e40-5b4e44 856->859 860 5b4e37-5b4e3c CloseHandle 856->860 873 5b4cfb-5b4d0f call 5c6859 857->873 874 5b4cf4-5b4cf9 857->874 861 5b4e4f-5b4e53 859->861 862 5b4e46-5b4e4b CloseHandle 859->862 860->859 865 5b4e5e-5b4e60 861->865 866 5b4e55-5b4e5a CloseHandle 861->866 862->861 867 5b4cbc 863->867 868 5b4cd1-5b4cd4 863->868 870 5b4e62-5b4e63 CloseHandle 865->870 871 5b4e65-5b4e79 call 5b2793 * 2 865->871 866->865 872 5b4cc1-5b4ccc call 5f012f 867->872 868->857 870->871 889 5b4e7b-5b4e7e call 5f54ef 871->889 890 5b4e83-5b4e87 871->890 872->856 881 5b4d29-5b4d3d call 5c6915 873->881 882 5b4d11 873->882 874->872 892 5b4d3f-5b4d44 881->892 893 5b4d46-5b4d61 call 5b1f62 881->893 884 5b4d16 882->884 887 5b4d1b-5b4d24 call 5f012f 884->887 900 5b4e28 887->900 889->890 895 5b4e89-5b4e8c call 5f54ef 890->895 896 5b4e91-5b4e99 890->896 892->884 902 5b4d6d-5b4d86 call 5b1f62 893->902 903 5b4d63-5b4d68 893->903 895->896 900->856 906 5b4d88-5b4d8d 902->906 907 5b4d92-5b4dbe CreateProcessW 902->907 903->872 906->872 908 5b4dfb-5b4e11 call 5f0917 907->908 909 5b4dc0-5b4df6 GetLastError call 5b37d3 907->909 913 5b4e16-5b4e1a 908->913 909->887 913->856 914 5b4e1c-5b4e23 call 5f012f 913->914 914->900
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005B33D7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,005B10DD,?,00000000), ref: 005B33F8
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 005B4E3A
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 005B4E49
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(000000FF,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 005B4E58
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 005B4E63
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to launch clean room process: %ls, xrefs: 005B4DF1
                                                                                                                                                                                                                        • Failed to get path for current process., xrefs: 005B4C7D
                                                                                                                                                                                                                        • Failed to append %ls, xrefs: 005B4D16
                                                                                                                                                                                                                        • burn.filehandle.attached, xrefs: 005B4D11
                                                                                                                                                                                                                        • Failed to allocate full command-line., xrefs: 005B4D88
                                                                                                                                                                                                                        • Failed to append original command line., xrefs: 005B4D63
                                                                                                                                                                                                                        • burn.filehandle.self, xrefs: 005B4D3F
                                                                                                                                                                                                                        • Failed to cache to clean room., xrefs: 005B4CBC
                                                                                                                                                                                                                        • engine.cpp, xrefs: 005B4DE4
                                                                                                                                                                                                                        • D, xrefs: 005B4DA3
                                                                                                                                                                                                                        • "%ls" %ls, xrefs: 005B4D74
                                                                                                                                                                                                                        • -%ls="%ls", xrefs: 005B4CE0
                                                                                                                                                                                                                        • %ls %ls, xrefs: 005B4D4F
                                                                                                                                                                                                                        • burn.clean.room, xrefs: 005B4CD8
                                                                                                                                                                                                                        • Failed to allocate parameters for unelevated process., xrefs: 005B4CF4
                                                                                                                                                                                                                        • Failed to wait for clean room process: %ls, xrefs: 005B4E1D
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseHandle$FileModuleName
                                                                                                                                                                                                                        • String ID: "%ls" %ls$%ls %ls$-%ls="%ls"$D$Failed to allocate full command-line.$Failed to allocate parameters for unelevated process.$Failed to append %ls$Failed to append original command line.$Failed to cache to clean room.$Failed to get path for current process.$Failed to launch clean room process: %ls$Failed to wait for clean room process: %ls$burn.clean.room$burn.filehandle.attached$burn.filehandle.self$engine.cpp
                                                                                                                                                                                                                        • API String ID: 3884789274-2391192076
                                                                                                                                                                                                                        • Opcode ID: 098d8f92748f7fdd282f25c7845484ab6ae3508349a1097f88bde68b145744e4
                                                                                                                                                                                                                        • Instruction ID: b71393fffec6ef5b4f35fe891bd56c4049aba085ac668a4bf39f772dca6113c2
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 098d8f92748f7fdd282f25c7845484ab6ae3508349a1097f88bde68b145744e4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B1715271D0022AABDF219BA4CC45EFFBF78BF44710F104165FA14B6292DB74AA41DBA1
                                                                                                                                                                                                                        Function 005C7337 Relevance: 35.3, APIs: 1, Strings: 19, Instructions: 277COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 916 5c7337-5c737c call 5df670 call 5b7503 921 5c737e-5c7383 916->921 922 5c7388-5c7399 call 5bc2a1 916->922 923 5c7602-5c7609 call 5f012f 921->923 928 5c739b-5c73a0 922->928 929 5c73a5-5c73b6 call 5bc108 922->929 931 5c760a-5c760f 923->931 928->923 935 5c73b8-5c73bd 929->935 936 5c73c2-5c73d7 call 5bc362 929->936 933 5c7617-5c761b 931->933 934 5c7611-5c7612 call 5f54ef 931->934 938 5c761d-5c7620 call 5f54ef 933->938 939 5c7625-5c762a 933->939 934->933 935->923 947 5c73d9-5c73de 936->947 948 5c73e3-5c73f3 call 5dbdc9 936->948 938->939 942 5c762c-5c762d call 5f54ef 939->942 943 5c7632-5c763f call 5bc055 939->943 942->943 950 5c7649-5c764d 943->950 951 5c7641-5c7644 call 5f54ef 943->951 947->923 960 5c73ff-5c7472 call 5c5a35 948->960 961 5c73f5-5c73fa 948->961 954 5c764f-5c7652 call 5f54ef 950->954 955 5c7657-5c765b 950->955 951->950 954->955 958 5c765d-5c7660 call 5b3999 955->958 959 5c7665-5c766d 955->959 958->959 965 5c747e-5c74a6 call 5b550f GetCurrentProcess call 5f076c 960->965 966 5c7474-5c7479 960->966 961->923 970 5c74ab-5c74c2 call 5b8152 965->970 966->923 973 5c74dc-5c74e1 970->973 974 5c74c4-5c74d7 call 5f012f 970->974 976 5c753d-5c7542 973->976 977 5c74e3-5c74f5 call 5b80f6 973->977 974->931 978 5c7544-5c7556 call 5b80f6 976->978 979 5c7562-5c756b 976->979 988 5c74f7-5c74fc 977->988 989 5c7501-5c7511 call 5b3446 977->989 978->979 992 5c7558-5c755d 978->992 983 5c756d-5c7570 979->983 984 5c7577-5c758b call 5ca307 979->984 983->984 987 5c7572-5c7575 983->987 996 5c758d-5c7592 984->996 997 5c7594 984->997 987->984 993 5c759a-5c759d 987->993 988->923 1000 5c751d-5c7531 call 5b80f6 989->1000 1001 5c7513-5c7518 989->1001 992->923 998 5c759f-5c75a2 993->998 999 5c75a4-5c75ba call 5bd497 993->999 996->923 997->993 998->931 998->999 1006 5c75bc-5c75c1 999->1006 1007 5c75c3-5c75db call 5bcabe 999->1007 1000->976 1008 5c7533-5c7538 1000->1008 1001->923 1006->923 1011 5c75dd-5c75e2 1007->1011 1012 5c75e4-5c75fb call 5bc7df 1007->1012 1008->923 1011->923 1012->931 1015 5c75fd 1012->1015 1015->923
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to initialize internal cache functionality., xrefs: 005C758D
                                                                                                                                                                                                                        • Failed to parse command line., xrefs: 005C7474
                                                                                                                                                                                                                        • WixBundleOriginalSource, xrefs: 005C7547
                                                                                                                                                                                                                        • Failed to open attached UX container., xrefs: 005C739B
                                                                                                                                                                                                                        • Failed to get unique temporary folder for bootstrapper application., xrefs: 005C75BC
                                                                                                                                                                                                                        • Failed to set original source variable., xrefs: 005C7558
                                                                                                                                                                                                                        • Failed to open manifest stream., xrefs: 005C73B8
                                                                                                                                                                                                                        • Failed to extract bootstrapper application payloads., xrefs: 005C75DD
                                                                                                                                                                                                                        • Failed to get source process folder from path., xrefs: 005C7513
                                                                                                                                                                                                                        • Failed to set source process path variable., xrefs: 005C74F7
                                                                                                                                                                                                                        • WixBundleSourceProcessPath, xrefs: 005C74E6
                                                                                                                                                                                                                        • WixBundleSourceProcessFolder, xrefs: 005C7522
                                                                                                                                                                                                                        • Failed to load manifest., xrefs: 005C73F5
                                                                                                                                                                                                                        • Failed to load catalog files., xrefs: 005C75FD
                                                                                                                                                                                                                        • Failed to set source process folder variable., xrefs: 005C7533
                                                                                                                                                                                                                        • Failed to initialize variables., xrefs: 005C737E
                                                                                                                                                                                                                        • WixBundleElevated, xrefs: 005C74B3, 005C74C4
                                                                                                                                                                                                                        • Failed to overwrite the %ls built-in variable., xrefs: 005C74C9
                                                                                                                                                                                                                        • Failed to get manifest stream from container., xrefs: 005C73D9
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalInitializeSection
                                                                                                                                                                                                                        • String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath
                                                                                                                                                                                                                        • API String ID: 32694325-252221001
                                                                                                                                                                                                                        • Opcode ID: f858b57b11b10666caf8bd0fedf5edd882e7e6b4cca9c59947ed803f5527a1b7
                                                                                                                                                                                                                        • Instruction ID: f5ddb558493fed53a6a7d86dbbd737e5d18d955b242c9849024c62e29810a569
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f858b57b11b10666caf8bd0fedf5edd882e7e6b4cca9c59947ed803f5527a1b7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FE917572944A1EBFCB269AE4CC45FEFBF6CBF08700F01452AE611A6541DB34A944DBD4
                                                                                                                                                                                                                        Function 005C84C4 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 205fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 1016 5c84c4-5c8512 CreateFileW 1017 5c8558-5c8568 call 5f47d3 1016->1017 1018 5c8514-5c8553 GetLastError call 5b37d3 call 5f012f 1016->1018 1024 5c856a-5c857b call 5f012f 1017->1024 1025 5c8580-5c8594 call 5f3db5 1017->1025 1031 5c86fc-5c870e call 5dde36 1018->1031 1032 5c86f5-5c86f6 CloseHandle 1024->1032 1033 5c85af-5c85b4 1025->1033 1034 5c8596-5c85aa call 5f012f 1025->1034 1032->1031 1033->1032 1037 5c85ba-5c85c9 SetFilePointerEx 1033->1037 1034->1032 1040 5c85cb-5c85fe GetLastError call 5b37d3 1037->1040 1041 5c8603-5c8613 call 5f4cee 1037->1041 1048 5c86ed-5c86f4 call 5f012f 1040->1048 1046 5c861f-5c8630 SetFilePointerEx 1041->1046 1047 5c8615-5c861a 1041->1047 1049 5c866a-5c867a call 5f4cee 1046->1049 1050 5c8632-5c8665 GetLastError call 5b37d3 1046->1050 1047->1048 1048->1032 1049->1047 1057 5c867c-5c868c call 5f4cee 1049->1057 1050->1048 1057->1047 1060 5c868e-5c869f SetFilePointerEx 1057->1060 1061 5c86d6-5c86dd call 5f4cee 1060->1061 1062 5c86a1-5c86d4 GetLastError call 5b37d3 1060->1062 1065 5c86e2-5c86e6 1061->1065 1062->1048 1065->1032 1067 5c86e8 1065->1067 1067->1048
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateFileW.KERNELBASE(00000000,40000000,00000005,00000000,00000002,08000080,00000000,?,00000000,00000000,005B4CB6,?,?,00000000,005B4CB6,00000000), ref: 005C8507
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005C8514
                                                                                                                                                                                                                        • CloseHandle.KERNELBASE(00000000,?,00000000,005FB4F0,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005C86F6
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to copy engine from: %ls to: %ls, xrefs: 005C859C
                                                                                                                                                                                                                        • Failed to seek to signature table in exe header., xrefs: 005C8660
                                                                                                                                                                                                                        • Failed to zero out original data offset., xrefs: 005C86E8
                                                                                                                                                                                                                        • Failed to seek to checksum in exe header., xrefs: 005C85F9
                                                                                                                                                                                                                        • cabinet.dll, xrefs: 005C866F
                                                                                                                                                                                                                        • Failed to seek to original data in exe burn section header., xrefs: 005C86CF
                                                                                                                                                                                                                        • Failed to create engine file at path: %ls, xrefs: 005C8545
                                                                                                                                                                                                                        • cache.cpp, xrefs: 005C8538, 005C85EF, 005C8656, 005C86C5
                                                                                                                                                                                                                        • Failed to update signature offset., xrefs: 005C8615
                                                                                                                                                                                                                        • msi.dll, xrefs: 005C8608
                                                                                                                                                                                                                        • Failed to seek to beginning of engine file: %ls, xrefs: 005C856D
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                        • String ID: Failed to copy engine from: %ls to: %ls$Failed to create engine file at path: %ls$Failed to seek to beginning of engine file: %ls$Failed to seek to checksum in exe header.$Failed to seek to original data in exe burn section header.$Failed to seek to signature table in exe header.$Failed to update signature offset.$Failed to zero out original data offset.$cabinet.dll$cache.cpp$msi.dll
                                                                                                                                                                                                                        • API String ID: 2528220319-1976062716
                                                                                                                                                                                                                        • Opcode ID: a8760c51ba14995ba8d9bba59df4cccf25433e22b760ec5b654ea933b16ce83b
                                                                                                                                                                                                                        • Instruction ID: 017eb7156003bcb8566f901600c84971be669dbb418c728d9d2a27d430615efe
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a8760c51ba14995ba8d9bba59df4cccf25433e22b760ec5b654ea933b16ce83b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E951C672E80225BFFB116BA88C4AFBB3A99FB54750F010129FE00F7181EB649D00D6E5
                                                                                                                                                                                                                        Function 005B7503 Relevance: 33.4, APIs: 1, Strings: 21, Instructions: 378COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 1068 5b7503-5b7dc0 InitializeCriticalSection 1069 5b7dc3-5b7de0 call 5b5530 1068->1069 1072 5b7ded-5b7dfb call 5f012f 1069->1072 1073 5b7de2-5b7de9 1069->1073 1076 5b7dfe-5b7e10 call 5dde36 1072->1076 1073->1069 1074 5b7deb 1073->1074 1074->1076
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • InitializeCriticalSection.KERNEL32(005C7378,005B52B5,00000000,005B533D), ref: 005B7523
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalInitializeSection
                                                                                                                                                                                                                        • String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleVersion
                                                                                                                                                                                                                        • API String ID: 32694325-826827252
                                                                                                                                                                                                                        • Opcode ID: 43fcf9c93482caf13533c85d8c8704d5676fe44a1cd7b19c44b9368b8c176a11
                                                                                                                                                                                                                        • Instruction ID: 1c551925c844f6ca2305f1518f31b31719d01970eaf11cd412fbcd882a01d589
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 43fcf9c93482caf13533c85d8c8704d5676fe44a1cd7b19c44b9368b8c176a11
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A3321DB0C1527D8BDB65CF5989887DDBEF8BB49B04F5081EAE24CA6211D7B41B84CF84
                                                                                                                                                                                                                        Function 005C80AE Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 151COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 1080 5c80ae-5c80f7 call 5df670 1083 5c80fd-5c810b GetCurrentProcess call 5f076c 1080->1083 1084 5c8270-5c827d call 5b21a5 1080->1084 1088 5c8110-5c811d 1083->1088 1089 5c828c-5c829e call 5dde36 1084->1089 1090 5c827f 1084->1090 1091 5c81ab-5c81b9 GetTempPathW 1088->1091 1092 5c8123-5c8132 GetWindowsDirectoryW 1088->1092 1095 5c8284-5c828b call 5f012f 1090->1095 1093 5c81bb-5c81ee GetLastError call 5b37d3 1091->1093 1094 5c81f3-5c8205 UuidCreate 1091->1094 1096 5c816c-5c817d call 5b338f 1092->1096 1097 5c8134-5c8167 GetLastError call 5b37d3 1092->1097 1093->1095 1101 5c820e-5c8223 StringFromGUID2 1094->1101 1102 5c8207-5c820c 1094->1102 1095->1089 1113 5c817f-5c8184 1096->1113 1114 5c8189-5c819f call 5b36b4 1096->1114 1097->1095 1108 5c8225-5c823f call 5b37d3 1101->1108 1109 5c8241-5c8262 call 5b1f20 1101->1109 1102->1095 1108->1095 1119 5c826b 1109->1119 1120 5c8264-5c8269 1109->1120 1113->1095 1114->1094 1122 5c81a1-5c81a6 1114->1122 1119->1084 1120->1095 1122->1095
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,005B5381), ref: 005C8104
                                                                                                                                                                                                                          • Part of subcall function 005F076C: OpenProcessToken.ADVAPI32(?,00000008,?,005B52B5,00000000,?,?,?,?,?,?,?,005C74AB,00000000), ref: 005F078A
                                                                                                                                                                                                                          • Part of subcall function 005F076C: GetLastError.KERNEL32(?,?,?,?,?,?,?,005C74AB,00000000), ref: 005F0794
                                                                                                                                                                                                                          • Part of subcall function 005F076C: CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,005C74AB,00000000), ref: 005F081D
                                                                                                                                                                                                                        • GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 005C812A
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005C8134
                                                                                                                                                                                                                        • GetTempPathW.KERNEL32(00000104,?,00000000), ref: 005C81B1
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005C81BB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Temp\, xrefs: 005C8189
                                                                                                                                                                                                                        • Failed to append bundle id on to temp path for working folder., xrefs: 005C8264
                                                                                                                                                                                                                        • Failed to create working folder guid., xrefs: 005C8207
                                                                                                                                                                                                                        • Failed to get temp path for working folder., xrefs: 005C81E9
                                                                                                                                                                                                                        • cache.cpp, xrefs: 005C8158, 005C81DF, 005C8230
                                                                                                                                                                                                                        • Failed to concat Temp directory on windows path for working folder., xrefs: 005C81A1
                                                                                                                                                                                                                        • Failed to convert working folder guid into string., xrefs: 005C823A
                                                                                                                                                                                                                        • Failed to ensure windows path for working folder ended in backslash., xrefs: 005C817F
                                                                                                                                                                                                                        • Failed to get windows path for working folder., xrefs: 005C8162
                                                                                                                                                                                                                        • %ls%ls\, xrefs: 005C824C
                                                                                                                                                                                                                        • Failed to copy working folder path., xrefs: 005C827F
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$Process$CloseCurrentDirectoryHandleOpenPathTempTokenWindows
                                                                                                                                                                                                                        • String ID: %ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$cache.cpp
                                                                                                                                                                                                                        • API String ID: 348923985-819636856
                                                                                                                                                                                                                        • Opcode ID: 6d94780f32e901d42c69a015ad3fc5bb880b218381b4330c2be772a3ce315144
                                                                                                                                                                                                                        • Instruction ID: a70a1a83dd4f203bd56e19cb846e22ed329db099de637ad0cdf850432976e3be
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6d94780f32e901d42c69a015ad3fc5bb880b218381b4330c2be772a3ce315144
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6C41F372B80725ABEB20A6E4CD4EFBB7BACBB40710F054159F905F71C0EA749D04CAA1
                                                                                                                                                                                                                        Function 005D0E43 Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 210COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 1123 5d0e43-5d0e6f CoInitializeEx 1124 5d0e71-5d0e7e call 5f012f 1123->1124 1125 5d0e83-5d0ece call 5ef364 1123->1125 1130 5d10df-5d10f1 call 5dde36 1124->1130 1131 5d0ef8-5d0f1a call 5ef374 1125->1131 1132 5d0ed0-5d0ef3 call 5b37d3 call 5f012f 1125->1132 1140 5d0f20-5d0f28 1131->1140 1141 5d0fd3-5d0fde SetEvent 1131->1141 1147 5d10d8-5d10d9 CoUninitialize 1132->1147 1143 5d0f2e-5d0f34 1140->1143 1144 5d10d0-5d10d3 call 5ef384 1140->1144 1145 5d101b-5d1029 WaitForSingleObject 1141->1145 1146 5d0fe0-5d1009 GetLastError call 5b37d3 1141->1146 1143->1144 1151 5d0f3a-5d0f42 1143->1151 1144->1147 1149 5d105b-5d1066 ResetEvent 1145->1149 1150 5d102b-5d1059 GetLastError call 5b37d3 1145->1150 1159 5d100e-5d1016 call 5f012f 1146->1159 1147->1130 1157 5d1068-5d1096 GetLastError call 5b37d3 1149->1157 1158 5d109b-5d10a1 1149->1158 1150->1159 1155 5d0fbb-5d0fce call 5f012f 1151->1155 1156 5d0f44-5d0f46 1151->1156 1155->1144 1161 5d0f58-5d0f5b 1156->1161 1162 5d0f48-5d0f56 1156->1162 1157->1159 1165 5d10cb 1158->1165 1166 5d10a3-5d10a6 1158->1166 1159->1144 1169 5d0f5d 1161->1169 1170 5d0fb5 1161->1170 1168 5d0fb7-5d0fb9 1162->1168 1165->1144 1173 5d10a8-5d10c2 call 5b37d3 1166->1173 1174 5d10c7-5d10c9 1166->1174 1168->1141 1168->1155 1176 5d0f9c-5d0fa1 1169->1176 1177 5d0f8e-5d0f93 1169->1177 1178 5d0f79-5d0f7e 1169->1178 1179 5d0f6b-5d0f70 1169->1179 1180 5d0faa-5d0faf 1169->1180 1181 5d0f95-5d0f9a 1169->1181 1182 5d0f64-5d0f69 1169->1182 1183 5d0f87-5d0f8c 1169->1183 1184 5d0fb1-5d0fb3 1169->1184 1185 5d0f80-5d0f85 1169->1185 1186 5d0fa3-5d0fa8 1169->1186 1187 5d0f72-5d0f77 1169->1187 1170->1168 1173->1159 1174->1144 1176->1155 1177->1155 1178->1155 1179->1155 1180->1155 1181->1155 1182->1155 1183->1155 1184->1155 1185->1155 1186->1155 1187->1155
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CoInitializeEx.OLE32(00000000,00000000), ref: 005D0E65
                                                                                                                                                                                                                        • CoUninitialize.COMBASE ref: 005D10D9
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InitializeUninitialize
                                                                                                                                                                                                                        • String ID: <the>.cab$Failed to extract all files from container, erf: %d:%X:%d$Failed to initialize COM.$Failed to initialize cabinet.dll.$Failed to reset begin operation event.$Failed to set operation complete event.$Failed to wait for begin operation event.$Invalid operation for this state.$cabextract.cpp
                                                                                                                                                                                                                        • API String ID: 3442037557-1168358783
                                                                                                                                                                                                                        • Opcode ID: 2da2e380577c91b4d3392422c8e5b969adcd44898e41cb5e3b66a0cd33d9bfc8
                                                                                                                                                                                                                        • Instruction ID: 96dd12004111c12589e4ca5feb475f367ae95669cfeac25373a5a5a20fe59e2a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2da2e380577c91b4d3392422c8e5b969adcd44898e41cb5e3b66a0cd33d9bfc8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 72514976A80762E7D73067AC8C49F6B7E64FB40761F264227FC02BB3C0D6598D4096D6
                                                                                                                                                                                                                        Function 005B41D2 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 158stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 1190 5b41d2-5b4229 InitializeCriticalSection * 2 call 5c4b0e * 2 1195 5b422f 1190->1195 1196 5b434d-5b4357 call 5bb389 1190->1196 1197 5b4235-5b4242 1195->1197 1201 5b435c-5b4360 1196->1201 1199 5b4248-5b4274 lstrlenW * 2 CompareStringW 1197->1199 1200 5b4340-5b4347 1197->1200 1202 5b42c6-5b42f2 lstrlenW * 2 CompareStringW 1199->1202 1203 5b4276-5b4299 lstrlenW 1199->1203 1200->1196 1200->1197 1204 5b436f-5b4377 1201->1204 1205 5b4362-5b436e call 5f012f 1201->1205 1202->1200 1209 5b42f4-5b4317 lstrlenW 1202->1209 1206 5b429f-5b42a4 1203->1206 1207 5b4385-5b439a call 5b37d3 1203->1207 1205->1204 1206->1207 1210 5b42aa-5b42ba call 5b29dc 1206->1210 1221 5b439f-5b43a6 1207->1221 1213 5b431d-5b4322 1209->1213 1214 5b43b1-5b43cb call 5b37d3 1209->1214 1223 5b437a-5b4383 1210->1223 1224 5b42c0 1210->1224 1213->1214 1218 5b4328-5b4338 call 5b29dc 1213->1218 1214->1221 1218->1223 1227 5b433a 1218->1227 1225 5b43a7-5b43af call 5f012f 1221->1225 1223->1225 1224->1202 1225->1204 1227->1200
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,005B515E,?,?,00000000,?,?), ref: 005B41FE
                                                                                                                                                                                                                        • InitializeCriticalSection.KERNEL32(000000D0,?,?,005B515E,?,?,00000000,?,?), ref: 005B4207
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,005B515E,?,?,00000000,?,?), ref: 005B424D
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,005B515E,?,?,00000000,?,?), ref: 005B4257
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,005B515E,?,?,00000000,?,?), ref: 005B426B
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(burn.filehandle.attached,?,?,005B515E,?,?,00000000,?,?), ref: 005B427B
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(burn.filehandle.self,?,?,005B515E,?,?,00000000,?,?), ref: 005B42CB
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,005B515E,?,?,00000000,?,?), ref: 005B42D5
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,005B515E,?,?,00000000,?,?), ref: 005B42E9
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(burn.filehandle.self,?,?,005B515E,?,?,00000000,?,?), ref: 005B42F9
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: lstrlen$CompareCriticalInitializeSectionString
                                                                                                                                                                                                                        • String ID: Failed to initialize engine section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$engine.cpp
                                                                                                                                                                                                                        • API String ID: 3039292287-3209860532
                                                                                                                                                                                                                        • Opcode ID: 8e15849147597204f74f24243b9bf926181b82d75b1e8a68398f41dc05b6fbde
                                                                                                                                                                                                                        • Instruction ID: a7139e9514dfffbe11f779054f75efcb9568fdae6c2baa4d73b9b5bf61b8be38
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8e15849147597204f74f24243b9bf926181b82d75b1e8a68398f41dc05b6fbde
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3151C371A0021ABFDB209B69CC46FBABFA8FB44760F040115F618D7291DB74B990CBA4
                                                                                                                                                                                                                        Function 005BC129 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 128fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 1230 5bc129-5bc15b 1231 5bc15d-5bc17b CreateFileW 1230->1231 1232 5bc1c5-5bc1e1 GetCurrentProcess * 2 DuplicateHandle 1230->1232 1233 5bc21d-5bc223 1231->1233 1234 5bc181-5bc1b2 GetLastError call 5b37d3 1231->1234 1235 5bc21b 1232->1235 1236 5bc1e3-5bc219 GetLastError call 5b37d3 1232->1236 1237 5bc22d 1233->1237 1238 5bc225-5bc22b 1233->1238 1244 5bc1b7-5bc1c0 call 5f012f 1234->1244 1235->1233 1236->1244 1242 5bc22f-5bc23d SetFilePointerEx 1237->1242 1238->1242 1245 5bc23f-5bc272 GetLastError call 5b37d3 1242->1245 1246 5bc274-5bc27a 1242->1246 1248 5bc298-5bc29e 1244->1248 1254 5bc290-5bc297 call 5f012f 1245->1254 1246->1248 1249 5bc27c-5bc280 call 5d1484 1246->1249 1255 5bc285-5bc289 1249->1255 1254->1248 1255->1248 1256 5bc28b 1255->1256 1256->1254
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateFileW.KERNEL32(00000000,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,00000000,?,005BC319,005B52FD,?,?,005B533D), ref: 005BC170
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005BC319,005B52FD,?,?,005B533D,005B533D,00000000,?,00000000), ref: 005BC181
                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,?,00000000,00000000,?,005BC319,005B52FD,?,?,005B533D,005B533D,00000000,?), ref: 005BC1D0
                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(000000FF,00000000,?,005BC319,005B52FD,?,?,005B533D,005B533D,00000000,?,00000000), ref: 005BC1D6
                                                                                                                                                                                                                        • DuplicateHandle.KERNELBASE(00000000,?,005BC319,005B52FD,?,?,005B533D,005B533D,00000000,?,00000000), ref: 005BC1D9
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005BC319,005B52FD,?,?,005B533D,005B533D,00000000,?,00000000), ref: 005BC1E3
                                                                                                                                                                                                                        • SetFilePointerEx.KERNELBASE(?,00000000,00000000,00000000,00000000,?,005BC319,005B52FD,?,?,005B533D,005B533D,00000000,?,00000000), ref: 005BC235
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005BC319,005B52FD,?,?,005B533D,005B533D,00000000,?,00000000), ref: 005BC23F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
                                                                                                                                                                                                                        • String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$container.cpp$crypt32.dll$feclient.dll
                                                                                                                                                                                                                        • API String ID: 2619879409-373955632
                                                                                                                                                                                                                        • Opcode ID: c3ffd5160b2450d9e9b4f0dd82ba85ac01ad39c691bc6d7921cf09f4ab9f1f88
                                                                                                                                                                                                                        • Instruction ID: 24c0da8b84fe824503b1d129dfe851a780e9b53bb761dd2ae8e1fed64a63023a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c3ffd5160b2450d9e9b4f0dd82ba85ac01ad39c691bc6d7921cf09f4ab9f1f88
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3A41EF76240305ABEB109F69DC89EA77FE9FFC4750F114029F908EB291DA35D801DB64
                                                                                                                                                                                                                        Function 005F29B3 Relevance: 26.3, APIs: 7, Strings: 8, Instructions: 86libraryloaderCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005B37EA: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005B3829
                                                                                                                                                                                                                          • Part of subcall function 005B37EA: GetLastError.KERNEL32 ref: 005B3833
                                                                                                                                                                                                                          • Part of subcall function 005F4932: GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 005F495A
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(MsiDeterminePatchSequenceW,00000000), ref: 005F29FD
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(MsiDetermineApplicablePatchesW), ref: 005F2A20
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(MsiEnumProductsExW), ref: 005F2A43
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(MsiGetPatchInfoExW), ref: 005F2A66
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(MsiGetProductInfoExW), ref: 005F2A89
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(MsiSetExternalUIRecord), ref: 005F2AAC
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(MsiSourceListAddSourceExW), ref: 005F2ACF
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressProc$ErrorLast$DirectorySystem
                                                                                                                                                                                                                        • String ID: Msi.dll$MsiDetermineApplicablePatchesW$MsiDeterminePatchSequenceW$MsiEnumProductsExW$MsiGetPatchInfoExW$MsiGetProductInfoExW$MsiSetExternalUIRecord$MsiSourceListAddSourceExW
                                                                                                                                                                                                                        • API String ID: 2510051996-1735120554
                                                                                                                                                                                                                        • Opcode ID: baa2d04da883fa04d73fb4a689ec955f320eb5d2c8f8c65e2380f7f99d5959c2
                                                                                                                                                                                                                        • Instruction ID: 73a6b0e8da57772e92d190716c2420b9cec6a49fc7fa9e18475459f463f2ad49
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: baa2d04da883fa04d73fb4a689ec955f320eb5d2c8f8c65e2380f7f99d5959c2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2E3108B0641318AFDB18DF25EC56AE93AA7B769700749F42FF405922B0D7B59840EF80
                                                                                                                                                                                                                        Function 005F2F23 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 152libraryloadercomCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,005F34DF,00000000,?,00000000), ref: 005F2F3D
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,005DBDED,?,005B52FD,?,00000000,?), ref: 005F2F49
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 005F2F89
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 005F2F95
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,Wow64EnableWow64FsRedirection), ref: 005F2FA0
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 005F2FAA
                                                                                                                                                                                                                        • CoCreateInstance.OLE32(0061B6C8,00000000,00000001,005FB808,?,?,?,?,?,?,?,?,?,?,?,005DBDED), ref: 005F2FE5
                                                                                                                                                                                                                        • ExitProcess.KERNEL32 ref: 005F3094
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressProc$CreateErrorExitHandleInstanceLastModuleProcess
                                                                                                                                                                                                                        • String ID: IsWow64Process$Wow64DisableWow64FsRedirection$Wow64EnableWow64FsRedirection$Wow64RevertWow64FsRedirection$kernel32.dll$xmlutil.cpp
                                                                                                                                                                                                                        • API String ID: 2124981135-499589564
                                                                                                                                                                                                                        • Opcode ID: c3b01f638cdfc288b9f2a60f4aa6be9f28233686040863e1cb41262255d9aedf
                                                                                                                                                                                                                        • Instruction ID: 9cbb44217e35bb24d534c6e0775a05e888db612324863f4f96cb1da697dace40
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c3b01f638cdfc288b9f2a60f4aa6be9f28233686040863e1cb41262255d9aedf
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4D41B635A01219ABEB20DFA8C849FBE7FA9FF44710F154069FA05E7250DB79DE409B90
                                                                                                                                                                                                                        Function 005D1484 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 103COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,wininet.dll,?,00000000,00000000,00000000,?,?,005BC285,?,00000000,?,005BC319), ref: 005D14BB
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005BC285,?,00000000,?,005BC319,005B52FD,?,?,005B533D,005B533D,00000000,?,00000000), ref: 005D14C4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CreateErrorEventLast
                                                                                                                                                                                                                        • String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$cabextract.cpp$wininet.dll
                                                                                                                                                                                                                        • API String ID: 545576003-938279966
                                                                                                                                                                                                                        • Opcode ID: 3ed74dfff5610d979079cf9d2498ef00b054c1a26b7132550708b68ff35a1c7e
                                                                                                                                                                                                                        • Instruction ID: d938e9ba0d19b65361c354a379f700e2002f2263d3d82263bb56fda182638f6b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3ed74dfff5610d979079cf9d2498ef00b054c1a26b7132550708b68ff35a1c7e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BC21F8B6A80B26BAF72056B96C45F772DDCFB447D0B024213BC06E7281DA58DD008AE6
                                                                                                                                                                                                                        Function 005EFBAD Relevance: 22.8, APIs: 6, Strings: 7, Instructions: 74libraryloaderCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetProcAddress.KERNELBASE(SystemFunction040,AdvApi32.dll), ref: 005EFBD5
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(SystemFunction041), ref: 005EFBE7
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(CryptProtectMemory,Crypt32.dll), ref: 005EFC2A
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 005EFC3E
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(CryptUnprotectMemory), ref: 005EFC76
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 005EFC8A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressProc$ErrorLast
                                                                                                                                                                                                                        • String ID: AdvApi32.dll$Crypt32.dll$CryptProtectMemory$CryptUnprotectMemory$SystemFunction040$SystemFunction041$cryputil.cpp
                                                                                                                                                                                                                        • API String ID: 4214558900-3191127217
                                                                                                                                                                                                                        • Opcode ID: 66b44c0eeba04879ed9c53577a9afb993755fc59cf9af83082cd4b36ae31c549
                                                                                                                                                                                                                        • Instruction ID: 3bb09e3e4fce43a55ae50c710f452fb4309e41916c2b2be6b006270209d66875
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 66b44c0eeba04879ed9c53577a9afb993755fc59cf9af83082cd4b36ae31c549
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3621F275A44366ABE3256F2BDC09BD6AD97FB10740F2AA136FC04E6160EF648C40DB90
                                                                                                                                                                                                                        Function 005D0627 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 103fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CompareStringA.KERNELBASE(00000000,00000000,<the>.cab,?,?), ref: 005D0657
                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(?,00000000,00000000,00000000,?,?), ref: 005D066F
                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(?,00000000,?,?), ref: 005D0674
                                                                                                                                                                                                                        • DuplicateHandle.KERNELBASE(00000000,?,?), ref: 005D0677
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?), ref: 005D0681
                                                                                                                                                                                                                        • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,08000080,00000000,?,?), ref: 005D06F0
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?), ref: 005D06FD
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to duplicate handle to cab container., xrefs: 005D06AF
                                                                                                                                                                                                                        • Failed to open cabinet file: %hs, xrefs: 005D072E
                                                                                                                                                                                                                        • <the>.cab, xrefs: 005D0650
                                                                                                                                                                                                                        • cabextract.cpp, xrefs: 005D06A5, 005D0721
                                                                                                                                                                                                                        • Failed to add virtual file pointer for cab container., xrefs: 005D06D6
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CurrentErrorLastProcess$CompareCreateDuplicateFileHandleString
                                                                                                                                                                                                                        • String ID: <the>.cab$Failed to add virtual file pointer for cab container.$Failed to duplicate handle to cab container.$Failed to open cabinet file: %hs$cabextract.cpp
                                                                                                                                                                                                                        • API String ID: 3030546534-3446344238
                                                                                                                                                                                                                        • Opcode ID: 5ba15894e0cee49e361048152109c081bf88b36b0b76c743faea7d0981653c40
                                                                                                                                                                                                                        • Instruction ID: fd1ffe3e10da0798285381f72c803cbb9a33743c5ff0083200cc52749c4fc531
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5ba15894e0cee49e361048152109c081bf88b36b0b76c743faea7d0981653c40
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3E31D272A41325FBEB206BA98C49FAB7EADFF047A0F010116FD04E7290C7259D10D6E1
                                                                                                                                                                                                                        Function 005C6859 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 68COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(000000FF,00000000,00000001,00000002,?,00000000,?,?,005B4D0B,?,?), ref: 005C6879
                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(?,00000000,?,?,005B4D0B,?,?), ref: 005C687F
                                                                                                                                                                                                                        • DuplicateHandle.KERNELBASE(00000000,?,?,005B4D0B,?,?), ref: 005C6882
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,005B4D0B,?,?), ref: 005C688C
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(000000FF,?,005B4D0B,?,?), ref: 005C6905
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to duplicate file handle for attached container., xrefs: 005C68BA
                                                                                                                                                                                                                        • Failed to append the file handle to the command line., xrefs: 005C68ED
                                                                                                                                                                                                                        • burn.filehandle.attached, xrefs: 005C68D2
                                                                                                                                                                                                                        • %ls -%ls=%u, xrefs: 005C68D9
                                                                                                                                                                                                                        • core.cpp, xrefs: 005C68B0
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CurrentHandleProcess$CloseDuplicateErrorLast
                                                                                                                                                                                                                        • String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to duplicate file handle for attached container.$burn.filehandle.attached$core.cpp
                                                                                                                                                                                                                        • API String ID: 4224961946-4196573879
                                                                                                                                                                                                                        • Opcode ID: 9f8299e6b574d9988a1aa14a3f1fb29282406724a31929864d0ef6be369b4abf
                                                                                                                                                                                                                        • Instruction ID: 2df64089cf0cca556d931539ef30609650912f91b9cdd4433cc50816d2e36acd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9f8299e6b574d9988a1aa14a3f1fb29282406724a31929864d0ef6be369b4abf
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2311B431A40719FBDB10ABA89D09E9B7BADFF04730F110215F911E71D0D7759E00D690
                                                                                                                                                                                                                        Function 005C6915 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 72fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateFileW.KERNELBASE(?,80000000,00000005,?,00000003,00000080,00000000,?,00000000,?,?,?), ref: 005C694B
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 005C69BB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseCreateFileHandle
                                                                                                                                                                                                                        • String ID: %ls -%ls=%u$Failed to append the file handle to the command line.$Failed to append the file handle to the obfuscated command line.$burn.filehandle.self
                                                                                                                                                                                                                        • API String ID: 3498533004-3263533295
                                                                                                                                                                                                                        • Opcode ID: 8c28c9b42c2dbbcac09fff3563423148949a035fb4ba0e6faf6b3f0608742e61
                                                                                                                                                                                                                        • Instruction ID: a005b7ee16e99b93f8ecfa1330018bd2cbf8e99fba44206128e490113cda650b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8c28c9b42c2dbbcac09fff3563423148949a035fb4ba0e6faf6b3f0608742e61
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6D11E932640614BFDB205AA8DC09F6B7FADFB89B70F014354FD24AB1D1D7745910C695
                                                                                                                                                                                                                        Function 005F076C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • OpenProcessToken.ADVAPI32(?,00000008,?,005B52B5,00000000,?,?,?,?,?,?,?,005C74AB,00000000), ref: 005F078A
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,005C74AB,00000000), ref: 005F0794
                                                                                                                                                                                                                        • GetTokenInformation.KERNELBASE(?,00000014(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,005C74AB,00000000), ref: 005F07C6
                                                                                                                                                                                                                        • CloseHandle.KERNELBASE(?,?,?,?,?,?,?,?,005C74AB,00000000), ref: 005F081D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Token$CloseErrorHandleInformationLastOpenProcess
                                                                                                                                                                                                                        • String ID: procutil.cpp
                                                                                                                                                                                                                        • API String ID: 3370771294-1178289305
                                                                                                                                                                                                                        • Opcode ID: e62a4f74970a8e0da532b5de40cd387e58c1f35265a9a5377450aeb041f9eeeb
                                                                                                                                                                                                                        • Instruction ID: aec832982148718a3c864316f35fe632ee1a3b3e21745c7088dde721d9c155f6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e62a4f74970a8e0da532b5de40cd387e58c1f35265a9a5377450aeb041f9eeeb
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9F219271E00228EBEB10AB95CC48AAEBBACFF54750F154066AE15E71A0D7348E04EBD0
                                                                                                                                                                                                                        Function 005F343B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CoInitialize.OLE32(00000000), ref: 005F344A
                                                                                                                                                                                                                        • InterlockedIncrement.KERNEL32(0061B6D8), ref: 005F3467
                                                                                                                                                                                                                        • CLSIDFromProgID.COMBASE(Msxml2.DOMDocument,0061B6C8,?,?,?,?,?,?), ref: 005F3482
                                                                                                                                                                                                                        • CLSIDFromProgID.OLE32(MSXML.DOMDocument,0061B6C8,?,?,?,?,?,?), ref: 005F348E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FromProg$IncrementInitializeInterlocked
                                                                                                                                                                                                                        • String ID: MSXML.DOMDocument$Msxml2.DOMDocument
                                                                                                                                                                                                                        • API String ID: 2109125048-2356320334
                                                                                                                                                                                                                        • Opcode ID: ad8967fb82ef50d05d91de7955088134ee230cacf3c78a0b77c5e22adad3557e
                                                                                                                                                                                                                        • Instruction ID: 0b3f53c41f75d4f190221b24ef70f43d3c123561a13a6ae4af559d1a93d766e4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ad8967fb82ef50d05d91de7955088134ee230cacf3c78a0b77c5e22adad3557e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0CF0EC2074123997FF128B96EC0DF7B5E67BBA0F64F151425FA00D1194E35C8581DAF0
                                                                                                                                                                                                                        Function 005F4932 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 94memoryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 005F495A
                                                                                                                                                                                                                        • GlobalAlloc.KERNEL32(00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 005F4989
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00000000,00000000,00000000), ref: 005F49B3
                                                                                                                                                                                                                        • GetLastError.KERNEL32(00000000,005FB790,?,?,?,00000000,00000000,00000000), ref: 005F49F4
                                                                                                                                                                                                                        • GlobalFree.KERNEL32(00000000), ref: 005F4A28
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$Global$AllocFree
                                                                                                                                                                                                                        • String ID: fileutil.cpp
                                                                                                                                                                                                                        • API String ID: 1145190524-2967768451
                                                                                                                                                                                                                        • Opcode ID: cb3bd058874442860518e6d94130b3e1aa731633d3332ed1e26f1ecd9e3659c7
                                                                                                                                                                                                                        • Instruction ID: bc654f807c2d48f3dc45dd69200ea5e4d3c32422406a193ddc779e972ffec868
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: cb3bd058874442860518e6d94130b3e1aa731633d3332ed1e26f1ecd9e3659c7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B821E535A4032DAB97119BA5CD49EFBBFADFF90360B014116FE05E7210DB788D40EAA0
                                                                                                                                                                                                                        Function 005D07E4 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 99COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SetFilePointerEx.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?), ref: 005D088A
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?), ref: 005D0894
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Invalid seek type., xrefs: 005D0820
                                                                                                                                                                                                                        • cabextract.cpp, xrefs: 005D08B8
                                                                                                                                                                                                                        • Failed to move file pointer 0x%x bytes., xrefs: 005D08C5
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                        • String ID: Failed to move file pointer 0x%x bytes.$Invalid seek type.$cabextract.cpp
                                                                                                                                                                                                                        • API String ID: 2976181284-417918914
                                                                                                                                                                                                                        • Opcode ID: 091a2bab29aa5b866c788ff226d239e2f2c6bb81cf200295837c2df4e3fc4e56
                                                                                                                                                                                                                        • Instruction ID: 9e0dae10b0e35ab1ea1a0124d4cc7ec5d945de1a6a09d24868205b5a9ecd4640
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 091a2bab29aa5b866c788ff226d239e2f2c6bb81cf200295837c2df4e3fc4e56
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 49318171A4061AEFDB14DEA8C884EAABBA9FB04320F05821AF915D7790D730A911DBD0
                                                                                                                                                                                                                        Function 005F31C7 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84memoryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • VariantInit.OLEAUT32(?), ref: 005F31DD
                                                                                                                                                                                                                        • SysAllocString.OLEAUT32(?), ref: 005F31F9
                                                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 005F3280
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F328B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: StringVariant$AllocClearFreeInit
                                                                                                                                                                                                                        • String ID: xmlutil.cpp
                                                                                                                                                                                                                        • API String ID: 760788290-1270936966
                                                                                                                                                                                                                        • Opcode ID: 541affbee6a0cd4faf195474a2c0d51233d921e71fcb2b2804284b841040d826
                                                                                                                                                                                                                        • Instruction ID: 1a74bc0c95bb43eaa76701d44ed48d8da8eb9ded397c194727b55860e7722dfc
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 541affbee6a0cd4faf195474a2c0d51233d921e71fcb2b2804284b841040d826
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 52218239901219EBEB10DBA8C848EBE7FB9BF84710F154568FA05A7250DB359E04DB90
                                                                                                                                                                                                                        Function 005B4013 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateDirectoryW.KERNELBASE(005B533D,005B53B5,00000000,00000000,?,005C9EE4,00000000,00000000,005B533D,00000000,005B52B5,00000000,?,=S[,005BD4AC,=S[), ref: 005B4021
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005C9EE4,00000000,00000000,005B533D,00000000,005B52B5,00000000,?,=S[,005BD4AC,=S[,00000000,00000000), ref: 005B402F
                                                                                                                                                                                                                        • CreateDirectoryW.KERNEL32(005B533D,005B53B5,005B5381,?,005C9EE4,00000000,00000000,005B533D,00000000,005B52B5,00000000,?,=S[,005BD4AC,=S[,00000000), ref: 005B4097
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005C9EE4,00000000,00000000,005B533D,00000000,005B52B5,00000000,?,=S[,005BD4AC,=S[,00000000,00000000), ref: 005B40A1
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                        • String ID: dirutil.cpp
                                                                                                                                                                                                                        • API String ID: 1375471231-2193988115
                                                                                                                                                                                                                        • Opcode ID: e21845901f7a75daf957168c350004caff8c971760e4bdfc468f79c4ed9664a3
                                                                                                                                                                                                                        • Instruction ID: c53637465ff87203e76d332ea79943adb1ce853f0db1e2d019b2ecadbde0473f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e21845901f7a75daf957168c350004caff8c971760e4bdfc468f79c4ed9664a3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E011EB3960023AD6EB313AA18C4DBBBBE94FF54760F104125FF45DF052D765AC05AAD1
                                                                                                                                                                                                                        Function 005F0917 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54synchronizationCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,?,005B4E16,?,000000FF,?,?,?,?,?,00000000,?,?), ref: 005F0927
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,005B4E16,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?), ref: 005F0935
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLastObjectSingleWait
                                                                                                                                                                                                                        • String ID: procutil.cpp
                                                                                                                                                                                                                        • API String ID: 1211598281-1178289305
                                                                                                                                                                                                                        • Opcode ID: 9d3aa0df4dea7ffafb72a24d85f9e7c8f3d6a071889ef865e43aedd4d04f790a
                                                                                                                                                                                                                        • Instruction ID: 49362fc9f899ce366bf8efe61fc17c6634ab922e9bde2e7d0ed98dcb39ae2f79
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9d3aa0df4dea7ffafb72a24d85f9e7c8f3d6a071889ef865e43aedd4d04f790a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B611C276E00229EBFB109BA5CD08ABB7ED5EB04360F114216FE15E7292E7798D00D6E0
                                                                                                                                                                                                                        Function 005D074E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 52fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005D114F: SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,005D077D,?,?,?), ref: 005D1177
                                                                                                                                                                                                                          • Part of subcall function 005D114F: GetLastError.KERNEL32(?,005D077D,?,?,?), ref: 005D1181
                                                                                                                                                                                                                        • ReadFile.KERNELBASE(?,?,?,?,00000000,?,?,?), ref: 005D078B
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005D0795
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to read during cabinet extraction., xrefs: 005D07C3
                                                                                                                                                                                                                        • cabextract.cpp, xrefs: 005D07B9
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorFileLast$PointerRead
                                                                                                                                                                                                                        • String ID: Failed to read during cabinet extraction.$cabextract.cpp
                                                                                                                                                                                                                        • API String ID: 2170121939-2426083571
                                                                                                                                                                                                                        • Opcode ID: 8430e7b9b385451961adca452d923a53db2ab67e970159cd009507e66fab02ea
                                                                                                                                                                                                                        • Instruction ID: 060e061fd3a5b0d511079b2e3ff7227ea4e9101598d70a8265bee182e678a485
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8430e7b9b385451961adca452d923a53db2ab67e970159cd009507e66fab02ea
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D901A572640225FBDB209FA8DC05E9B7BA9FF44760F01411AFD08E7690D7359A11D7D4
                                                                                                                                                                                                                        Function 005D114F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,005D077D,?,?,?), ref: 005D1177
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005D077D,?,?,?), ref: 005D1181
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • cabextract.cpp, xrefs: 005D11A5
                                                                                                                                                                                                                        • Failed to move to virtual file pointer., xrefs: 005D11AF
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                        • String ID: Failed to move to virtual file pointer.$cabextract.cpp
                                                                                                                                                                                                                        • API String ID: 2976181284-3005670968
                                                                                                                                                                                                                        • Opcode ID: ca3a69cf4197a5e1e4e6c729522b3db77ce983a982f732466d1c07b6b2b5c44b
                                                                                                                                                                                                                        • Instruction ID: 3ece792635230fa1c5a5db22c505de43a285f1e0ba2ecc4c65634c97e53f3f86
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ca3a69cf4197a5e1e4e6c729522b3db77ce983a982f732466d1c07b6b2b5c44b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2401F236640726BBE7211AAA9C08E97FF9AFF417A0B018227FE08D6250DB259C10C6D4
                                                                                                                                                                                                                        Function 005F3DB5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ReadFile.KERNELBASE(?,?,00000000,?,00000000), ref: 005F3E5E
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005F3EC1
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorFileLastRead
                                                                                                                                                                                                                        • String ID: fileutil.cpp
                                                                                                                                                                                                                        • API String ID: 1948546556-2967768451
                                                                                                                                                                                                                        • Opcode ID: 38f703496817b99273bd4ff3eb0bbaa815ea38900f2ee6a114a190cc5be71c83
                                                                                                                                                                                                                        • Instruction ID: 0e6a22268e1a0bcf8b5edef129e201ffeac4bda0b83838bad068fb8ce4d14c0c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 38f703496817b99273bd4ff3eb0bbaa815ea38900f2ee6a114a190cc5be71c83
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4F415071E0026D9BEB21DF54C8407FABBA9FF48751F0041A6AB49E7240D7B89EC49B90
                                                                                                                                                                                                                        Function 005B501B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,005B1104,?,?,00000000), ref: 005B503A
                                                                                                                                                                                                                        • CompareStringW.KERNELBASE(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,005B1104,?,?,00000000), ref: 005B506A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CompareStringlstrlen
                                                                                                                                                                                                                        • String ID: burn.clean.room
                                                                                                                                                                                                                        • API String ID: 1433953587-3055529264
                                                                                                                                                                                                                        • Opcode ID: c54619bb9ed7d576e2227f508f2362dc733f2b12a1cc6122ed672b17a6ad8189
                                                                                                                                                                                                                        • Instruction ID: 6bb54e4519a26bc19de062cff3d9cbf1039c68f4556465d0980bd6bb0db20d7b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c54619bb9ed7d576e2227f508f2362dc733f2b12a1cc6122ed672b17a6ad8189
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 36018672501629AE93285B99DC8CEF3BFADFF147607188116F545C3610E775AC40D7E1
                                                                                                                                                                                                                        Function 005F4CEE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • WriteFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,00000000,?,?,?,005F3E85,?,?,?), ref: 005F4D12
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,005F3E85,?,?,?), ref: 005F4D1C
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorFileLastWrite
                                                                                                                                                                                                                        • String ID: fileutil.cpp
                                                                                                                                                                                                                        • API String ID: 442123175-2967768451
                                                                                                                                                                                                                        • Opcode ID: cdcc8c7419a2769c19de527fa78da1e086bf330da6d72de23a03e114c0657c37
                                                                                                                                                                                                                        • Instruction ID: 39c1615e69b7365d3022655b27168d67cf050e21d4696241069627ae638c146b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: cdcc8c7419a2769c19de527fa78da1e086bf330da6d72de23a03e114c0657c37
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2AF08172A0122DBBD7109E9ACC49EEBBBADFB44761F010116FE04D7040EA34AE00DAE0
                                                                                                                                                                                                                        Function 005F47D3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,005C8564,00000000,00000000,00000000,00000000,00000000), ref: 005F47EB
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,005C8564,00000000,00000000,00000000,00000000,00000000), ref: 005F47F5
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                        • String ID: fileutil.cpp
                                                                                                                                                                                                                        • API String ID: 2976181284-2967768451
                                                                                                                                                                                                                        • Opcode ID: 0d8d0976f3c623a009c5ccec7609765d0f2f992e5fd7f560649a27bfd84948eb
                                                                                                                                                                                                                        • Instruction ID: 80e95bb3edb04aa5b4b2adf7cca7241b57bed3daeb3a0cba4cc63aadb51fd2bc
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0d8d0976f3c623a009c5ccec7609765d0f2f992e5fd7f560649a27bfd84948eb
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D5F03C71A40269AFAB109F95DC09EBB7FA9FF08790F014159BD09E7260E635DD10DBE0
                                                                                                                                                                                                                        Function 005B37EA Relevance: 4.6, APIs: 3, Instructions: 79libraryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005B3829
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B3833
                                                                                                                                                                                                                        • LoadLibraryW.KERNELBASE(?,?,00000104,?), ref: 005B389B
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: DirectoryErrorLastLibraryLoadSystem
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1230559179-0
                                                                                                                                                                                                                        • Opcode ID: e8a8d86d04edef92319b0dbd0632a4d80cb82b9d78a5d2715f6826aec6310977
                                                                                                                                                                                                                        • Instruction ID: 40913110062337bbfde7e665334f1b977f0d3c03162f640584b43cd3710b92be
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e8a8d86d04edef92319b0dbd0632a4d80cb82b9d78a5d2715f6826aec6310977
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8521C8B2D0232AA7EB209F648C49FDA7B6CBB44710F150165BD04F7241EA35EE48CBA1
                                                                                                                                                                                                                        Function 005B3999 Relevance: 4.5, APIs: 3, Instructions: 20memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetProcessHeap.KERNEL32(00000000,00000000,00000000,?,005B3B34,00000000,?,005B1472,00000000,80004005,00000000,80004005,00000000,000001C7,?,005B13B7), ref: 005B39A3
                                                                                                                                                                                                                        • RtlFreeHeap.NTDLL(00000000,?,005B3B34,00000000,?,005B1472,00000000,80004005,00000000,80004005,00000000,000001C7,?,005B13B7,000001C7,00000100), ref: 005B39AA
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005B3B34,00000000,?,005B1472,00000000,80004005,00000000,80004005,00000000,000001C7,?,005B13B7,000001C7,00000100,?), ref: 005B39B4
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Heap$ErrorFreeLastProcess
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 406640338-0
                                                                                                                                                                                                                        • Opcode ID: ad043e60bebbcfae41303ba1d42fa67beef2081279261c3d8b811e9fe7b98906
                                                                                                                                                                                                                        • Instruction ID: 1c017e55a3e48b384c692823871e4b79db00fa294e42481e358a3d80ebed39c3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ad043e60bebbcfae41303ba1d42fa67beef2081279261c3d8b811e9fe7b98906
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4ED05B32600234E797102BFADC0CEA7BE9CEF155E1B014022FD05D2110D7399914D6F5
                                                                                                                                                                                                                        Function 005F0E3F Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 34registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,005F5699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 005F0E52
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Open
                                                                                                                                                                                                                        • String ID: regutil.cpp
                                                                                                                                                                                                                        • API String ID: 71445658-955085611
                                                                                                                                                                                                                        • Opcode ID: efb2f38fccd76a73d558eb02dfd83b85fe6c21b391b31b525a896d8572a0eaad
                                                                                                                                                                                                                        • Instruction ID: aba80a3ec3823ea6c9cdfd074b80cd38205365f045cbf2dde45aefa41d88bd0f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: efb2f38fccd76a73d558eb02dfd83b85fe6c21b391b31b525a896d8572a0eaad
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 60F0A7727021396BDF2449568C04BB77DC6EF446A0F158525BE49DA191D235CC10D3D0
                                                                                                                                                                                                                        Function 005EF349 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 005EF35B
                                                                                                                                                                                                                          • Part of subcall function 005F9814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005F9891
                                                                                                                                                                                                                          • Part of subcall function 005F9814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005F98A2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                        • String ID: PA:n
                                                                                                                                                                                                                        • API String ID: 1269201914-347252079
                                                                                                                                                                                                                        • Opcode ID: 7195a1c36235c2a5ff549f1693714ea00176c86cf8b302cb5068ef97b9f2f198
                                                                                                                                                                                                                        • Instruction ID: 2f3d8ceedc98be2a7cb40df47981ea91a785249882ab80e59ed4c0955807e817
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7195a1c36235c2a5ff549f1693714ea00176c86cf8b302cb5068ef97b9f2f198
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 18B012A23698467C320813616D06C760A5FD2C5F2633ECC3AB680C2040EC880DC40032
                                                                                                                                                                                                                        Function 005EF37A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 005EF35B
                                                                                                                                                                                                                          • Part of subcall function 005F9814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005F9891
                                                                                                                                                                                                                          • Part of subcall function 005F9814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005F98A2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                        • String ID: PA:n
                                                                                                                                                                                                                        • API String ID: 1269201914-347252079
                                                                                                                                                                                                                        • Opcode ID: ed34789814bb24ee19766c9098dec233b4b3e57073874f935517627850aed73f
                                                                                                                                                                                                                        • Instruction ID: 5b6c26522ab8ffc726dedf5a3a62d762888a9e27f8a26c2277a7fefb479ce47f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ed34789814bb24ee19766c9098dec233b4b3e57073874f935517627850aed73f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 83B012A13699066C324853651D06D76095FD2C9F2233ECD3AF180C7040EC840CC44132
                                                                                                                                                                                                                        Function 005EF36A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 005EF35B
                                                                                                                                                                                                                          • Part of subcall function 005F9814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005F9891
                                                                                                                                                                                                                          • Part of subcall function 005F9814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005F98A2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                        • String ID: PA:n
                                                                                                                                                                                                                        • API String ID: 1269201914-347252079
                                                                                                                                                                                                                        • Opcode ID: 36662706e4b89fdafbc8ca24a16f8af3c769022b0a577df6724a4d9a996b1fa8
                                                                                                                                                                                                                        • Instruction ID: b78039ddffaef594d75b1c65ca90136f87d688121fac06383bca4291089453a7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 36662706e4b89fdafbc8ca24a16f8af3c769022b0a577df6724a4d9a996b1fa8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E8B012A13698066D324853651E07D76095FD2C9F2233ECC3AB180C3041EC880CC50132
                                                                                                                                                                                                                        Function 005F3499 Relevance: 1.6, APIs: 1, Instructions: 101COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • VariantInit.OLEAUT32(?), ref: 005F34CE
                                                                                                                                                                                                                          • Part of subcall function 005F2F23: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,005F34DF,00000000,?,00000000), ref: 005F2F3D
                                                                                                                                                                                                                          • Part of subcall function 005F2F23: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,005DBDED,?,005B52FD,?,00000000,?), ref: 005F2F49
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorHandleInitLastModuleVariant
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 52713655-0
                                                                                                                                                                                                                        • Opcode ID: eaa77e9a038d7f84087407c96af9923a4ae4f4beab6f65944ea6943741e9d07c
                                                                                                                                                                                                                        • Instruction ID: a39246684422a99735b48e16921fba8dda18e8e3b4b5852e06344352ada9ebfe
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: eaa77e9a038d7f84087407c96af9923a4ae4f4beab6f65944ea6943741e9d07c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D6310A76E0061D9BDB11DFA8C884AEEBBF8EF48750F01456AED15EB211D6749E048BA0
                                                                                                                                                                                                                        Function 005F5728 Relevance: 1.6, APIs: 1, Instructions: 60registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(80070490,00000000,80070490,0061AAA0,00000000,80070490,00000000,?,005C890E,WiX\Burn,PackageCache,00000000,0061AAA0,00000000,00000000,80070490), ref: 005F5782
                                                                                                                                                                                                                          • Part of subcall function 005F0F6E: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 005F0FE4
                                                                                                                                                                                                                          • Part of subcall function 005F0F6E: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 005F101F
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: QueryValue$Close
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1979452859-0
                                                                                                                                                                                                                        • Opcode ID: d27bb5494b813e86cfc6891b2950e3ac59bd78630524e3bcbe07817d9e893a61
                                                                                                                                                                                                                        • Instruction ID: c7958862cb74b97b858e8677d58357345d2f428a531d280b437a9dcb4e41f9b0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d27bb5494b813e86cfc6891b2950e3ac59bd78630524e3bcbe07817d9e893a61
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0011A33680292EEB8F217EA4DC859BEBE69FB443A1B150639EF1167111E3394D50EAD0
                                                                                                                                                                                                                        Function 005B34C5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,00000104,00000000,?,005C89CA,0000001C,80070490,00000000,00000000,80070490), ref: 005B34E5
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FolderPath
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1514166925-0
                                                                                                                                                                                                                        • Opcode ID: 878e55d5ccb693b7cad7ab7af8f402b1f2cf77e86e333b908a28d18b68cb4814
                                                                                                                                                                                                                        • Instruction ID: 5d50094924e12df72e7b841d67356b834bf88a0cd025d268fb48d2e2c6f6c6e3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 878e55d5ccb693b7cad7ab7af8f402b1f2cf77e86e333b908a28d18b68cb4814
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 22E012722416257BAB022E669C0EDEB7F9CFF15750B048451FE44E6100EA65F91096B4
                                                                                                                                                                                                                        Function 005F2DD0 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • FreeLibrary.KERNELBASE(00000000,00000000,005B547B,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005F2DDD
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FreeLibrary
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3664257935-0
                                                                                                                                                                                                                        • Opcode ID: ccdbe549c038ad1fd92bb8d439c9a6c361c8bc114d5131d2e63bb12ad7590091
                                                                                                                                                                                                                        • Instruction ID: 30a1de140e72003f46f80921dc4d93e3a90a0665217bf81d7afbd6648ff1799b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ccdbe549c038ad1fd92bb8d439c9a6c361c8bc114d5131d2e63bb12ad7590091
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B9E0E3B5A262389A8B108F69BE445927ABAB629B40319F65BF500C2274C3B444409FD0
                                                                                                                                                                                                                        Function 005F94D5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 005F94E7
                                                                                                                                                                                                                          • Part of subcall function 005F9814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005F9891
                                                                                                                                                                                                                          • Part of subcall function 005F9814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005F98A2
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                                                                                        • Opcode ID: 27d3582767468fa407133e5e65516e4f3b63bec9bbc2d23f08c288fa539c521a
                                                                                                                                                                                                                        • Instruction ID: 65ff3f208e0bc525769d6d28a4fa73052457a48e298402756d640c87a5aa40ae
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 27d3582767468fa407133e5e65516e4f3b63bec9bbc2d23f08c288fa539c521a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 30B01295279D0E7C360426551C8AD76091DF6C0F2133AC96BB300D30C5A8440CC50033
                                                                                                                                                                                                                        Function 005F94F6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 005F94E7
                                                                                                                                                                                                                          • Part of subcall function 005F9814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005F9891
                                                                                                                                                                                                                          • Part of subcall function 005F9814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005F98A2
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                                                                                        • Opcode ID: 9088a797f2815f6ac516777b2126c5d43f6889c27b3d7bc368c7d181242d1fc7
                                                                                                                                                                                                                        • Instruction ID: 0df95e2601e06691f65b7b600524a68e41ee7db545699b975ac9e8ad3743c531
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9088a797f2815f6ac516777b2126c5d43f6889c27b3d7bc368c7d181242d1fc7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 26B01295279C0B6C324466551C0BE76090DF2C4F1233ACA6BB700C30C1E8440CC90032
                                                                                                                                                                                                                        Function 005F9506 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 005F94E7
                                                                                                                                                                                                                          • Part of subcall function 005F9814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 005F9891
                                                                                                                                                                                                                          • Part of subcall function 005F9814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 005F98A2
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AccessDloadExceptionHelper2@8LoadRaiseReleaseSectionWrite___delay
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1269201914-0
                                                                                                                                                                                                                        • Opcode ID: 1b29584be22911667962732af6aa121d9f3f1b5e35d93233ff7d509ef68efe11
                                                                                                                                                                                                                        • Instruction ID: f0a67cb60ed82c94e48bbc1ea727f45f8bed2311a356af1caa8efff7c95312fd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1b29584be22911667962732af6aa121d9f3f1b5e35d93233ff7d509ef68efe11
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DDB01295279E0A6C364466952E4BE76090EF6C4F1133A896BB304C31C2E8480CC60032
                                                                                                                                                                                                                        Function 005B14B2 Relevance: 1.3, APIs: 1, Instructions: 54stringCOMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(00000000,00000000,00000000,?,?,005B21B8,?,00000000,?,00000000,?,005B38BD,00000000,?,00000104), ref: 005B14E4
                                                                                                                                                                                                                          • Part of subcall function 005B3B51: GetProcessHeap.KERNEL32(00000000,000001C7,?,005B21DC,000001C7,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B3B59
                                                                                                                                                                                                                          • Part of subcall function 005B3B51: HeapSize.KERNEL32(00000000,?,005B21DC,000001C7,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B3B60
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Heap$ProcessSizelstrlen
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3492610842-0
                                                                                                                                                                                                                        • Opcode ID: 0c4bdd35b05f6c123f486c874746fcfc809cc734572fee61c991eac901576ced
                                                                                                                                                                                                                        • Instruction ID: 592456665c1dc7424fdf05bd16edfc8af59ecdb0b2bc8a872225434461151642
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0c4bdd35b05f6c123f486c874746fcfc809cc734572fee61c991eac901576ced
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9B014537200619AFCF215E14CC54EDA7F99BF81760F614224FA259B0A0D731BC109AD8

                                                                                                                                                                                                                        Non-executed Functions

                                                                                                                                                                                                                        Function 005F15CB Relevance: 38.8, APIs: 21, Strings: 1, Instructions: 320COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • InitializeSecurityDescriptor.ADVAPI32(?,00000001), ref: 005F166B
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005F1675
                                                                                                                                                                                                                        • CreateWellKnownSid.ADVAPI32(0000001A,00000000,?,?), ref: 005F16C2
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005F16C8
                                                                                                                                                                                                                        • CreateWellKnownSid.ADVAPI32(00000017,00000000,?,?), ref: 005F1702
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005F1708
                                                                                                                                                                                                                        • CreateWellKnownSid.ADVAPI32(00000018,00000000,?,?), ref: 005F1748
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005F174E
                                                                                                                                                                                                                        • CreateWellKnownSid.ADVAPI32(00000010,00000000,?,?), ref: 005F178E
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005F1794
                                                                                                                                                                                                                        • CreateWellKnownSid.ADVAPI32(00000016,00000000,?,?), ref: 005F17D4
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 005F17DA
                                                                                                                                                                                                                        • SetEntriesInAclA.ADVAPI32(00000005,?,00000000,?), ref: 005F18BD
                                                                                                                                                                                                                        • LocalFree.KERNEL32(?), ref: 005F19DC
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$CreateKnownWell$DescriptorEntriesFreeInitializeLocalSecurity
                                                                                                                                                                                                                        • String ID: srputil.cpp
                                                                                                                                                                                                                        • API String ID: 3627156773-4105181634
                                                                                                                                                                                                                        • Opcode ID: 66f1a82300e544819d7a34ddccb85ba546db2889d815a9c2e88d1f96fad8d8e1
                                                                                                                                                                                                                        • Instruction ID: 500068fd2705a2dc58a0985014212cd0c82cdd3482bd3e2ee8d39ae8b19436e8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 66f1a82300e544819d7a34ddccb85ba546db2889d815a9c2e88d1f96fad8d8e1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 04B14671D4172DEAEB209BA58D48BEB7AFCFB08740F014166ED09F6150E7749D84CAA4
                                                                                                                                                                                                                        Function 005DC0FA Relevance: 37.1, APIs: 1, Strings: 20, Instructions: 364COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to copy local source path for pseudo bundle., xrefs: 005DC203
                                                                                                                                                                                                                        • Failed to append relation type to install arguments for related bundle package, xrefs: 005DC371
                                                                                                                                                                                                                        • Failed to append relation type to repair arguments for related bundle package, xrefs: 005DC3B9
                                                                                                                                                                                                                        • Failed to copy uninstall arguments for related bundle package, xrefs: 005DC3EB
                                                                                                                                                                                                                        • Failed to allocate memory for dependency providers., xrefs: 005DC481
                                                                                                                                                                                                                        • Failed to copy filename for pseudo bundle., xrefs: 005DC1DF
                                                                                                                                                                                                                        • Failed to allocate memory for pseudo bundle payload hash., xrefs: 005DC275
                                                                                                                                                                                                                        • Failed to copy key for pseudo bundle payload., xrefs: 005DC1BB
                                                                                                                                                                                                                        • Failed to copy key for pseudo bundle., xrefs: 005DC30A
                                                                                                                                                                                                                        • Failed to copy display name for pseudo bundle., xrefs: 005DC4F2
                                                                                                                                                                                                                        • Failed to copy cache id for pseudo bundle., xrefs: 005DC327
                                                                                                                                                                                                                        • Failed to copy repair arguments for related bundle package, xrefs: 005DC398
                                                                                                                                                                                                                        • -%ls, xrefs: 005DC114
                                                                                                                                                                                                                        • Failed to allocate space for burn payload inside of related bundle struct, xrefs: 005DC186
                                                                                                                                                                                                                        • Failed to append relation type to uninstall arguments for related bundle package, xrefs: 005DC40C
                                                                                                                                                                                                                        • pseudobundle.cpp, xrefs: 005DC141, 005DC17A, 005DC269, 005DC475
                                                                                                                                                                                                                        • Failed to allocate space for burn package payload inside of related bundle struct, xrefs: 005DC14D
                                                                                                                                                                                                                        • Failed to copy install arguments for related bundle package, xrefs: 005DC34C
                                                                                                                                                                                                                        • Failed to copy download source for pseudo bundle., xrefs: 005DC231
                                                                                                                                                                                                                        • Failed to copy version for pseudo bundle., xrefs: 005DC4D0
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Heap$AllocateProcess
                                                                                                                                                                                                                        • String ID: -%ls$Failed to allocate memory for dependency providers.$Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of related bundle struct$Failed to allocate space for burn payload inside of related bundle struct$Failed to append relation type to install arguments for related bundle package$Failed to append relation type to repair arguments for related bundle package$Failed to append relation type to uninstall arguments for related bundle package$Failed to copy cache id for pseudo bundle.$Failed to copy display name for pseudo bundle.$Failed to copy download source for pseudo bundle.$Failed to copy filename for pseudo bundle.$Failed to copy install arguments for related bundle package$Failed to copy key for pseudo bundle payload.$Failed to copy key for pseudo bundle.$Failed to copy local source path for pseudo bundle.$Failed to copy repair arguments for related bundle package$Failed to copy uninstall arguments for related bundle package$Failed to copy version for pseudo bundle.$pseudobundle.cpp
                                                                                                                                                                                                                        • API String ID: 1357844191-2832335422
                                                                                                                                                                                                                        • Opcode ID: 34299b5824cf141f8464bb551662d5ca0aec91ff4c35835e3c19bf84d84016d7
                                                                                                                                                                                                                        • Instruction ID: 6f66112ef45ad6889ec97412076fa4978b25ee75116cba2e9c6d8d5824ff839a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 34299b5824cf141f8464bb551662d5ca0aec91ff4c35835e3c19bf84d84016d7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E1C1BE71A40657ABEB358F6CC855E6A7EA9BF48710F01822BF915EB741DB70EC00DB90
                                                                                                                                                                                                                        Function 005C69CC Relevance: 33.6, APIs: 6, Strings: 13, Instructions: 358synchronizationCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005BD39D: EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,005C6E4B,000000B8,00000000,?,00000000,75C0B390), ref: 005BD3AC
                                                                                                                                                                                                                          • Part of subcall function 005BD39D: InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 005BD3BB
                                                                                                                                                                                                                          • Part of subcall function 005BD39D: LeaveCriticalSection.KERNEL32(000000D0,?,005C6E4B,000000B8,00000000,?,00000000,75C0B390), ref: 005BD3D0
                                                                                                                                                                                                                        • ReleaseMutex.KERNEL32(00000000,?,00000000,?,00000000,00000001,00000000), ref: 005C6D9A
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 005C6DA3
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(@G[,?,00000000,?,00000000,00000001,00000000), ref: 005C6DC0
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseCriticalHandleSection$CompareEnterExchangeInterlockedLeaveMutexRelease
                                                                                                                                                                                                                        • String ID: @G[$Another per-machine setup is already executing.$Another per-user setup is already executing.$Engine cannot start apply because it is busy with another action.$Failed to cache engine to working directory.$Failed to create cache thread.$Failed to elevate.$Failed to register bundle.$Failed to set initial apply variables.$Failed while caching, aborting execution.$UX aborted apply begin.$core.cpp$crypt32.dll
                                                                                                                                                                                                                        • API String ID: 322611130-3994927323
                                                                                                                                                                                                                        • Opcode ID: 3e75426673858b5ba9fda09f1cdc5d3579156b40e002ddbb82021501bc73a31d
                                                                                                                                                                                                                        • Instruction ID: a13937e38574eb26371905778c17bde0facb5ed3d2ab51af33c66054cd2dc779
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3e75426673858b5ba9fda09f1cdc5d3579156b40e002ddbb82021501bc73a31d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AEC18F71A01616EFDB199BE4C849FEFBBB9FF04304F00462EE516A6141DB70AE54CB91
                                                                                                                                                                                                                        Function 005B44E9 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 137COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000020,?,00000001,00000000,?,?,?,?,?,?,?), ref: 005B4512
                                                                                                                                                                                                                        • OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 005B4519
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?), ref: 005B4523
                                                                                                                                                                                                                        • LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 005B4573
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B457D
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 005B4677
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLastProcess$CloseCurrentHandleLookupOpenPrivilegeTokenValue
                                                                                                                                                                                                                        • String ID: Failed to adjust token to add shutdown privileges.$Failed to get process token.$Failed to get shutdown privilege LUID.$Failed to schedule restart.$SeShutdownPrivilege$engine.cpp
                                                                                                                                                                                                                        • API String ID: 4232854991-1583736410
                                                                                                                                                                                                                        • Opcode ID: 0c0a74fb95fe0aa28408eb8faf921b72ff722e9f999ab9187e33a8209dea7ea2
                                                                                                                                                                                                                        • Instruction ID: 47ded44fbbd175ef4126c5aa6d65b19c0e83b46c1d4ccde06e264497c9ae148d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0c0a74fb95fe0aa28408eb8faf921b72ff722e9f999ab9187e33a8209dea7ea2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4D41D272A40329EBF7205EB99D8AFFB7E9CFB04741F010125BE01F6191DB695D048AA1
                                                                                                                                                                                                                        Function 005C4CE8 Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 161pipeCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ConvertStringSecurityDescriptorToSecurityDescriptorW.ADVAPI32(D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD),00000001,?,00000000), ref: 005C4D16
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00000000,?,?,005B442A,?), ref: 005C4D1F
                                                                                                                                                                                                                        • CreateNamedPipeW.KERNEL32(000000FF,00080003,00000000,00000001,00010000,00010000,00000001,?,?,00000000,?,?,005B442A,?), ref: 005C4DC0
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005B442A,?), ref: 005C4DCD
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,pipe.cpp,00000132,00000000,?,?,?,?,?,?,?,005B442A,?), ref: 005C4E93
                                                                                                                                                                                                                        • LocalFree.KERNEL32(00000000,?,005B442A,?), ref: 005C4EC1
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to allocate full name of cache pipe: %ls, xrefs: 005C4E2A
                                                                                                                                                                                                                        • Failed to create the security descriptor for the connection event and pipe., xrefs: 005C4D4D
                                                                                                                                                                                                                        • Failed to create pipe: %ls, xrefs: 005C4DFE, 005C4E84
                                                                                                                                                                                                                        • pipe.cpp, xrefs: 005C4D43, 005C4DF1, 005C4E77
                                                                                                                                                                                                                        • \\.\pipe\%ls, xrefs: 005C4D77
                                                                                                                                                                                                                        • \\.\pipe\%ls.Cache, xrefs: 005C4E14
                                                                                                                                                                                                                        • Failed to allocate full name of pipe: %ls, xrefs: 005C4D8D
                                                                                                                                                                                                                        • D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD), xrefs: 005C4D11
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: DescriptorErrorLastSecurity$CloseConvertCreateFreeHandleLocalNamedPipeString
                                                                                                                                                                                                                        • String ID: D:(A;;GA;;;SY)(A;;GA;;;BA)(A;;GRGW0x00100000;;;WD)$Failed to allocate full name of cache pipe: %ls$Failed to allocate full name of pipe: %ls$Failed to create pipe: %ls$Failed to create the security descriptor for the connection event and pipe.$\\.\pipe\%ls$\\.\pipe\%ls.Cache$pipe.cpp
                                                                                                                                                                                                                        • API String ID: 3065245045-3253666091
                                                                                                                                                                                                                        • Opcode ID: e2d359f1a3d5e8793e3e5ebde28bdd90a871d591f5019330e83d0503c74558e5
                                                                                                                                                                                                                        • Instruction ID: 941ffea117e09ef3cf22031704c1ccd61f48d25b82fae02c9a124f8a06e119f4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e2d359f1a3d5e8793e3e5ebde28bdd90a871d591f5019330e83d0503c74558e5
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 46519071E80325BFEB219AA4DC4AFAFBFA9FB04310F114129FE01E61D0D7755A40DA91
                                                                                                                                                                                                                        Function 005EF961 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 167encryptionCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000003,F0000040,00000003,00000000,00000000,005C9CFF,00000003,000007D0,00000003,?,000007D0,00000000,000007D0), ref: 005EF9C6
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005EF9D0
                                                                                                                                                                                                                        • CryptCreateHash.ADVAPI32(?,?,00000000,00000000,?), ref: 005EFA0D
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005EFA17
                                                                                                                                                                                                                        • CryptDestroyHash.ADVAPI32(00000000), ref: 005EFAC9
                                                                                                                                                                                                                        • CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 005EFAE0
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005EFAFB
                                                                                                                                                                                                                        • CryptGetHashParam.ADVAPI32(?,00000002,?,?,00000000), ref: 005EFB33
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005EFB3D
                                                                                                                                                                                                                        • SetFilePointerEx.KERNEL32(00000000,00000000,00000000,00008004,00000001), ref: 005EFB76
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005EFB84
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CryptErrorLast$Hash$Context$AcquireCreateDestroyFileParamPointerRelease
                                                                                                                                                                                                                        • String ID: cryputil.cpp
                                                                                                                                                                                                                        • API String ID: 1716956426-2185294990
                                                                                                                                                                                                                        • Opcode ID: bb819077102871d551f031526d4c0fda693441bca4c0033aee0a00271cb773b2
                                                                                                                                                                                                                        • Instruction ID: 62d25e59cd7c05c98f8886306b2e00ade7ed6116a99008636288fac2ec708b19
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bb819077102871d551f031526d4c0fda693441bca4c0033aee0a00271cb773b2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3F518532E00265EBFB319A65CC08BE77AE9FB08741F014176BE49E6150DB758D84DBA4
                                                                                                                                                                                                                        Function 005C9C99 Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 181COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to move verified file to complete payload path: %ls, xrefs: 005C9E68
                                                                                                                                                                                                                        • Failed to create unverified path., xrefs: 005C9D69
                                                                                                                                                                                                                        • Failed to reset permissions on unverified cached payload: %ls, xrefs: 005C9DEC
                                                                                                                                                                                                                        • copying, xrefs: 005C9E27
                                                                                                                                                                                                                        • Failed to get cached path for package with cache id: %ls, xrefs: 005C9CC3
                                                                                                                                                                                                                        • Failed to transfer working path to unverified path for payload: %ls., xrefs: 005C9D9F
                                                                                                                                                                                                                        • moving, xrefs: 005C9E2C, 005C9E34
                                                                                                                                                                                                                        • Failed to concat complete cached path., xrefs: 005C9CEF
                                                                                                                                                                                                                        • Failed to find payload: %ls in working path: %ls and unverified path: %ls, xrefs: 005C9DC6
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: Failed to concat complete cached path.$Failed to create unverified path.$Failed to find payload: %ls in working path: %ls and unverified path: %ls$Failed to get cached path for package with cache id: %ls$Failed to move verified file to complete payload path: %ls$Failed to reset permissions on unverified cached payload: %ls$Failed to transfer working path to unverified path for payload: %ls.$copying$moving
                                                                                                                                                                                                                        • API String ID: 0-1289240508
                                                                                                                                                                                                                        • Opcode ID: bb59ab6d8038ec764aac9a9e492836180a8cf08dac2e6b5ba68d022035eb5cc1
                                                                                                                                                                                                                        • Instruction ID: 0a2540664ecc031e45d87b3d25c7bd29d65eeb7a3e9a804f7cadd6745c112073
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bb59ab6d8038ec764aac9a9e492836180a8cf08dac2e6b5ba68d022035eb5cc1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 57518F3694011ABFDF226BD4CC0AFAEBF7ABF54310F104059FA01751A1EB765E60AB91
                                                                                                                                                                                                                        Function 005EFDC2 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 130threadtimeCOMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(0061B60C,00000000,?,?,?,?,005D1014,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 005EFDF0
                                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(00000000,?,005D1014,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 005EFE00
                                                                                                                                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 005EFE09
                                                                                                                                                                                                                        • GetLocalTime.KERNEL32(8007139F,?,005D1014,8007139F,Invalid operation for this state.,cabextract.cpp,000001C7,8007139F), ref: 005EFE1F
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(0061B60C,?,00000000,00000000,0000FDE9), ref: 005EFF12
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalCurrentSection$EnterLeaveLocalProcessThreadTime
                                                                                                                                                                                                                        • String ID: $ca$%ls[%04X:%04X][%04hu-%02hu-%02huT%02hu:%02hu:%02hu]%hs%03d:%ls %ls%ls$(ca$,ca$0ca$0ca
                                                                                                                                                                                                                        • API String ID: 296830338-872011647
                                                                                                                                                                                                                        • Opcode ID: 8d713eda90ade6651338cc56e84ddab599554cd41263ebef7d91c0e67644583f
                                                                                                                                                                                                                        • Instruction ID: 7c34e57eaf4e8069ff530560713f380edeaa4acb60d8a6ba7ccd5e0c89bbbae4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8d713eda90ade6651338cc56e84ddab599554cd41263ebef7d91c0e67644583f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2A418172D01219EBDF248FA5CC44AFEBBF9BB48711F045026FA50E2160DB389D40DBA1
                                                                                                                                                                                                                        Function 005B6184 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 147COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetVersionExW.KERNEL32(0000011C), ref: 005B61D2
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B61DC
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLastVersion
                                                                                                                                                                                                                        • String ID: Failed to get OS info.$Failed to set variant value.$variable.cpp
                                                                                                                                                                                                                        • API String ID: 305913169-1971907631
                                                                                                                                                                                                                        • Opcode ID: fbd2148051f9293c452f96c037c0b09dc0dba250fef3205609fd430a3c642370
                                                                                                                                                                                                                        • Instruction ID: d8e79b63fdd7a58ac06013e5a5d9c399e2fa104d4407c11ae0b6172b08adc2b6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fbd2148051f9293c452f96c037c0b09dc0dba250fef3205609fd430a3c642370
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 06415871E0522CABEB209BA9CC45FEBBFB8FB89710F10059AF505E7140D674AE51DB50
                                                                                                                                                                                                                        Function 005C993E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108filestringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • FindFirstFileW.KERNEL32(?,?,?,?,*.*,?,?,?,00000000,.unverified,?), ref: 005C99ED
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(?), ref: 005C9A14
                                                                                                                                                                                                                        • FindNextFileW.KERNEL32(00000000,00000010), ref: 005C9A74
                                                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 005C9A7F
                                                                                                                                                                                                                          • Part of subcall function 005B3BC3: GetFileAttributesW.KERNELBASE(?,?,?,?,00000001,00000000,?), ref: 005B3C3F
                                                                                                                                                                                                                          • Part of subcall function 005B3BC3: GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 005B3C52
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FileFind$AttributesCloseErrorFirstLastNextlstrlen
                                                                                                                                                                                                                        • String ID: *.*$.unverified
                                                                                                                                                                                                                        • API String ID: 457978746-2528915496
                                                                                                                                                                                                                        • Opcode ID: 4978ed799b40c8bb768d5d666e517e2943824f7c00451359f4e1f30d8638214c
                                                                                                                                                                                                                        • Instruction ID: 660f02b0651f5d4fe388f95442e221ed2dcddfd18e6d46ad35e9f854ed5154ae
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4978ed799b40c8bb768d5d666e517e2943824f7c00451359f4e1f30d8638214c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 11415F7190056DAEDF20ABA4DC4DFEA7BB8BF84301F5001A9E909E50A0EB759EC4DF54
                                                                                                                                                                                                                        Function 005F8733 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 79timeCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetTimeZoneInformation.KERNEL32(?,00000001,00000000), ref: 005F8788
                                                                                                                                                                                                                        • SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 005F879A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • feclient.dll, xrefs: 005F8762
                                                                                                                                                                                                                        • %04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u, xrefs: 005F87E3
                                                                                                                                                                                                                        • %04hu-%02hu-%02huT%02hu:%02hu:%02huZ, xrefs: 005F8771
                                                                                                                                                                                                                        • crypt32.dll, xrefs: 005F8758
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Time$InformationLocalSpecificSystemZone
                                                                                                                                                                                                                        • String ID: %04hu-%02hu-%02huT%02hu:%02hu:%02hu%c%02u:%02u$%04hu-%02hu-%02huT%02hu:%02hu:%02huZ$crypt32.dll$feclient.dll
                                                                                                                                                                                                                        • API String ID: 1772835396-1985132828
                                                                                                                                                                                                                        • Opcode ID: 722e4cb89645e4223ee11217bf597abd41ab23985ee48aa21520ccce86280a54
                                                                                                                                                                                                                        • Instruction ID: 3a8dca381589dd190971cb8e71c72e747570a9afa07b0606c7b4665d2cdedac0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 722e4cb89645e4223ee11217bf597abd41ab23985ee48aa21520ccce86280a54
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 86212AA6901118FAE7209F9ADC05FBBB3FDEB48B01F14445AF944D6080E738AE84D770
                                                                                                                                                                                                                        Function 005B60BA Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 52COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLastNameUser
                                                                                                                                                                                                                        • String ID: Failed to get the user name.$Failed to set variant value.$variable.cpp
                                                                                                                                                                                                                        • API String ID: 2054405381-1522884404
                                                                                                                                                                                                                        • Opcode ID: 9e76fb9e22655841e19f30045f427af7c5791882e93dca84e4b20aeb041feb4b
                                                                                                                                                                                                                        • Instruction ID: 58ad01a91014beab98b97427b4cc64511ed4746ff00a72509f775846ad76a244
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9e76fb9e22655841e19f30045f427af7c5791882e93dca84e4b20aeb041feb4b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AF01D671A0132DA7D720AB69DC09EEBBFACFB40710F004166FD04E7241EE78AE04D6A1
                                                                                                                                                                                                                        Function 005EFD20 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • FormatMessageW.KERNEL32(00000900,?,00000000,00000000,00000000,00000000,?,00000000,?,?,005F03EC,?,00000000,?,?,00000001), ref: 005EFD3F
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005F03EC,?,00000000,?,?,00000001,?,005B5523,?,?,00000000,?,?,005B528D,00000002), ref: 005EFD4B
                                                                                                                                                                                                                        • LocalFree.KERNEL32(00000000,?,00000000,00000000,?,?,005F03EC,?,00000000,?,?,00000001,?,005B5523,?,?), ref: 005EFDB3
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorFormatFreeLastLocalMessage
                                                                                                                                                                                                                        • String ID: logutil.cpp
                                                                                                                                                                                                                        • API String ID: 1365068426-3545173039
                                                                                                                                                                                                                        • Opcode ID: 2b4c61229ed6ab959f20aac23454168a495618e715eb5ad92c912be20f32f744
                                                                                                                                                                                                                        • Instruction ID: 74af3f1b42bc23d594ff8dcddd44f1b493d68614b4e0a62cfeae1dc120035a9f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2b4c61229ed6ab959f20aac23454168a495618e715eb5ad92c912be20f32f744
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 54116D32600259EBDB25AF92CE09EEF7F69FF54710F014029FD0596160DB718B60E7A1
                                                                                                                                                                                                                        Function 005D6945 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ChangeServiceConfigW.ADVAPI32(00000000,000000FF,00000003,000000FF,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,005D68EF,00000000,00000003), ref: 005D695C
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005D68EF,00000000,00000003,00000000,?,?,?,?,?,?,?,?,?,005D6CE1,?), ref: 005D6966
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to set service start type., xrefs: 005D6994
                                                                                                                                                                                                                        • msuengine.cpp, xrefs: 005D698A
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ChangeConfigErrorLastService
                                                                                                                                                                                                                        • String ID: Failed to set service start type.$msuengine.cpp
                                                                                                                                                                                                                        • API String ID: 1456623077-1628545019
                                                                                                                                                                                                                        • Opcode ID: 93fc326f2f5be274f4cfa583663b2850eebadf384f11e70a65a8a18efa87aefe
                                                                                                                                                                                                                        • Instruction ID: dd4141498353aff1504190faa0a8984956330da971333a06e53b4806cfd1e771
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 93fc326f2f5be274f4cfa583663b2850eebadf384f11e70a65a8a18efa87aefe
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 47F0653274433577AB2066A99C09E9B7FC9EF017B0B124326FD28E61D1DE258D05D2E5
                                                                                                                                                                                                                        Function 005E3BB0 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 005E3CA8
                                                                                                                                                                                                                        • SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 005E3CB2
                                                                                                                                                                                                                        • UnhandledExceptionFilter.KERNEL32(80003CDD,?,?,?,?,?,?), ref: 005E3CBF
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ExceptionFilterUnhandled$DebuggerPresent
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3906539128-0
                                                                                                                                                                                                                        • Opcode ID: 15b2ac4cd1c8ce1413f39e3bd47d4f3566af268b2bebf15e570d73c331c6fe25
                                                                                                                                                                                                                        • Instruction ID: 0b8a07cfdf2e9ff4901f0caf082e60a3f40cc313f200a3844a218062228fec3f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 15b2ac4cd1c8ce1413f39e3bd47d4f3566af268b2bebf15e570d73c331c6fe25
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6631D474901219ABCB21DF69DD8979DBBB8BF08310F5041EAE80CA7251E7349F85CF44
                                                                                                                                                                                                                        Function 005F393B Relevance: 3.1, APIs: 2, Instructions: 58memoryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005F3AC9: RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,005F396A,?), ref: 005F3B3A
                                                                                                                                                                                                                        • AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 005F398E
                                                                                                                                                                                                                        • CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 005F399F
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AllocateCheckCloseInitializeMembershipToken
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2114926846-0
                                                                                                                                                                                                                        • Opcode ID: 1a041e22d6883b86bee64fbdf70d0d183598693ac12ac45359d51ef3a0e3d5a4
                                                                                                                                                                                                                        • Instruction ID: 6d548a7cf268ef5f8a40bce20815f9cd9e7c0c3af04207082e4feccc7ecb1516
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1a041e22d6883b86bee64fbdf70d0d183598693ac12ac45359d51ef3a0e3d5a4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6411337190021EEBEF10DFA5CD45ABFBBB8FF04340F50042DAA45A6141D7B49B44CB51
                                                                                                                                                                                                                        Function 005DE773 Relevance: 1.5, APIs: 1, Instructions: 3COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SetUnhandledExceptionFilter.KERNEL32(Function_0002E77F,005DDEF8), ref: 005DE778
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ExceptionFilterUnhandled
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3192549508-0
                                                                                                                                                                                                                        • Opcode ID: 3f3fbe144d88db48994a695f8374621a4201c1c205afba88403fedfde8799271
                                                                                                                                                                                                                        • Instruction ID: d4d9fb069eb2e38dbd571a8994e597b61e01291a8f9029f2c4707e144626d757
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3f3fbe144d88db48994a695f8374621a4201c1c205afba88403fedfde8799271
                                                                                                                                                                                                                        • Instruction Fuzzy Hash:
                                                                                                                                                                                                                        Function 005BFE26 Relevance: 81.0, APIs: 1, Strings: 45, Instructions: 476registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,00000000,00000001,00000000,00000101,?,?,00020006,00000000,?,?,?), ref: 005C0409
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Close
                                                                                                                                                                                                                        • String ID: /uninstall$"%ls" %ls$"%ls" /modify$"%ls" /uninstall /quiet$%hs$%hu.%hu.%hu.%hu$%s,0$/modify$3.10.4.4718$BundleAddonCode$BundleCachePath$BundleDetectCode$BundlePatchCode$BundleProviderKey$BundleTag$BundleUpgradeCode$BundleVersion$Comments$Contact$DisplayIcon$DisplayName$DisplayVersion$EngineVersion$EstimatedSize$Failed to cache bundle from path: %ls$Failed to create registration key.$Failed to register the bundle dependency key.$Failed to update resume mode.$Failed to write %ls value.$Failed to write software tags.$Failed to write update registration.$HelpLink$HelpTelephone$ModifyPath$NoElevateOnModify$NoModify$NoRemove$ParentDisplayName$ParentKeyName$Publisher$QuietUninstallString$SystemComponent$URLInfoAbout$URLUpdateInfo$UninstallString
                                                                                                                                                                                                                        • API String ID: 3535843008-3978993339
                                                                                                                                                                                                                        • Opcode ID: 73055614ab63ad0985c094ca583a34c4b54a31be24c982c614fc4545f50ad3ef
                                                                                                                                                                                                                        • Instruction ID: 4298d3abeb59b6a762a896a5d565cb352585aebdd5ce4a34ca43b57c9b0b4fb5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 73055614ab63ad0985c094ca583a34c4b54a31be24c982c614fc4545f50ad3ef
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C5F1B331A80A6AFFDF165A94CC06FBEBE66BF40B10F151A19F900B62D1D775AD10E6C0
                                                                                                                                                                                                                        Function 005B834D Relevance: 61.6, APIs: 5, Strings: 30, Instructions: 331COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(?,?,00000000,80070490,?,?,?,?,?,?,?,=S[,005DBF87,?,?,?), ref: 005B837E
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,=S[,005DBF87,?,?,?,?,=S[,Chain), ref: 005B86DB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to select variable nodes., xrefs: 005B839B
                                                                                                                                                                                                                        • numeric, xrefs: 005B8493
                                                                                                                                                                                                                        • Failed to set variant value., xrefs: 005B8666
                                                                                                                                                                                                                        • Failed to insert variable '%ls'., xrefs: 005B859D
                                                                                                                                                                                                                        • =S[, xrefs: 005B834D
                                                                                                                                                                                                                        • Failed to get variable node count., xrefs: 005B83B8
                                                                                                                                                                                                                        • Attempt to set built-in variable value: %ls, xrefs: 005B869F
                                                                                                                                                                                                                        • Variable, xrefs: 005B8388
                                                                                                                                                                                                                        • Failed to get @Id., xrefs: 005B86C6
                                                                                                                                                                                                                        • variable.cpp, xrefs: 005B8690
                                                                                                                                                                                                                        • Initializing hidden variable '%ls', xrefs: 005B8548
                                                                                                                                                                                                                        • Invalid value for @Type: %ls, xrefs: 005B864F
                                                                                                                                                                                                                        • Failed to get @Type., xrefs: 005B865F
                                                                                                                                                                                                                        • Failed to get @Persisted., xrefs: 005B86B8
                                                                                                                                                                                                                        • Initializing numeric variable '%ls' to value '%ls', xrefs: 005B84B9
                                                                                                                                                                                                                        • Initializing string variable '%ls' to value '%ls', xrefs: 005B84F1
                                                                                                                                                                                                                        • Failed to get next node., xrefs: 005B86CD
                                                                                                                                                                                                                        • Failed to set value of variable: %ls, xrefs: 005B867E
                                                                                                                                                                                                                        • Failed to set variant encryption, xrefs: 005B8674
                                                                                                                                                                                                                        • Failed to get @Hidden., xrefs: 005B86BF
                                                                                                                                                                                                                        • Hidden, xrefs: 005B8406
                                                                                                                                                                                                                        • Failed to find variable value '%ls'., xrefs: 005B86A9
                                                                                                                                                                                                                        • Initializing version variable '%ls' to value '%ls', xrefs: 005B852A
                                                                                                                                                                                                                        • version, xrefs: 005B8503
                                                                                                                                                                                                                        • Value, xrefs: 005B843C
                                                                                                                                                                                                                        • Failed to change variant type., xrefs: 005B86B1
                                                                                                                                                                                                                        • Failed to get @Value., xrefs: 005B866D
                                                                                                                                                                                                                        • Type, xrefs: 005B847A
                                                                                                                                                                                                                        • string, xrefs: 005B84CE
                                                                                                                                                                                                                        • Persisted, xrefs: 005B8421
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                        • String ID: =S[$Attempt to set built-in variable value: %ls$Failed to change variant type.$Failed to find variable value '%ls'.$Failed to get @Hidden.$Failed to get @Id.$Failed to get @Persisted.$Failed to get @Type.$Failed to get @Value.$Failed to get next node.$Failed to get variable node count.$Failed to insert variable '%ls'.$Failed to select variable nodes.$Failed to set value of variable: %ls$Failed to set variant encryption$Failed to set variant value.$Hidden$Initializing hidden variable '%ls'$Initializing numeric variable '%ls' to value '%ls'$Initializing string variable '%ls' to value '%ls'$Initializing version variable '%ls' to value '%ls'$Invalid value for @Type: %ls$Persisted$Type$Value$Variable$numeric$string$variable.cpp$version
                                                                                                                                                                                                                        • API String ID: 3168844106-1896206214
                                                                                                                                                                                                                        • Opcode ID: f9bba454a56ec964e34c83650301997fb2ef7b8386c03194fa0e711e493611ae
                                                                                                                                                                                                                        • Instruction ID: 29c55fa4085d6f972c7bf2432431679eae47679d18d852f25c184ebe556a7bb8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f9bba454a56ec964e34c83650301997fb2ef7b8386c03194fa0e711e493611ae
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 84B1AE72D0022EBBCF119B94CD4AEFEBF79BB54710F105665FA11B6290CB74AA10DB90
                                                                                                                                                                                                                        Function 005D6A85 Relevance: 58.1, APIs: 7, Strings: 26, Instructions: 377COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,005CBBCA,00000007,?,?,?), ref: 005D6AD9
                                                                                                                                                                                                                          • Part of subcall function 005F09BB: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,005B5D8F,00000000), ref: 005F09CF
                                                                                                                                                                                                                          • Part of subcall function 005F09BB: GetProcAddress.KERNEL32(00000000), ref: 005F09D6
                                                                                                                                                                                                                          • Part of subcall function 005F09BB: GetLastError.KERNEL32(?,?,?,005B5D8F,00000000), ref: 005F09ED
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 005D6EC9
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,000001F4,?,?,?,?,?,?,?,?,?,?,wusa.exe,?,00000025), ref: 005D6EDD
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • "%ls" "%ls" /quiet /norestart, xrefs: 005D6C01
                                                                                                                                                                                                                        • Failed to append log path to MSU command-line., xrefs: 005D6C8D
                                                                                                                                                                                                                        • 2, xrefs: 005D6D6C
                                                                                                                                                                                                                        • msuengine.cpp, xrefs: 005D6D46, 005D6DDB, 005D6E03
                                                                                                                                                                                                                        • Failed to append log switch to MSU command-line., xrefs: 005D6C6F
                                                                                                                                                                                                                        • Failed to determine WOW64 status., xrefs: 005D6AEB
                                                                                                                                                                                                                        • D, xrefs: 005D6CF4
                                                                                                                                                                                                                        • Failed to get action arguments for MSU package., xrefs: 005D6B8F
                                                                                                                                                                                                                        • Failed to CreateProcess on path: %ls, xrefs: 005D6D53
                                                                                                                                                                                                                        • SysNative\, xrefs: 005D6B23
                                                                                                                                                                                                                        • Failed to allocate WUSA.exe path., xrefs: 005D6B6C
                                                                                                                                                                                                                        • /log:, xrefs: 005D6C5B
                                                                                                                                                                                                                        • Failed to append SysNative directory., xrefs: 005D6B36
                                                                                                                                                                                                                        • WixBundleExecutePackageCacheFolder, xrefs: 005D6BC4, 005D6EF5
                                                                                                                                                                                                                        • Failed to get process exit code., xrefs: 005D6DE5
                                                                                                                                                                                                                        • Bootstrapper application aborted during MSU progress., xrefs: 005D6E0D
                                                                                                                                                                                                                        • wusa.exe, xrefs: 005D6B59
                                                                                                                                                                                                                        • Failed to ensure WU service was enabled to install MSU package., xrefs: 005D6CE7
                                                                                                                                                                                                                        • Failed to wait for executable to complete: %ls, xrefs: 005D6E58
                                                                                                                                                                                                                        • Failed to build MSU path., xrefs: 005D6BEE
                                                                                                                                                                                                                        • Failed to get cached path for package: %ls, xrefs: 005D6BB5
                                                                                                                                                                                                                        • Failed to format MSU install command., xrefs: 005D6C15
                                                                                                                                                                                                                        • Failed to format MSU uninstall command., xrefs: 005D6C42
                                                                                                                                                                                                                        • "%ls" /uninstall /kb:%ls /quiet /norestart, xrefs: 005D6C2E
                                                                                                                                                                                                                        • Failed to find Windows directory., xrefs: 005D6B18
                                                                                                                                                                                                                        • Failed to find System32 directory., xrefs: 005D6B4E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Handle$Close$AddressCurrentErrorLastModuleProcProcess
                                                                                                                                                                                                                        • String ID: /log:$"%ls" "%ls" /quiet /norestart$"%ls" /uninstall /kb:%ls /quiet /norestart$2$Bootstrapper application aborted during MSU progress.$D$Failed to CreateProcess on path: %ls$Failed to allocate WUSA.exe path.$Failed to append SysNative directory.$Failed to append log path to MSU command-line.$Failed to append log switch to MSU command-line.$Failed to build MSU path.$Failed to determine WOW64 status.$Failed to ensure WU service was enabled to install MSU package.$Failed to find System32 directory.$Failed to find Windows directory.$Failed to format MSU install command.$Failed to format MSU uninstall command.$Failed to get action arguments for MSU package.$Failed to get cached path for package: %ls$Failed to get process exit code.$Failed to wait for executable to complete: %ls$SysNative\$WixBundleExecutePackageCacheFolder$msuengine.cpp$wusa.exe
                                                                                                                                                                                                                        • API String ID: 1400713077-4261965642
                                                                                                                                                                                                                        • Opcode ID: 0bf72988f424a99bd54ef7b6509f49d93be05e06d6f529114ad4f145d003abe7
                                                                                                                                                                                                                        • Instruction ID: 6b61c837947b5a6e45c51bca83e0027d811a79175854bea232a74769bf0d41a6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0bf72988f424a99bd54ef7b6509f49d93be05e06d6f529114ad4f145d003abe7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1FD17E74A4031AEAEB219FE8CC85EAF7FB9FF04704F104027F601A22A1D7B59A45DB51
                                                                                                                                                                                                                        Function 005C52E3 Relevance: 52.7, APIs: 17, Strings: 13, Instructions: 222filepipesleepCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,?,00000000,?,005FB4F0,?,00000000,?,005B442A,?,005FB4F0), ref: 005C5304
                                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,005B442A,?,005FB4F0), ref: 005C530F
                                                                                                                                                                                                                        • SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,005B442A,?,005FB4F0), ref: 005C5346
                                                                                                                                                                                                                        • ConnectNamedPipe.KERNEL32(?,00000000,?,005B442A,?,005FB4F0), ref: 005C535B
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005B442A,?,005FB4F0), ref: 005C5365
                                                                                                                                                                                                                        • Sleep.KERNEL32(00000064,?,005B442A,?,005FB4F0), ref: 005C5396
                                                                                                                                                                                                                        • SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,005B442A,?,005FB4F0), ref: 005C53B9
                                                                                                                                                                                                                        • WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,005B442A,?,005FB4F0), ref: 005C53D4
                                                                                                                                                                                                                        • WriteFile.KERNEL32(?,*D[,005FB4F0,00000000,00000000,?,005B442A,?,005FB4F0), ref: 005C53EF
                                                                                                                                                                                                                        • WriteFile.KERNEL32(?,comres.dll,00000004,feclient.dll,00000000,?,005B442A,?,005FB4F0), ref: 005C540A
                                                                                                                                                                                                                        • ReadFile.KERNEL32(?,wininet.dll,00000004,feclient.dll,00000000,?,005B442A,?,005FB4F0), ref: 005C5425
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005B442A,?,005FB4F0), ref: 005C547D
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005B442A,?,005FB4F0), ref: 005C54B1
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005B442A,?,005FB4F0), ref: 005C54E5
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005B442A,?,005FB4F0), ref: 005C557B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$File$NamedPipeWrite$HandleState$ConnectCurrentProcessReadSleeplstrlen
                                                                                                                                                                                                                        • String ID: *D[$Failed to read ACK from pipe.$Failed to reset pipe to blocking.$Failed to set pipe to non-blocking.$Failed to wait for child to connect to pipe.$Failed to write our process id to pipe.$Failed to write secret length to pipe.$Failed to write secret to pipe.$comres.dll$crypt32.dll$feclient.dll$pipe.cpp$wininet.dll
                                                                                                                                                                                                                        • API String ID: 2944378912-4288226380
                                                                                                                                                                                                                        • Opcode ID: 5e27a1b2b2a73b62191dfca2ebb0e7163c82b14ddba746a54c25d00310abddfd
                                                                                                                                                                                                                        • Instruction ID: f02adbde0798b4da302950d2791f82a5b42dc97d1faba2e7236c79da11d3c4c9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5e27a1b2b2a73b62191dfca2ebb0e7163c82b14ddba746a54c25d00310abddfd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3C61B4B2E80725AEEB149AE5CC45FBBBAE9FF04741F114125BD01FB180EB649E40C6E1
                                                                                                                                                                                                                        Function 005F72F4 Relevance: 45.8, APIs: 13, Strings: 13, Instructions: 340COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: GetProcessHeap.KERNEL32(?,000001C7,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38E5
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: RtlAllocateHeap.NTDLL(00000000,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38EC
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,generator,000000FF,?,?,?), ref: 005F7407
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F75D0
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F766D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: String$FreeHeap$AllocateCompareProcess
                                                                                                                                                                                                                        • String ID: ($@$atomutil.cpp$author$category$entry$generator$icon$link$logo$subtitle$title$updated
                                                                                                                                                                                                                        • API String ID: 1555028553-2592408802
                                                                                                                                                                                                                        • Opcode ID: 90751aee83f4de348e793f976f883e59da7871fd83977f4b814cba1ef83a3a22
                                                                                                                                                                                                                        • Instruction ID: 482638f23f488b6fdbdca83ec12886e674723a900c295c7bc21d7fb0b20d52dc
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 90751aee83f4de348e793f976f883e59da7871fd83977f4b814cba1ef83a3a22
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: ABB18E7194861EBBDB119B68CC45FBE7E75BB08720F200754F621EA2D1D778EA40DB90
                                                                                                                                                                                                                        Function 005F6FB7 Relevance: 45.8, APIs: 11, Strings: 15, Instructions: 298COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,00613C78,000000FF,?,?,?), ref: 005F707E
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,summary,000000FF), ref: 005F70A3
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 005F70C3
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,published,000000FF), ref: 005F70DF
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,updated,000000FF), ref: 005F7107
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,author,000000FF), ref: 005F7123
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,category,000000FF), ref: 005F715C
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,content,000000FF), ref: 005F7195
                                                                                                                                                                                                                          • Part of subcall function 005F6BF6: SysFreeString.OLEAUT32(00000000), ref: 005F6D2F
                                                                                                                                                                                                                          • Part of subcall function 005F6BF6: SysFreeString.OLEAUT32(00000000), ref: 005F6D71
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F7219
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F72C9
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: String$Compare$Free
                                                                                                                                                                                                                        • String ID: ($atomutil.cpp$author$cabinet.dll$category$clbcatq.dll$content$feclient.dll$link$msi.dll$published$summary$title$updated$version.dll
                                                                                                                                                                                                                        • API String ID: 318886736-4294603148
                                                                                                                                                                                                                        • Opcode ID: 431f4623edac604653ba5734c10e9ecea4df183f13010eaed58044bcfb15a859
                                                                                                                                                                                                                        • Instruction ID: faece3905c3b1bb835c7f5e71d2472881292b440fcdfabc5ba0239aab7f41211
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 431f4623edac604653ba5734c10e9ecea4df183f13010eaed58044bcfb15a859
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AEA1B03994821EBBDB209B94CC45FBDBA79BF08730F204755F621A61D1C778EA50DB90
                                                                                                                                                                                                                        Function 005BA311 Relevance: 44.0, APIs: 8, Strings: 17, Instructions: 299registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 005BA356
                                                                                                                                                                                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 005BA37C
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,?,00000000,?,?,?,?,?), ref: 005BA666
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to query registry key value., xrefs: 005BA4D8
                                                                                                                                                                                                                        • Failed to change value type., xrefs: 005BA60D
                                                                                                                                                                                                                        • Failed to format key string., xrefs: 005BA361
                                                                                                                                                                                                                        • Failed to clear variable., xrefs: 005BA3D4
                                                                                                                                                                                                                        • Failed to allocate string buffer., xrefs: 005BA565
                                                                                                                                                                                                                        • Failed to query registry key value size., xrefs: 005BA454
                                                                                                                                                                                                                        • RegistrySearchValue failed: ID '%ls', HRESULT 0x%x, xrefs: 005BA63E
                                                                                                                                                                                                                        • Failed to allocate memory registry value., xrefs: 005BA487
                                                                                                                                                                                                                        • Failed to set variable., xrefs: 005BA629
                                                                                                                                                                                                                        • Registry value not found. Key = '%ls', Value = '%ls', xrefs: 005BA418
                                                                                                                                                                                                                        • search.cpp, xrefs: 005BA44A, 005BA47D, 005BA4CE, 005BA5D1
                                                                                                                                                                                                                        • Unsupported registry key value type. Type = '%u', xrefs: 005BA506
                                                                                                                                                                                                                        • Failed to format value string., xrefs: 005BA387
                                                                                                                                                                                                                        • Failed to get expand environment string., xrefs: 005BA5DB
                                                                                                                                                                                                                        • Failed to open registry key., xrefs: 005BA3E9
                                                                                                                                                                                                                        • Failed to read registry value., xrefs: 005BA5F4
                                                                                                                                                                                                                        • Registry key not found. Key = '%ls', xrefs: 005BA3B0
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Open@16$Close
                                                                                                                                                                                                                        • String ID: Failed to allocate memory registry value.$Failed to allocate string buffer.$Failed to change value type.$Failed to clear variable.$Failed to format key string.$Failed to format value string.$Failed to get expand environment string.$Failed to open registry key.$Failed to query registry key value size.$Failed to query registry key value.$Failed to read registry value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchValue failed: ID '%ls', HRESULT 0x%x$Unsupported registry key value type. Type = '%u'$search.cpp
                                                                                                                                                                                                                        • API String ID: 2348241696-3124384294
                                                                                                                                                                                                                        • Opcode ID: acd3b0e8c201734dbe446e3789aab890fb9b85ee7e5ab477992f5499175e9abc
                                                                                                                                                                                                                        • Instruction ID: 99709b6e4e073b2532faa81f2f86028cbf2edf2a04fc12dcb37d1898a9176bac
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: acd3b0e8c201734dbe446e3789aab890fb9b85ee7e5ab477992f5499175e9abc
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A9A1B672D4061AFBDF21AAA4CC4AEFE7FA9BF04710F144521F900B6191E775AE10D7A2
                                                                                                                                                                                                                        Function 005DD22C Relevance: 44.0, APIs: 10, Strings: 15, Instructions: 276processCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • UuidCreate.RPCRT4(?), ref: 005DD2A7
                                                                                                                                                                                                                        • StringFromGUID2.OLE32(?,?,00000027), ref: 005DD2D0
                                                                                                                                                                                                                        • CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?,?,?,?,?), ref: 005DD3BC
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?), ref: 005DD3C6
                                                                                                                                                                                                                        • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,00000064,?,?,?,?), ref: 005DD45B
                                                                                                                                                                                                                        • GetExitCodeProcess.KERNEL32(?,?), ref: 005DD485
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?), ref: 005DD493
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?), ref: 005DD4CB
                                                                                                                                                                                                                          • Part of subcall function 005DD12C: WaitForSingleObject.KERNEL32(?,000000FF,74DF30B0,00000000,?,?,?,?,005DD439,?), ref: 005DD145
                                                                                                                                                                                                                          • Part of subcall function 005DD12C: ReleaseMutex.KERNEL32(?,?,?,?,005DD439,?), ref: 005DD161
                                                                                                                                                                                                                          • Part of subcall function 005DD12C: WaitForSingleObject.KERNEL32(?,000000FF), ref: 005DD1A4
                                                                                                                                                                                                                          • Part of subcall function 005DD12C: ReleaseMutex.KERNEL32(?), ref: 005DD1BB
                                                                                                                                                                                                                          • Part of subcall function 005DD12C: SetEvent.KERNEL32(?), ref: 005DD1C4
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 005DD580
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 005DD598
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to process netfx chainer message., xrefs: 005DD43F
                                                                                                                                                                                                                        • Failed to get netfx return code., xrefs: 005DD4C1
                                                                                                                                                                                                                        • Failed to allocate section name., xrefs: 005DD311
                                                                                                                                                                                                                        • %ls /pipe %ls, xrefs: 005DD373
                                                                                                                                                                                                                        • NetFxChainer.cpp, xrefs: 005DD2E5, 005DD3EA, 005DD4B7, 005DD4EF
                                                                                                                                                                                                                        • Failed to allocate event name., xrefs: 005DD333
                                                                                                                                                                                                                        • Failed to convert netfx chainer guid into string., xrefs: 005DD2EF
                                                                                                                                                                                                                        • Failed to create netfx chainer., xrefs: 005DD352
                                                                                                                                                                                                                        • D, xrefs: 005DD3A1
                                                                                                                                                                                                                        • Failed to CreateProcess on path: %ls, xrefs: 005DD3F5
                                                                                                                                                                                                                        • NetFxEvent.%ls, xrefs: 005DD31F
                                                                                                                                                                                                                        • NetFxSection.%ls, xrefs: 005DD2FD
                                                                                                                                                                                                                        • Failed to allocate netfx chainer arguments., xrefs: 005DD387
                                                                                                                                                                                                                        • Failed to create netfx chainer guid., xrefs: 005DD2B4
                                                                                                                                                                                                                        • Failed to wait for netfx chainer process to complete, xrefs: 005DD4F9
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLastWait$CloseCreateHandleMutexObjectProcessReleaseSingle$CodeEventExitFromMultipleObjectsStringUuid
                                                                                                                                                                                                                        • String ID: %ls /pipe %ls$D$Failed to CreateProcess on path: %ls$Failed to allocate event name.$Failed to allocate netfx chainer arguments.$Failed to allocate section name.$Failed to convert netfx chainer guid into string.$Failed to create netfx chainer guid.$Failed to create netfx chainer.$Failed to get netfx return code.$Failed to process netfx chainer message.$Failed to wait for netfx chainer process to complete$NetFxChainer.cpp$NetFxEvent.%ls$NetFxSection.%ls
                                                                                                                                                                                                                        • API String ID: 2531618940-1825855094
                                                                                                                                                                                                                        • Opcode ID: 3aad6a98324f0ac69e78be8830a6e43296e131df1125b0c8216e4b7e322b0d24
                                                                                                                                                                                                                        • Instruction ID: cc38906dbe95dd90126462b10f4114ec136b839c8fd78b15ff76dfb3f08f6c36
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3aad6a98324f0ac69e78be8830a6e43296e131df1125b0c8216e4b7e322b0d24
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DDA17E71940329ABEF309BA8CD45BEEBBB9BB44300F110067E909F7251D6759A84DFA1
                                                                                                                                                                                                                        Function 005B567D Relevance: 42.5, APIs: 5, Strings: 19, Instructions: 476stringCOMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(000002C0,00000100,00000100,00000000,00000000,?,005B99BB,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,00000100), ref: 005B56A2
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(00000000,?,005B99BB,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,00000100), ref: 005B56AC
                                                                                                                                                                                                                        • _wcschr.LIBVCRUNTIME ref: 005B58B4
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(000002C0,00000000,00000000,00000000,00000000,00000000,00000001,?,005B99BB,000002C0,?,00000000,00000000,000002C0,00000100,000002C0), ref: 005B5B56
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalSection$EnterLeave_wcschrlstrlen
                                                                                                                                                                                                                        • String ID: *****$Failed to allocate buffer for format string.$Failed to allocate record.$Failed to allocate string.$Failed to allocate variable array.$Failed to append placeholder.$Failed to append string.$Failed to copy string.$Failed to determine variable visibility: '%ls'.$Failed to format placeholder string.$Failed to format record.$Failed to get formatted length.$Failed to get variable name.$Failed to reallocate variable array.$Failed to set record format string.$Failed to set record string.$Failed to set variable value.$[%d]$variable.cpp
                                                                                                                                                                                                                        • API String ID: 1026845265-2050445661
                                                                                                                                                                                                                        • Opcode ID: 70bdb203e8dde88e17ebd606018fb0535b912e29ad05d7c07a7e3943d9191b33
                                                                                                                                                                                                                        • Instruction ID: 1f83c7484eafc0a5fae3ca1c54386a771f118c9484163c69c945b6cd2aa312c6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 70bdb203e8dde88e17ebd606018fb0535b912e29ad05d7c07a7e3943d9191b33
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6AF1A171A0061AEBDB159FA48845FFF7FA9FB44750F11452ABE05A7240EB34AE01CBA1
                                                                                                                                                                                                                        Function 005DCC24 Relevance: 40.5, APIs: 12, Strings: 11, Instructions: 235synchronizationCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: GetProcessHeap.KERNEL32(?,000001C7,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38E5
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: RtlAllocateHeap.NTDLL(00000000,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38EC
                                                                                                                                                                                                                        • CreateEventW.KERNEL32(00000000,00000000,00000000,?,00000000,00000018,00000001,?,00000000,?,?,005DD34C,?,?,?), ref: 005DCC6A
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,005DD34C,?,?,?), ref: 005DCC77
                                                                                                                                                                                                                        • ReleaseMutex.KERNEL32(?), ref: 005DCEDF
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Heap$AllocateCreateErrorEventLastMutexProcessRelease
                                                                                                                                                                                                                        • String ID: %ls_mutex$%ls_send$Failed to MapViewOfFile for %ls.$Failed to allocate memory for NetFxChainer struct.$Failed to create event: %ls$Failed to create mutex: %ls$Failed to memory map cabinet file: %ls$NetFxChainer.cpp$failed to allocate memory for event name$failed to allocate memory for mutex name$failed to copy event name to shared memory structure.
                                                                                                                                                                                                                        • API String ID: 3944734951-2991465304
                                                                                                                                                                                                                        • Opcode ID: 67423200dc68a97acb63440ca24f1cf38206c232c68f2b72f09bcd43d9bf8833
                                                                                                                                                                                                                        • Instruction ID: 1a63b08a6a8f6233172fc48f16736cbc292d5180ba9c75481ffdf3ee52fd6a1c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 67423200dc68a97acb63440ca24f1cf38206c232c68f2b72f09bcd43d9bf8833
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6071C1B2A40722BBE7229B698C49EA67FA9FF14350F024126FD08E7351D7749D80D6E4
                                                                                                                                                                                                                        Function 005BE936 Relevance: 40.5, APIs: 4, Strings: 19, Instructions: 231COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005F31C7: VariantInit.OLEAUT32(?), ref: 005F31DD
                                                                                                                                                                                                                          • Part of subcall function 005F31C7: SysAllocString.OLEAUT32(?), ref: 005F31F9
                                                                                                                                                                                                                          • Part of subcall function 005F31C7: VariantClear.OLEAUT32(?), ref: 005F3280
                                                                                                                                                                                                                          • Part of subcall function 005F31C7: SysFreeString.OLEAUT32(00000000), ref: 005F328B
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,000000FF,000000FF,Detect,000000FF,?,005FCA64,?,?,Action,?,?,?,00000000,?), ref: 005BEA07
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,Upgrade,000000FF), ref: 005BEA51
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Action, xrefs: 005BE9C4
                                                                                                                                                                                                                        • RelatedBundle, xrefs: 005BE944
                                                                                                                                                                                                                        • Invalid value for @Action: %ls, xrefs: 005BEB46
                                                                                                                                                                                                                        • version.dll, xrefs: 005BEA64
                                                                                                                                                                                                                        • cabinet.dll, xrefs: 005BEAAE
                                                                                                                                                                                                                        • Failed to resize Detect code array in registration, xrefs: 005BEB22
                                                                                                                                                                                                                        • Failed to get @Action., xrefs: 005BEB5D
                                                                                                                                                                                                                        • Failed to get next RelatedBundle element., xrefs: 005BEB64
                                                                                                                                                                                                                        • Failed to resize Patch code array in registration, xrefs: 005BEB37
                                                                                                                                                                                                                        • Patch, xrefs: 005BEAD1
                                                                                                                                                                                                                        • Addon, xrefs: 005BEA8E
                                                                                                                                                                                                                        • Failed to get @Id., xrefs: 005BEB56
                                                                                                                                                                                                                        • Failed to get RelatedBundle nodes, xrefs: 005BE966
                                                                                                                                                                                                                        • Failed to get RelatedBundle element count., xrefs: 005BE98B
                                                                                                                                                                                                                        • Detect, xrefs: 005BE9F8
                                                                                                                                                                                                                        • comres.dll, xrefs: 005BEA1A
                                                                                                                                                                                                                        • Upgrade, xrefs: 005BEA44
                                                                                                                                                                                                                        • Failed to resize Addon code array in registration, xrefs: 005BEB30
                                                                                                                                                                                                                        • Failed to resize Upgrade code array in registration, xrefs: 005BEB29
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: String$CompareVariant$AllocClearFreeInit
                                                                                                                                                                                                                        • String ID: Action$Addon$Detect$Failed to get @Action.$Failed to get @Id.$Failed to get RelatedBundle element count.$Failed to get RelatedBundle nodes$Failed to get next RelatedBundle element.$Failed to resize Addon code array in registration$Failed to resize Detect code array in registration$Failed to resize Patch code array in registration$Failed to resize Upgrade code array in registration$Invalid value for @Action: %ls$Patch$RelatedBundle$Upgrade$cabinet.dll$comres.dll$version.dll
                                                                                                                                                                                                                        • API String ID: 702752599-259800149
                                                                                                                                                                                                                        • Opcode ID: 4ecc029ee626db7dfe750d4dcd7a8cb981f7bdd45d189518ac58412eeb06dc13
                                                                                                                                                                                                                        • Instruction ID: 71c9af486282af1bac933c5db6c1079d49548497d41f13c60b2d6cd0f95db793
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4ecc029ee626db7dfe750d4dcd7a8cb981f7bdd45d189518ac58412eeb06dc13
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A771AA30A4162ABBDB148B90CC46EEEBBB5FF05720F244254F912AB6C1D730BE01DB90
                                                                                                                                                                                                                        Function 005B8E48 Relevance: 37.2, APIs: 8, Strings: 13, Instructions: 433COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetStringTypeW.KERNEL32(00000001,56005FDB,00000001,?,005B9801,?,00000000,00000000), ref: 005B8E8D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to parse condition "%ls". Constant too big, at position %d., xrefs: 005B924D
                                                                                                                                                                                                                        • Failed to parse condition "%ls". Unexpected '~' operator at position %d., xrefs: 005B92C8
                                                                                                                                                                                                                        • condition.cpp, xrefs: 005B8F5C, 005B9027, 005B909C, 005B90F9, 005B923A, 005B927A, 005B92B5
                                                                                                                                                                                                                        • AND, xrefs: 005B9187
                                                                                                                                                                                                                        • NOT, xrefs: 005B91A7
                                                                                                                                                                                                                        • Failed to parse condition "%ls". Unterminated literal at position %d., xrefs: 005B8F6F
                                                                                                                                                                                                                        • Failed to set symbol value., xrefs: 005B8F35
                                                                                                                                                                                                                        • Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d., xrefs: 005B928D
                                                                                                                                                                                                                        • Failed to parse condition "%ls". Unexpected character at position %d., xrefs: 005B903A
                                                                                                                                                                                                                        • -, xrefs: 005B8FF1
                                                                                                                                                                                                                        • @, xrefs: 005B8E93
                                                                                                                                                                                                                        • Failed to parse condition "%ls". Invalid version format, at position %d., xrefs: 005B910C
                                                                                                                                                                                                                        • Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d., xrefs: 005B90AF
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: StringType
                                                                                                                                                                                                                        • String ID: -$@$AND$Failed to parse condition "%ls". Constant too big, at position %d.$Failed to parse condition "%ls". Identifier cannot start at a digit, at position %d.$Failed to parse condition "%ls". Invalid version format, at position %d.$Failed to parse condition "%ls". Unexpected '~' operator at position %d.$Failed to parse condition "%ls". Unexpected character at position %d.$Failed to parse condition "%ls". Unterminated literal at position %d.$Failed to parse condition "%ls". Version can have a maximum of 4 parts, at position %d.$Failed to set symbol value.$NOT$condition.cpp
                                                                                                                                                                                                                        • API String ID: 4177115715-3640792234
                                                                                                                                                                                                                        • Opcode ID: e0dbda7bea58e02e758b1c0bd914e8ec1f479674fdfdfb61508558e0ca4740cc
                                                                                                                                                                                                                        • Instruction ID: cb9ee6f0bf53c6d912d5e627d12ec80e245bd5dfcfc02a53acb6cd232f55be05
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e0dbda7bea58e02e758b1c0bd914e8ec1f479674fdfdfb61508558e0ca4740cc
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 60E101B5600205EBDB118F58C889BFABFB9FB45710F144485FA059E2C5C7B9EA81DBA0
                                                                                                                                                                                                                        Function 005C44E7 Relevance: 36.9, APIs: 10, Strings: 11, Instructions: 181fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,8000FFFF,feclient.dll,?,005C49FE,005FB4D8,?,feclient.dll,00000000,?,?), ref: 005C44FE
                                                                                                                                                                                                                        • ReadFile.KERNEL32(feclient.dll,feclient.dll,00000004,?,00000000,?,005C49FE,005FB4D8,?,feclient.dll,00000000,?,?), ref: 005C451F
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005C49FE,005FB4D8,?,feclient.dll,00000000,?,?), ref: 005C4525
                                                                                                                                                                                                                        • WriteFile.KERNEL32(feclient.dll,?,00000004,005C49FE,00000000,?,005C49FE,005FB4D8,?,feclient.dll,00000000,?,?), ref: 005C468E
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005C49FE,005FB4D8,?,feclient.dll,00000000,?,?), ref: 005C4698
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorFileLast$CurrentProcessReadWrite
                                                                                                                                                                                                                        • String ID: Failed to allocate buffer for verification secret.$Failed to inform parent process that child is running.$Failed to read size of verification secret from parent pipe.$Failed to read verification process id from parent pipe.$Failed to read verification secret from parent pipe.$Verification process id from parent does not match.$Verification secret from parent does not match.$Verification secret from parent is too big.$feclient.dll$msasn1.dll$pipe.cpp
                                                                                                                                                                                                                        • API String ID: 3008747291-452622383
                                                                                                                                                                                                                        • Opcode ID: ce6321986b85eb2a10dfa5aa544310b08e3ec2a0f607708044caeb8e9e5248a3
                                                                                                                                                                                                                        • Instruction ID: f2b7825da5831ff60bec5a0612680199ad052a27a16bb500c5dcc30dcf527f97
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ce6321986b85eb2a10dfa5aa544310b08e3ec2a0f607708044caeb8e9e5248a3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7251C6B2A80326BBE7219AE58C45FBB7AADFB45710F114119FE01F71D0DB748E409AE1
                                                                                                                                                                                                                        Function 005D25AF Relevance: 36.9, APIs: 3, Strings: 18, Instructions: 145COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: StringVariant$AllocClearFreeInit
                                                                                                                                                                                                                        • String ID: DetectCondition$Failed to get @DetectCondition.$Failed to get @InstallArguments.$Failed to get @Protocol.$Failed to get @RepairArguments.$Failed to get @Repairable.$Failed to get @UninstallArguments.$Failed to parse command lines.$Failed to parse exit codes.$InstallArguments$Invalid protocol type: %ls$Protocol$RepairArguments$Repairable$UninstallArguments$burn$netfx4$none
                                                                                                                                                                                                                        • API String ID: 760788290-1911311241
                                                                                                                                                                                                                        • Opcode ID: cf50436f6855663435a3bb3ac8598d3bd34be1ddce4663d68f3736237ea98ec0
                                                                                                                                                                                                                        • Instruction ID: 34c84036cdd81b3ea89e38d1f228287be56a61ac02406ebd81084355868ae897
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: cf50436f6855663435a3bb3ac8598d3bd34be1ddce4663d68f3736237ea98ec0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6941D932AC472676DB3955A8CC46FAB7E59BF30770F210713F910B63D1CA649D00E292
                                                                                                                                                                                                                        Function 005D1970 Relevance: 35.2, APIs: 4, Strings: 16, Instructions: 212COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: GetProcessHeap.KERNEL32(?,000001C7,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38E5
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: RtlAllocateHeap.NTDLL(00000000,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38EC
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,success,000000FF,?,Type,00000000,?,?,00000000,?,00000001,?), ref: 005D1A77
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,error,000000FF), ref: 005D1A95
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CompareHeapString$AllocateProcess
                                                                                                                                                                                                                        • String ID: Code$ExitCode$Failed to allocate memory for exit code structs.$Failed to get @Code.$Failed to get @Type.$Failed to get exit code node count.$Failed to get next node.$Failed to parse @Code value: %ls$Failed to select exit code nodes.$Invalid exit code type: %ls$Type$error$exeengine.cpp$forceReboot$scheduleReboot$success
                                                                                                                                                                                                                        • API String ID: 2664528157-1714101571
                                                                                                                                                                                                                        • Opcode ID: 15f4578519ad89f669f7748057c3e843da02850eef4b220a7f4d0fb96df65ad5
                                                                                                                                                                                                                        • Instruction ID: 7b3dfe7660c6ae133dc5b718187c8f0993cb1a9f64359c46593e8ccdf22afa26
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 15f4578519ad89f669f7748057c3e843da02850eef4b220a7f4d0fb96df65ad5
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D0610230A4561ABBDB249B98CC45EAEBFA5FF40720F208267F414AB3D1DB709E00D795
                                                                                                                                                                                                                        Function 005BF09D Relevance: 33.4, APIs: 3, Strings: 16, Instructions: 180registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005F39CD: GetVersionExW.KERNEL32(?,?,00000000,?), ref: 005F3A1A
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,?,00020006,00020006,00000000,?,?,00000002,00000000,?,00000000,00000001,00000002), ref: 005BF2CB
                                                                                                                                                                                                                          • Part of subcall function 005F1344: RegSetValueExW.ADVAPI32(?,?,00000000,00000004,?,00000004,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,?,005BF11A,00000005,Resume,?,?,?,00000002,00000000), ref: 005F1359
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 005BF0FA
                                                                                                                                                                                                                        • "%ls" /%ls, xrefs: 005BF172
                                                                                                                                                                                                                        • Failed to write resume command line value., xrefs: 005BF1EA
                                                                                                                                                                                                                        • Failed to create run key., xrefs: 005BF1AA
                                                                                                                                                                                                                        • registration.cpp, xrefs: 005BF250, 005BF29D
                                                                                                                                                                                                                        • Resume, xrefs: 005BF10F
                                                                                                                                                                                                                        • Failed to delete resume command line value., xrefs: 005BF2A7
                                                                                                                                                                                                                        • Failed to write Resume value., xrefs: 005BF120
                                                                                                                                                                                                                        • Installed, xrefs: 005BF132
                                                                                                                                                                                                                        • Failed to format resume command line for RunOnce., xrefs: 005BF186
                                                                                                                                                                                                                        • Failed to delete run key value., xrefs: 005BF25A
                                                                                                                                                                                                                        • BundleResumeCommandLine, xrefs: 005BF1D5, 005BF267
                                                                                                                                                                                                                        • Failed to write Installed value., xrefs: 005BF143
                                                                                                                                                                                                                        • SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 005BF0AE
                                                                                                                                                                                                                        • Failed to write run key value., xrefs: 005BF1C8
                                                                                                                                                                                                                        • burn.runonce, xrefs: 005BF167
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseValueVersion
                                                                                                                                                                                                                        • String ID: "%ls" /%ls$BundleResumeCommandLine$Failed to create run key.$Failed to delete resume command line value.$Failed to delete run key value.$Failed to format resume command line for RunOnce.$Failed to write Installed value.$Failed to write Resume value.$Failed to write resume command line value.$Failed to write run key value.$Installed$Resume$SOFTWARE\Microsoft\Windows\CurrentVersion\Run$SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce$burn.runonce$registration.cpp
                                                                                                                                                                                                                        • API String ID: 2348918689-3140388177
                                                                                                                                                                                                                        • Opcode ID: 385ab4aaf5e1abadff8b1183949015a5fa14b3d485882fd71f3a3bce097a4089
                                                                                                                                                                                                                        • Instruction ID: cfa37e7fca65d60175a4a17bf99f881a9c195b02704f91239049caffacec14d8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 385ab4aaf5e1abadff8b1183949015a5fa14b3d485882fd71f3a3bce097a4089
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2951B136A8062AFBEF155AA4CC46BEEBEA5BF00740F010525BD00FA191D775EE50D790
                                                                                                                                                                                                                        Function 005F7FEC Relevance: 31.8, APIs: 9, Strings: 9, Instructions: 309COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,00000000,000002C0), ref: 005F8019
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF), ref: 005F8034
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,upgrade,000000FF), ref: 005F80D7
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,00700079,000000FF,version,000000FF,00000018,005FB508,00000000), ref: 005F8116
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,exclusive,000000FF), ref: 005F8169
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,005FB508,000000FF,true,000000FF), ref: 005F8187
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,version,000000FF), ref: 005F81BF
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,enclosure,000000FF), ref: 005F8303
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CompareString
                                                                                                                                                                                                                        • String ID: application$apuputil.cpp$enclosure$exclusive$http://appsyndication.org/2006/appsyn$true$type$upgrade$version
                                                                                                                                                                                                                        • API String ID: 1825529933-3037633208
                                                                                                                                                                                                                        • Opcode ID: 59e92109f16ef204c2d7b788993cc470b587671b1bfdb039d28d780e3fb39973
                                                                                                                                                                                                                        • Instruction ID: 477b97d2db2b447cefa77002dd9d5c8c30fbdfefdee60ad2fd42880ffbcc0bf5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 59e92109f16ef204c2d7b788993cc470b587671b1bfdb039d28d780e3fb39973
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6CB19F3194460AABDB209F54CC85F7A7BB6BB44720F254A54FA39EB2D1DF78E844CB10
                                                                                                                                                                                                                        Function 005F76A1 Relevance: 31.7, APIs: 8, Strings: 10, Instructions: 210COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,rel,000000FF,?,?,?,00000000), ref: 005F7703
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,href,000000FF), ref: 005F7727
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,length,000000FF), ref: 005F7746
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,title,000000FF), ref: 005F777D
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,type,000000FF), ref: 005F7798
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F77C3
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F7842
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F788E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: String$Compare$Free
                                                                                                                                                                                                                        • String ID: comres.dll$feclient.dll$href$length$msasn1.dll$msi.dll$rel$title$type$version.dll
                                                                                                                                                                                                                        • API String ID: 318886736-3944986760
                                                                                                                                                                                                                        • Opcode ID: 11f8288942ffafc56cbfe59c97653f1c7d252e1773ba3a683af4335a9e46cfb9
                                                                                                                                                                                                                        • Instruction ID: 62c89d2f238922174c44717316db63d5e0e6343e1896ca7cb8a5d408f80d32e9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 11f8288942ffafc56cbfe59c97653f1c7d252e1773ba3a683af4335a9e46cfb9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C7714C3590511EBBDB11DB94CC88EBEBF78FF08760F2002A4E625A7190D7359E44DB90
                                                                                                                                                                                                                        Function 005CE177 Relevance: 31.6, APIs: 12, Strings: 6, Instructions: 144registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005CE05E: LoadBitmapW.USER32(?,00000001), ref: 005CE094
                                                                                                                                                                                                                          • Part of subcall function 005CE05E: GetLastError.KERNEL32 ref: 005CE0A0
                                                                                                                                                                                                                        • LoadCursorW.USER32(00000000,00007F00), ref: 005CE1D8
                                                                                                                                                                                                                        • RegisterClassW.USER32(?), ref: 005CE1EC
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005CE1F7
                                                                                                                                                                                                                        • UnregisterClassW.USER32(WixBurnSplashScreen,?), ref: 005CE2FC
                                                                                                                                                                                                                        • DeleteObject.GDI32(00000000), ref: 005CE30B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ClassErrorLastLoad$BitmapCursorDeleteObjectRegisterUnregister
                                                                                                                                                                                                                        • String ID: Failed to create window.$Failed to load splash screen.$Failed to register window.$Unexpected return value from message pump.$WixBurnSplashScreen$splashscreen.cpp
                                                                                                                                                                                                                        • API String ID: 164797020-2188509422
                                                                                                                                                                                                                        • Opcode ID: 64e66dfa37172b898481b46fd9b22e1ba01b62c841a2be1c626b5af66e9d4dfb
                                                                                                                                                                                                                        • Instruction ID: 280fcf62af27e7c824a8c97e0017d25ac020bd0afc3922b4e2393754574d52d6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 64e66dfa37172b898481b46fd9b22e1ba01b62c841a2be1c626b5af66e9d4dfb
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D1419076A40619FFEB119BE4DC4AFAABBAEFF04310F100529F905E61A0D7749D04D7A1
                                                                                                                                                                                                                        Function 005D9BB3 Relevance: 30.0, APIs: 4, Strings: 13, Instructions: 230threadCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • WaitForMultipleObjects.KERNEL32(00000001,?,00000000,000000FF,00000001,00000000,00000000,?,005DBA53,00000001), ref: 005D9C18
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005DBA53,00000001), ref: 005D9D88
                                                                                                                                                                                                                        • GetExitCodeThread.KERNEL32(00000001,00000000,?,005DBA53,00000001), ref: 005D9DC8
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005DBA53,00000001), ref: 005D9DD2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to execute MSI package., xrefs: 005D9C78
                                                                                                                                                                                                                        • Invalid execute action., xrefs: 005D9E23
                                                                                                                                                                                                                        • Failed to execute dependency action., xrefs: 005D9D08
                                                                                                                                                                                                                        • Failed to load compatible package on per-machine package., xrefs: 005D9D2E
                                                                                                                                                                                                                        • Failed to execute package provider registration action., xrefs: 005D9CE9
                                                                                                                                                                                                                        • Cache thread exited unexpectedly., xrefs: 005D9E14
                                                                                                                                                                                                                        • Failed to execute MSU package., xrefs: 005D9CCD
                                                                                                                                                                                                                        • Failed to get cache thread exit code., xrefs: 005D9E03
                                                                                                                                                                                                                        • Failed to execute MSP package., xrefs: 005D9C9D
                                                                                                                                                                                                                        • Failed to execute compatible package action., xrefs: 005D9D45
                                                                                                                                                                                                                        • apply.cpp, xrefs: 005D9DAC, 005D9DF6
                                                                                                                                                                                                                        • Failed to execute EXE package., xrefs: 005D9C4F
                                                                                                                                                                                                                        • Failed to wait for cache check-point., xrefs: 005D9DB9
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$CodeExitMultipleObjectsThreadWait
                                                                                                                                                                                                                        • String ID: Cache thread exited unexpectedly.$Failed to execute EXE package.$Failed to execute MSI package.$Failed to execute MSP package.$Failed to execute MSU package.$Failed to execute compatible package action.$Failed to execute dependency action.$Failed to execute package provider registration action.$Failed to get cache thread exit code.$Failed to load compatible package on per-machine package.$Failed to wait for cache check-point.$Invalid execute action.$apply.cpp
                                                                                                                                                                                                                        • API String ID: 3703294532-2662572847
                                                                                                                                                                                                                        • Opcode ID: 8353bd8113228ea57fffb66e896d85cab5b83b9064bbd9f8fa160cfb44f22170
                                                                                                                                                                                                                        • Instruction ID: a9e329704e71d24159dd9a739a977a2f1ae18c950ccf8483351030024f422422
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8353bd8113228ea57fffb66e896d85cab5b83b9064bbd9f8fa160cfb44f22170
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 93714B71A4121AEFDB24DB68C945ABFBBF9FB48710F11456BB805E7390D2709E019BA0
                                                                                                                                                                                                                        Function 005DCA34 Relevance: 29.9, APIs: 7, Strings: 10, Instructions: 173processCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(74DE8FB0,00000002,00000000), ref: 005DCA40
                                                                                                                                                                                                                          • Part of subcall function 005C4B96: UuidCreate.RPCRT4(?), ref: 005C4BC9
                                                                                                                                                                                                                        • CreateProcessW.KERNEL32(?,?,00000000,00000000,00000001,08000000,00000000,00000000,?,005D21A5,?,?,00000000,?,?,?), ref: 005DCB1E
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,00000000,?,?,?,?), ref: 005DCB28
                                                                                                                                                                                                                        • GetProcessId.KERNEL32(005D21A5,?,?,00000000,?,?,?,?), ref: 005DCB60
                                                                                                                                                                                                                          • Part of subcall function 005C52E3: lstrlenW.KERNEL32(?,?,00000000,?,005FB4F0,?,00000000,?,005B442A,?,005FB4F0), ref: 005C5304
                                                                                                                                                                                                                          • Part of subcall function 005C52E3: GetCurrentProcessId.KERNEL32(?,005B442A,?,005FB4F0), ref: 005C530F
                                                                                                                                                                                                                          • Part of subcall function 005C52E3: SetNamedPipeHandleState.KERNEL32(?,000000FF,00000000,00000000,?,005B442A,?,005FB4F0), ref: 005C5346
                                                                                                                                                                                                                          • Part of subcall function 005C52E3: ConnectNamedPipe.KERNEL32(?,00000000,?,005B442A,?,005FB4F0), ref: 005C535B
                                                                                                                                                                                                                          • Part of subcall function 005C52E3: GetLastError.KERNEL32(?,005B442A,?,005FB4F0), ref: 005C5365
                                                                                                                                                                                                                          • Part of subcall function 005C52E3: Sleep.KERNEL32(00000064,?,005B442A,?,005FB4F0), ref: 005C5396
                                                                                                                                                                                                                          • Part of subcall function 005C52E3: SetNamedPipeHandleState.KERNEL32(?,00000000,00000000,00000000,?,005B442A,?,005FB4F0), ref: 005C53B9
                                                                                                                                                                                                                          • Part of subcall function 005C52E3: WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,005B442A,?,005FB4F0), ref: 005C53D4
                                                                                                                                                                                                                          • Part of subcall function 005C52E3: WriteFile.KERNEL32(?,*D[,005FB4F0,00000000,00000000,?,005B442A,?,005FB4F0), ref: 005C53EF
                                                                                                                                                                                                                          • Part of subcall function 005C52E3: WriteFile.KERNEL32(?,comres.dll,00000004,feclient.dll,00000000,?,005B442A,?,005FB4F0), ref: 005C540A
                                                                                                                                                                                                                          • Part of subcall function 005F0917: WaitForSingleObject.KERNEL32(000000FF,?,00000000,?,?,005B4E16,?,000000FF,?,?,?,?,?,00000000,?,?), ref: 005F0927
                                                                                                                                                                                                                          • Part of subcall function 005F0917: GetLastError.KERNEL32(?,?,005B4E16,?,000000FF,?,?,?,?,?,00000000,?,?,?,?,?), ref: 005F0935
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,005DC992,?,?,?,?,?,00000000,?,?,?,?), ref: 005DCBE4
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,000000FF,00000000,?,005DC992,?,?,?,?,?,00000000,?,?,?,?), ref: 005DCBF3
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,000000FF,00000000,?,005DC992,?,?,?,?,?,00000000,?,?,?), ref: 005DCC0A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to allocate embedded command., xrefs: 005DCAF7
                                                                                                                                                                                                                        • embedded.cpp, xrefs: 005DCB49
                                                                                                                                                                                                                        • %ls -%ls %ls %ls %u, xrefs: 005DCAE3
                                                                                                                                                                                                                        • Failed to wait for embedded process to connect to pipe., xrefs: 005DCB82
                                                                                                                                                                                                                        • Failed to create embedded pipe name and client token., xrefs: 005DCAA3
                                                                                                                                                                                                                        • Failed to create embedded pipe., xrefs: 005DCACA
                                                                                                                                                                                                                        • Failed to create embedded process at path: %ls, xrefs: 005DCB56
                                                                                                                                                                                                                        • Failed to process messages from embedded message., xrefs: 005DCBA7
                                                                                                                                                                                                                        • burn.embedded, xrefs: 005DCADB
                                                                                                                                                                                                                        • Failed to wait for embedded executable: %ls, xrefs: 005DCBC7
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Handle$Process$CloseErrorFileLastNamedPipeWrite$CreateCurrentState$ConnectObjectSingleSleepUuidWaitlstrlen
                                                                                                                                                                                                                        • String ID: %ls -%ls %ls %ls %u$Failed to allocate embedded command.$Failed to create embedded pipe name and client token.$Failed to create embedded pipe.$Failed to create embedded process at path: %ls$Failed to process messages from embedded message.$Failed to wait for embedded executable: %ls$Failed to wait for embedded process to connect to pipe.$burn.embedded$embedded.cpp
                                                                                                                                                                                                                        • API String ID: 875070380-3803182736
                                                                                                                                                                                                                        • Opcode ID: b55def5246adf68b148d796ce3372a4455c68d944486799b1a8b5940c6ba4d15
                                                                                                                                                                                                                        • Instruction ID: b6a180a9d6c025e475804a73d417d7764456ab39c099bb95753b1492987b52cd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b55def5246adf68b148d796ce3372a4455c68d944486799b1a8b5940c6ba4d15
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 00515F72D4021ABBEF21DAA4CC06FEE7FB9BB04711F110117FA00B6290D7759944DB90
                                                                                                                                                                                                                        Function 005F7E36 Relevance: 29.9, APIs: 8, Strings: 9, Instructions: 153stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,msi.dll,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000000,00000000,00000000,?,005F8320,00000001,?), ref: 005F7E56
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,digest,000000FF,002E0069,000000FF,?,005F8320,00000001,?), ref: 005F7E71
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,name,000000FF,002E0069,000000FF,?,005F8320,00000001,?), ref: 005F7E8C
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,algorithm,000000FF,?,000000FF,?,005F8320,00000001,?), ref: 005F7EF8
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000001,md5,000000FF,?,000000FF,?,005F8320,00000001,?), ref: 005F7F1C
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000001,sha1,000000FF,?,000000FF,?,005F8320,00000001,?), ref: 005F7F40
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000001,sha256,000000FF,?,000000FF,?,005F8320,00000001,?), ref: 005F7F60
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(006C0064,?,005F8320,00000001,?), ref: 005F7F7B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CompareString$lstrlen
                                                                                                                                                                                                                        • String ID: algorithm$apuputil.cpp$digest$http://appsyndication.org/2006/appsyn$md5$msi.dll$name$sha1$sha256
                                                                                                                                                                                                                        • API String ID: 1657112622-2492263259
                                                                                                                                                                                                                        • Opcode ID: 0b5af14420f4b1ff3b00fd046254ce87eb55f94a851d4b30163d623cc559f0f0
                                                                                                                                                                                                                        • Instruction ID: 50c087a25080a4cc12f5a1e6ce0029caaab09a0cd0c7cc2f27b154a91ec35a0d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0b5af14420f4b1ff3b00fd046254ce87eb55f94a851d4b30163d623cc559f0f0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C651AD3164C21ABBEB204E14CC86F727E65BB19730F204755FB34AA2E4C768EC90D790
                                                                                                                                                                                                                        Function 005B9F2B Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 216COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 005B9FA3
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Open@16
                                                                                                                                                                                                                        • String ID: AssignmentType$Failed to change value type.$Failed to copy upgrade code.$Failed to enumerate related products for upgrade code.$Failed to format GUID string.$Failed to get product info.$Failed to set variable.$Language$MsiProductSearch failed: ID '%ls', HRESULT 0x%x$Product or related product not found: %ls$State$Trying per-machine extended info for property '%ls' for product: %ls$Trying per-user extended info for property '%ls' for product: %ls$Unsupported product search type: %u$VersionString
                                                                                                                                                                                                                        • API String ID: 3613110473-2134270738
                                                                                                                                                                                                                        • Opcode ID: 1997f9d2612b655b1a4788d60a98b8a6436ae63095d3b72ab51d508877a9672c
                                                                                                                                                                                                                        • Instruction ID: 009f8cd25745e392805f984c8f32830b51c79530276739a4f640fcdb3c51d169
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1997f9d2612b655b1a4788d60a98b8a6436ae63095d3b72ab51d508877a9672c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9761B432D4011DBBCB11AEA8C94ADFE7FA9FB44710F244165F600BB251D676EE40D792
                                                                                                                                                                                                                        Function 005DDC0D Relevance: 28.2, APIs: 3, Strings: 13, Instructions: 204stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,?,005D9751,75C08550,?,?,00000000,?,?,?,00000001,00000000,?), ref: 005DDC28
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to copy download URL., xrefs: 005DDC6F
                                                                                                                                                                                                                        • Failed to initialize BITS job callback., xrefs: 005DDD49
                                                                                                                                                                                                                        • bitsengine.cpp, xrefs: 005DDC3E, 005DDD31
                                                                                                                                                                                                                        • Failed while waiting for BITS download., xrefs: 005DDDD9
                                                                                                                                                                                                                        • Failed to complete BITS job., xrefs: 005DDDD2
                                                                                                                                                                                                                        • Failed to create BITS job callback., xrefs: 005DDD3B
                                                                                                                                                                                                                        • Failed to set callback interface for BITS job., xrefs: 005DDD60
                                                                                                                                                                                                                        • Failed to create BITS job., xrefs: 005DDCB7
                                                                                                                                                                                                                        • Failed to download BITS job., xrefs: 005DDDBF
                                                                                                                                                                                                                        • Failed to add file to BITS job., xrefs: 005DDCF5
                                                                                                                                                                                                                        • Invalid BITS engine URL: %ls, xrefs: 005DDC4A
                                                                                                                                                                                                                        • Failed to set credentials for BITS job., xrefs: 005DDCD6
                                                                                                                                                                                                                        • Falied to start BITS job., xrefs: 005DDDE0
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: lstrlen
                                                                                                                                                                                                                        • String ID: Failed to add file to BITS job.$Failed to complete BITS job.$Failed to copy download URL.$Failed to create BITS job callback.$Failed to create BITS job.$Failed to download BITS job.$Failed to initialize BITS job callback.$Failed to set callback interface for BITS job.$Failed to set credentials for BITS job.$Failed while waiting for BITS download.$Falied to start BITS job.$Invalid BITS engine URL: %ls$bitsengine.cpp
                                                                                                                                                                                                                        • API String ID: 1659193697-2382896028
                                                                                                                                                                                                                        • Opcode ID: 25ca5d72db63f42a2066795ceaca73eacaeaffa1b13e30750ed390445560a289
                                                                                                                                                                                                                        • Instruction ID: d62e7dbf50c28a0cedeab052594ae8aead0aae47e26ca3a4169f50b09c973d33
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 25ca5d72db63f42a2066795ceaca73eacaeaffa1b13e30750ed390445560a289
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E761A131A40225EBDF21AB58C889EAE7FB6FF44B50B164157F804AB351DB70DD80DBA1
                                                                                                                                                                                                                        Function 005BEBB2 Relevance: 28.2, APIs: 2, Strings: 14, Instructions: 173COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(?), ref: 005BED40
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: GetProcessHeap.KERNEL32(?,000001C7,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38E5
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: RtlAllocateHeap.NTDLL(00000000,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38EC
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(?), ref: 005BECF8
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to get @Filename., xrefs: 005BED9D
                                                                                                                                                                                                                        • Failed to get SoftwareTag text., xrefs: 005BED7F
                                                                                                                                                                                                                        • Path, xrefs: 005BECA6
                                                                                                                                                                                                                        • Failed to get software tag count., xrefs: 005BEC07
                                                                                                                                                                                                                        • registration.cpp, xrefs: 005BEC35
                                                                                                                                                                                                                        • Failed to get next node., xrefs: 005BEDA7
                                                                                                                                                                                                                        • Filename, xrefs: 005BEC73
                                                                                                                                                                                                                        • SoftwareTag, xrefs: 005BEBC1
                                                                                                                                                                                                                        • Failed to get @Path., xrefs: 005BED89
                                                                                                                                                                                                                        • Failed to allocate memory for software tag structs., xrefs: 005BEC3F
                                                                                                                                                                                                                        • Failed to get @Regid., xrefs: 005BED93
                                                                                                                                                                                                                        • Failed to select software tag nodes., xrefs: 005BEBE2
                                                                                                                                                                                                                        • Failed to convert SoftwareTag text to UTF-8, xrefs: 005BED75
                                                                                                                                                                                                                        • Regid, xrefs: 005BEC8E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FreeHeapString$AllocateProcess
                                                                                                                                                                                                                        • String ID: Failed to allocate memory for software tag structs.$Failed to convert SoftwareTag text to UTF-8$Failed to get @Filename.$Failed to get @Path.$Failed to get @Regid.$Failed to get SoftwareTag text.$Failed to get next node.$Failed to get software tag count.$Failed to select software tag nodes.$Filename$Path$Regid$SoftwareTag$registration.cpp
                                                                                                                                                                                                                        • API String ID: 336948655-1068704183
                                                                                                                                                                                                                        • Opcode ID: f689bc060a929cbaf0c37618b89c578ccd2867870ffd5570fc04ce0e69df0174
                                                                                                                                                                                                                        • Instruction ID: 77e8a87e073c77f9161c61253f0b99183a05f17a7a502b07debd5a8328d2c1bd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f689bc060a929cbaf0c37618b89c578ccd2867870ffd5570fc04ce0e69df0174
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F051D135A4132AAFDB159F54C886EFEBFA5BF00710F19056CF902AB290D7B0EE009790
                                                                                                                                                                                                                        Function 005C4933 Relevance: 28.2, APIs: 7, Strings: 9, Instructions: 155sleepfileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateFileW.KERNEL32(00000000,C0000000,00000000,00000000,00000003,00000000,00000000,00000000,?,?), ref: 005C498D
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005C499B
                                                                                                                                                                                                                        • Sleep.KERNEL32(00000064), ref: 005C49BF
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CreateErrorFileLastSleep
                                                                                                                                                                                                                        • String ID: Failed to allocate name of parent cache pipe.$Failed to allocate name of parent pipe.$Failed to open companion process with PID: %u$Failed to open parent pipe: %ls$Failed to verify parent pipe: %ls$\\.\pipe\%ls$\\.\pipe\%ls.Cache$feclient.dll$pipe.cpp
                                                                                                                                                                                                                        • API String ID: 408151869-3212458075
                                                                                                                                                                                                                        • Opcode ID: d715e848d7ba8b05a37e84aaeb90a8c29d238e42b051d297a1a93e66f4a2c4a5
                                                                                                                                                                                                                        • Instruction ID: 2633d70d4f0cc8f84d14886dc06b37d0fb9bcf32754a2545eef13ddab27e5648
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d715e848d7ba8b05a37e84aaeb90a8c29d238e42b051d297a1a93e66f4a2c4a5
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FE41D576A80732BFEB215AE49C19F6B7E59BB00720F114225FD01F61D0DB699D10DAD4
                                                                                                                                                                                                                        Function 005BF410 Relevance: 28.2, APIs: 1, Strings: 15, Instructions: 152registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,00000000,005C0348,InstallerVersion,InstallerVersion,00000000,005C0348,InstallerName,InstallerName,00000000,005C0348,Date,InstalledDate,00000000,005C0348,LogonUser), ref: 005BF5BE
                                                                                                                                                                                                                          • Part of subcall function 005F1392: RegSetValueExW.ADVAPI32(00020006,00020006,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,005BF1C2,00000000,?,00020006), ref: 005F13C5
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseValue
                                                                                                                                                                                                                        • String ID: Date$Failed to create the key for update registration.$Failed to get the formatted key path for update registration.$Failed to write %ls value.$InstalledBy$InstalledDate$InstallerName$InstallerVersion$LogonUser$PackageName$PackageVersion$Publisher$PublishingGroup$ReleaseType$ThisVersionInstalled
                                                                                                                                                                                                                        • API String ID: 3132538880-2703781546
                                                                                                                                                                                                                        • Opcode ID: bd648efb32346121df34dcbc5296efe856756d387e21e27da6573816f8672bac
                                                                                                                                                                                                                        • Instruction ID: fa3d700085b2665cdcb3da7bcc6c6515cb8985fd1c3f1981fdc41636e0953e04
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bd648efb32346121df34dcbc5296efe856756d387e21e27da6573816f8672bac
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DB418631A8062BBBDB365A50CC1AEFF7E6ABF40B10F114575FA01762D1D764AE20E790
                                                                                                                                                                                                                        Function 005D678F Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 150serviceCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • OpenSCManagerW.ADVAPI32(00000000,00000000,000F003F,?,?,00000000,?,?,?,?,?,?,?,?,005D6CE1,?), ref: 005D67C8
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,005D6CE1,?,?,?), ref: 005D67D5
                                                                                                                                                                                                                        • OpenServiceW.ADVAPI32(00000000,wuauserv,00000027,?,?,?,?,?,?,?,?,005D6CE1,?,?,?), ref: 005D681D
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,005D6CE1,?,?,?), ref: 005D6829
                                                                                                                                                                                                                        • QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,?,?,?,?,005D6CE1,?,?,?), ref: 005D6863
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,005D6CE1,?,?,?), ref: 005D686D
                                                                                                                                                                                                                        • CloseServiceHandle.ADVAPI32(00000000), ref: 005D6924
                                                                                                                                                                                                                        • CloseServiceHandle.ADVAPI32(?), ref: 005D692E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Service$ErrorLast$CloseHandleOpen$ManagerQueryStatus
                                                                                                                                                                                                                        • String ID: Failed to mark WU service to start on demand.$Failed to open WU service.$Failed to open service control manager.$Failed to query status of WU service.$Failed to read configuration for WU service.$msuengine.cpp$wuauserv$l]
                                                                                                                                                                                                                        • API String ID: 971853308-1458068076
                                                                                                                                                                                                                        • Opcode ID: 60b62b1d9f51ed9c5892b9ad3a8a5b37a2679489f5b5ffddbc8bf9d0bfda5988
                                                                                                                                                                                                                        • Instruction ID: 757f84c2c6070741e89f7a88f0454cd4639bc61fc29d6f7dbdc3758c4b166778
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 60b62b1d9f51ed9c5892b9ad3a8a5b37a2679489f5b5ffddbc8bf9d0bfda5988
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6341A171B40315ABEB209BADCC49AAF7BE9FB48750F024527FD05F7380DA749C4596A0
                                                                                                                                                                                                                        Function 005CE563 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 135registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • TlsSetValue.KERNEL32(?,?), ref: 005CE5AE
                                                                                                                                                                                                                        • RegisterClassW.USER32(?), ref: 005CE5DA
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005CE5E5
                                                                                                                                                                                                                        • CreateWindowExW.USER32(00000080,00609CC4,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 005CE64C
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005CE656
                                                                                                                                                                                                                        • UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 005CE6F4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
                                                                                                                                                                                                                        • String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$uithread.cpp
                                                                                                                                                                                                                        • API String ID: 213125376-288575659
                                                                                                                                                                                                                        • Opcode ID: ff9481489350a4a0c828740e6fdc0d0eeb1ed486ce76d972c0c702a260720bf9
                                                                                                                                                                                                                        • Instruction ID: 4773bfacc5dae675a4e6350f8534458f3bdfda9c183e21b51feb064cbd908fee
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ff9481489350a4a0c828740e6fdc0d0eeb1ed486ce76d972c0c702a260720bf9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D4419E72A40214EFEB209BA4DC49FEBBFE9FF18350F11412AF909E6190D7349944DBA1
                                                                                                                                                                                                                        Function 005DC517 Relevance: 26.5, APIs: 1, Strings: 14, Instructions: 272COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to recreate command-line arguments., xrefs: 005DC7E6
                                                                                                                                                                                                                        • Failed to allocate memory for pseudo bundle payload hash., xrefs: 005DC750
                                                                                                                                                                                                                        • Failed to copy key for passthrough pseudo bundle., xrefs: 005DC72B
                                                                                                                                                                                                                        • Failed to copy cache id for passthrough pseudo bundle., xrefs: 005DC7A8
                                                                                                                                                                                                                        • Failed to copy uninstall arguments for passthrough bundle package, xrefs: 005DC84F
                                                                                                                                                                                                                        • Failed to copy download source for passthrough pseudo bundle., xrefs: 005DC732
                                                                                                                                                                                                                        • Failed to copy filename for passthrough pseudo bundle., xrefs: 005DC761
                                                                                                                                                                                                                        • Failed to copy install arguments for passthrough bundle package, xrefs: 005DC805
                                                                                                                                                                                                                        • Failed to allocate space for burn payload inside of related bundle struct, xrefs: 005DC78A
                                                                                                                                                                                                                        • Failed to copy key for passthrough pseudo bundle payload., xrefs: 005DC768
                                                                                                                                                                                                                        • pseudobundle.cpp, xrefs: 005DC54B, 005DC744, 005DC77E
                                                                                                                                                                                                                        • Failed to copy local source path for passthrough pseudo bundle., xrefs: 005DC75A
                                                                                                                                                                                                                        • Failed to copy related arguments for passthrough bundle package, xrefs: 005DC825
                                                                                                                                                                                                                        • Failed to allocate space for burn package payload inside of passthrough bundle., xrefs: 005DC557
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Heap$AllocateProcess
                                                                                                                                                                                                                        • String ID: Failed to allocate memory for pseudo bundle payload hash.$Failed to allocate space for burn package payload inside of passthrough bundle.$Failed to allocate space for burn payload inside of related bundle struct$Failed to copy cache id for passthrough pseudo bundle.$Failed to copy download source for passthrough pseudo bundle.$Failed to copy filename for passthrough pseudo bundle.$Failed to copy install arguments for passthrough bundle package$Failed to copy key for passthrough pseudo bundle payload.$Failed to copy key for passthrough pseudo bundle.$Failed to copy local source path for passthrough pseudo bundle.$Failed to copy related arguments for passthrough bundle package$Failed to copy uninstall arguments for passthrough bundle package$Failed to recreate command-line arguments.$pseudobundle.cpp
                                                                                                                                                                                                                        • API String ID: 1357844191-115096447
                                                                                                                                                                                                                        • Opcode ID: a2f29cb07b23b3da9b223ea9fe0ed001695f160f5e65bf57cd97594a91b1de0a
                                                                                                                                                                                                                        • Instruction ID: 3923ab41634aa1b8a66032d2967401e4fa05ac83952b5d72653332e8aee004b4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a2f29cb07b23b3da9b223ea9fe0ed001695f160f5e65bf57cd97594a91b1de0a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BBB13575A40616EFDB21DF28C881F96BFA1FB48710F11416AF914AB7A2C731E811DF90
                                                                                                                                                                                                                        Function 005BBB30 Relevance: 26.4, APIs: 6, Strings: 9, Instructions: 189processCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 005BBB82
                                                                                                                                                                                                                        • CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000200,00000000,?,00000044,?,?,?,?,?), ref: 005BBC8F
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?), ref: 005BBC99
                                                                                                                                                                                                                        • WaitForInputIdle.USER32(?,?), ref: 005BBCED
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?), ref: 005BBD38
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?), ref: 005BBD45
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseHandle$CreateErrorIdleInputLastOpen@16ProcessWait
                                                                                                                                                                                                                        • String ID: "%ls"$"%ls" %s$D$Failed to CreateProcess on path: %ls$Failed to create executable command.$Failed to create obfuscated executable command.$Failed to format argument string.$Failed to format obfuscated argument string.$approvedexe.cpp
                                                                                                                                                                                                                        • API String ID: 155678114-2737401750
                                                                                                                                                                                                                        • Opcode ID: 203d54c843e799db166a1fbb3ed9b9fd779e928a2f6263397b40392ef9105742
                                                                                                                                                                                                                        • Instruction ID: 8cfa11e2f881b600a3ecb45917074e87248cd9336752c214b14d45b6fba9d84a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 203d54c843e799db166a1fbb3ed9b9fd779e928a2f6263397b40392ef9105742
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0A513972D0061ABBEF119FA4CC46DEEBF79FF44300B104566EA04B6160D7B5AE50DBA1
                                                                                                                                                                                                                        Function 005BB106 Relevance: 24.6, APIs: 3, Strings: 11, Instructions: 136COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(00000000,00000000,00000000,?,005BB9F7,00000008,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 005BB10E
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005BB9F7,00000008,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 005BB11A
                                                                                                                                                                                                                        • _memcmp.LIBVCRUNTIME ref: 005BB1C2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorHandleLastModule_memcmp
                                                                                                                                                                                                                        • String ID: .wix$.wixburn$Bundle guid didn't match the guid in the PE Header in memory.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get module handle to process.$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$burn$section.cpp
                                                                                                                                                                                                                        • API String ID: 3888311042-926796631
                                                                                                                                                                                                                        • Opcode ID: db0191cdf1f9374780eb1b0aa07e77e23952a54db717c2c48924f43ed62185cd
                                                                                                                                                                                                                        • Instruction ID: 072e104e72cd390c9630a559783b34c712b41faf3286d4f88d89ab40b682bac5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: db0191cdf1f9374780eb1b0aa07e77e23952a54db717c2c48924f43ed62185cd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 25412AB6380715B7E7305A55DC47EBA6E55FF80B20F154029FA02AB581DBE8EA01C3A6
                                                                                                                                                                                                                        Function 005C2DDC Relevance: 23.1, APIs: 1, Strings: 12, Instructions: 303COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to lookup the bundle ID in the ancestors dictionary., xrefs: 005C30F0
                                                                                                                                                                                                                        • %ls;%ls, xrefs: 005C2EDE
                                                                                                                                                                                                                        • Failed to create string array from ancestors., xrefs: 005C2E1A
                                                                                                                                                                                                                        • Failed to copy ancestors and self to related bundle ancestors., xrefs: 005C2EF6
                                                                                                                                                                                                                        • plan.cpp, xrefs: 005C311D
                                                                                                                                                                                                                        • Failed to add the package provider key "%ls" to the planned list., xrefs: 005C3107
                                                                                                                                                                                                                        • feclient.dll, xrefs: 005C30BB
                                                                                                                                                                                                                        • Failed to copy self to related bundle ancestors., xrefs: 005C312E
                                                                                                                                                                                                                        • crypt32.dll, xrefs: 005C2E0E
                                                                                                                                                                                                                        • Unexpected relation type encountered during plan: %d, xrefs: 005C30FE
                                                                                                                                                                                                                        • Failed to create dictionary from ancestors array., xrefs: 005C2E46
                                                                                                                                                                                                                        • UX aborted plan related bundle., xrefs: 005C3127
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: %ls;%ls$Failed to add the package provider key "%ls" to the planned list.$Failed to copy ancestors and self to related bundle ancestors.$Failed to copy self to related bundle ancestors.$Failed to create dictionary from ancestors array.$Failed to create string array from ancestors.$Failed to lookup the bundle ID in the ancestors dictionary.$UX aborted plan related bundle.$Unexpected relation type encountered during plan: %d$crypt32.dll$feclient.dll$plan.cpp
                                                                                                                                                                                                                        • API String ID: 0-794096528
                                                                                                                                                                                                                        • Opcode ID: a14f8eb985be0ed99bd5c98951cdbcdfa7818e8e5506b68d8e948f16e00e6430
                                                                                                                                                                                                                        • Instruction ID: 46fed884548e9769f6cebf726bd4ce876d1045533f5f58d327715585ce997b6f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a14f8eb985be0ed99bd5c98951cdbcdfa7818e8e5506b68d8e948f16e00e6430
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E5B1C13190061AEFDB15DFA4CC49FAABFB5FF45310F14856EE804AB251E731AA90CB90
                                                                                                                                                                                                                        Function 005BA17D Relevance: 22.9, APIs: 4, Strings: 9, Instructions: 138registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 005BA1A8
                                                                                                                                                                                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 005BA204
                                                                                                                                                                                                                        • RegQueryValueExW.ADVAPI32(000002C0,00000000,00000000,000002C0,00000000,00000000,000002C0,?,00000000,00000000,?,00000000,00000101,000002C0,000002C0,?), ref: 005BA226
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,00000000,00000000,000002C0,00000100,00000000,000002C0), ref: 005BA300
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Registry value not found. Key = '%ls', Value = '%ls', xrefs: 005BA275
                                                                                                                                                                                                                        • Failed to query registry key value., xrefs: 005BA265
                                                                                                                                                                                                                        • Failed to open registry key. Key = '%ls', xrefs: 005BA2C2
                                                                                                                                                                                                                        • search.cpp, xrefs: 005BA25B
                                                                                                                                                                                                                        • RegistrySearchExists failed: ID '%ls', HRESULT 0x%x, xrefs: 005BA2D8
                                                                                                                                                                                                                        • Failed to format key string., xrefs: 005BA1B3
                                                                                                                                                                                                                        • Failed to format value string., xrefs: 005BA20F
                                                                                                                                                                                                                        • Registry key not found. Key = '%ls', xrefs: 005BA291
                                                                                                                                                                                                                        • Failed to set variable., xrefs: 005BA2B8
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Open@16$CloseQueryValue
                                                                                                                                                                                                                        • String ID: Failed to format key string.$Failed to format value string.$Failed to open registry key. Key = '%ls'$Failed to query registry key value.$Failed to set variable.$Registry key not found. Key = '%ls'$Registry value not found. Key = '%ls', Value = '%ls'$RegistrySearchExists failed: ID '%ls', HRESULT 0x%x$search.cpp
                                                                                                                                                                                                                        • API String ID: 2702208347-46557908
                                                                                                                                                                                                                        • Opcode ID: 9893e18f532ee0dc9b74ecce7becdd6759134fc8e796ff7a3efd5ecc5e367912
                                                                                                                                                                                                                        • Instruction ID: c2c9e5748f25ed2a6e7bc7041fadbc156061b30969bafddae3a4cae4524bfc7e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9893e18f532ee0dc9b74ecce7becdd6759134fc8e796ff7a3efd5ecc5e367912
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3441D676E40219BBDF116A94CC0AFFDBF69FB44700F104165FE04B61A1D775AE10D692
                                                                                                                                                                                                                        Function 005B67E5 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 131libraryloaderCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetModuleHandleExW.KERNEL32(00000000,ntdll,?), ref: 005B6835
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B683F
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,RtlGetVersion), ref: 005B6882
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B688C
                                                                                                                                                                                                                        • FreeLibrary.KERNEL32(00000000,00000000,?), ref: 005B699D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                        • String ID: Failed to get OS info.$Failed to locate NTDLL.$Failed to locate RtlGetVersion.$Failed to set variant value.$RtlGetVersion$ntdll$variable.cpp
                                                                                                                                                                                                                        • API String ID: 3057421322-109962352
                                                                                                                                                                                                                        • Opcode ID: b3a02047758d216fa9392afcb29b90a0cdcffc6a2884aec493ed86ec494fa523
                                                                                                                                                                                                                        • Instruction ID: 3467c2300ea22f81423141bb705db178364a5e95488887cdbf8b72918426c20d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b3a02047758d216fa9392afcb29b90a0cdcffc6a2884aec493ed86ec494fa523
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 364184719012299BEB319B65CD09BFABEF4FB08750F0001AAF948F6190D7799E54CAA1
                                                                                                                                                                                                                        Function 005B47E9 Relevance: 22.9, APIs: 6, Strings: 7, Instructions: 128memorysynchronizationCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • TlsAlloc.KERNEL32(?,00000001,00000001,00000000,00000000,?,?,?,005B535E,?,?,?,?), ref: 005B481A
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,005B535E,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 005B482B
                                                                                                                                                                                                                        • ReleaseMutex.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 005B4968
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?,?,005B535E,?,?,?,?,?,?,?,?,?,?,?), ref: 005B4971
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to connect to unelevated process., xrefs: 005B4810
                                                                                                                                                                                                                        • engine.cpp, xrefs: 005B484F, 005B4898
                                                                                                                                                                                                                        • Failed to allocate thread local storage for logging., xrefs: 005B4859
                                                                                                                                                                                                                        • Failed to create the message window., xrefs: 005B48C6
                                                                                                                                                                                                                        • Failed to set elevated pipe into thread local storage for logging., xrefs: 005B48A2
                                                                                                                                                                                                                        • comres.dll, xrefs: 005B48D7
                                                                                                                                                                                                                        • Failed to pump messages from parent process., xrefs: 005B493C
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AllocCloseErrorHandleLastMutexRelease
                                                                                                                                                                                                                        • String ID: Failed to allocate thread local storage for logging.$Failed to connect to unelevated process.$Failed to create the message window.$Failed to pump messages from parent process.$Failed to set elevated pipe into thread local storage for logging.$comres.dll$engine.cpp
                                                                                                                                                                                                                        • API String ID: 687263955-1790235126
                                                                                                                                                                                                                        • Opcode ID: 1c1b03fd684db0d575372bc812000adeea57c8ed8466a649e00deffdba792a30
                                                                                                                                                                                                                        • Instruction ID: d24b14ff4ddec903204a08936154857f41eaec2e17b93470673b85938b01f23d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1c1b03fd684db0d575372bc812000adeea57c8ed8466a649e00deffdba792a30
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2B416A72A00619FBEB215BA5CC4AEFBBEACFF44710F100226FB05E2151DB7469549BE1
                                                                                                                                                                                                                        Function 005C39FD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 128COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetTempPathW.KERNEL32(00000104,?,?,00000000,crypt32.dll), ref: 005C3A51
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00000000,crypt32.dll), ref: 005C3A5B
                                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,?,?,00000104,?,?,00000000,crypt32.dll), ref: 005C3AC4
                                                                                                                                                                                                                        • ProcessIdToSessionId.KERNEL32(00000000,?,00000000,crypt32.dll), ref: 005C3ACB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to get temp folder., xrefs: 005C3A89
                                                                                                                                                                                                                        • Failed to get length of temp folder., xrefs: 005C3AB5
                                                                                                                                                                                                                        • %u\, xrefs: 005C3AE5
                                                                                                                                                                                                                        • Failed to copy temp folder., xrefs: 005C3B7A
                                                                                                                                                                                                                        • Failed to format session id as a string., xrefs: 005C3AF9
                                                                                                                                                                                                                        • crypt32.dll, xrefs: 005C3A10
                                                                                                                                                                                                                        • logging.cpp, xrefs: 005C3A7F
                                                                                                                                                                                                                        • Failed to get length of session id string., xrefs: 005C3B1D
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Process$CurrentErrorLastPathSessionTemp
                                                                                                                                                                                                                        • String ID: %u\$Failed to copy temp folder.$Failed to format session id as a string.$Failed to get length of session id string.$Failed to get length of temp folder.$Failed to get temp folder.$crypt32.dll$logging.cpp
                                                                                                                                                                                                                        • API String ID: 1726527325-3274134579
                                                                                                                                                                                                                        • Opcode ID: 1f5127887f1a23f91452234b6ab7183c93e2a94e8b2bf84d9a906b857573329c
                                                                                                                                                                                                                        • Instruction ID: 026b517cfdff479a39ad502fc40a4f91b2b6d1e1af91c303e759a6120e14bedc
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1f5127887f1a23f91452234b6ab7183c93e2a94e8b2bf84d9a906b857573329c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A841847298123DABDB209B64CC4DFEABB7CFB14710F114296E908A7291D6749F84CBD0
                                                                                                                                                                                                                        Function 005B7E7C Relevance: 21.2, APIs: 2, Strings: 12, Instructions: 214COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,000000B9,00000002,?,00000000,00000000), ref: 005B7E99
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(?,?,?), ref: 005B80C1
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to write included flag., xrefs: 005B80AF
                                                                                                                                                                                                                        • Failed to write variable count., xrefs: 005B7EB4
                                                                                                                                                                                                                        • Failed to get string., xrefs: 005B808C
                                                                                                                                                                                                                        • Failed to write literal flag., xrefs: 005B809A
                                                                                                                                                                                                                        • Failed to write variable value type., xrefs: 005B80A1
                                                                                                                                                                                                                        • Failed to write variable name., xrefs: 005B80A8
                                                                                                                                                                                                                        • feclient.dll, xrefs: 005B7F74, 005B7FCA, 005B800B
                                                                                                                                                                                                                        • Failed to write variable value as string., xrefs: 005B8085
                                                                                                                                                                                                                        • Failed to get numeric., xrefs: 005B8093
                                                                                                                                                                                                                        • Unsupported variable type., xrefs: 005B807E
                                                                                                                                                                                                                        • Failed to get version., xrefs: 005B8072
                                                                                                                                                                                                                        • Failed to write variable value as number., xrefs: 005B806B
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                        • String ID: Failed to get numeric.$Failed to get string.$Failed to get version.$Failed to write included flag.$Failed to write literal flag.$Failed to write variable count.$Failed to write variable name.$Failed to write variable value as number.$Failed to write variable value as string.$Failed to write variable value type.$Unsupported variable type.$feclient.dll
                                                                                                                                                                                                                        • API String ID: 3168844106-2118673349
                                                                                                                                                                                                                        • Opcode ID: 9daf6a28caee0e10c2a543e88c62f0b08881ef3eab5a0241b213c88a5591a253
                                                                                                                                                                                                                        • Instruction ID: c96669fd1fd21749de571d1eec6269d4f5215ae3d437e6ac283fb2eb403e1efd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9daf6a28caee0e10c2a543e88c62f0b08881ef3eab5a0241b213c88a5591a253
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BB61933290061EABCB22AE64C948AFE7F79FF44390F145161FA0067290DB35ED58DBA1
                                                                                                                                                                                                                        Function 005F6BF6 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 166COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,label,000000FF,?,?,?,74DEDFD0,?,005F7172,?,?), ref: 005F6C4C
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F6CB7
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F6D2F
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F6D71
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: String$Free$Compare
                                                                                                                                                                                                                        • String ID: feclient.dll$label$rq_$rq_$scheme$term
                                                                                                                                                                                                                        • API String ID: 1324494773-1282537015
                                                                                                                                                                                                                        • Opcode ID: cb8ee1c9f4a3299a1f49b6074d0aa6f9404f5e195da593b378f29e3e94ae39e2
                                                                                                                                                                                                                        • Instruction ID: db63d6bbc562aa395ef508eac9d72e60eb410837f0ebe12287b85912a57f4463
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: cb8ee1c9f4a3299a1f49b6074d0aa6f9404f5e195da593b378f29e3e94ae39e2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EC513875A0121DEBDB11DBA4CC58EBEBBB9FF04720F240695E611EA1A0D739AE40DB50
                                                                                                                                                                                                                        Function 005F01F0 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 123COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(00000000,?,00000104,00000001,00000000,00000000), ref: 005F0234
                                                                                                                                                                                                                        • GetComputerNameW.KERNEL32(?,?), ref: 005F028C
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Name$ComputerFileModule
                                                                                                                                                                                                                        • String ID: --- logging level: %hs ---$8ba$=== Logging started: %ls ===$@ba$Computer : %ls$Executable: %ls v%d.%d.%d.%d$Hba$Tba$\ba$dba
                                                                                                                                                                                                                        • API String ID: 2577110986-263053728
                                                                                                                                                                                                                        • Opcode ID: 24b71a690fab62d0f3f95bad347d29e61a0ada0b0fa244465ec9dc44bd8820d5
                                                                                                                                                                                                                        • Instruction ID: 028617341c3ceb7602c0d42ec9a36d29197aa1cf9c24baddcb5da3bad34de501
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 24b71a690fab62d0f3f95bad347d29e61a0ada0b0fa244465ec9dc44bd8820d5
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 514196B590011C9BCB219F64DC889FA7BBCFB54300F0855AAF709E3182D6349F858F65
                                                                                                                                                                                                                        Function 005C95AC Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 122fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateFileW.KERNEL32(?,80000000,00000005,00000000,00000003,08000000,00000000,?,00000000,?,005CA63D,?,00000000,?,?,005DB049), ref: 005C95C7
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005CA63D,?,00000000,?,?,005DB049,?,00000000,?,00000000,?,?,005DB049,?), ref: 005C95D7
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,005DB049,00000001,00000003,000007D0,?,?,005DB049,?), ref: 005C96E4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • %ls payload from working path '%ls' to path '%ls', xrefs: 005C968F
                                                                                                                                                                                                                        • Failed to copy %ls to %ls, xrefs: 005C96D2
                                                                                                                                                                                                                        • Failed to verify payload hash: %ls, xrefs: 005C966F
                                                                                                                                                                                                                        • Failed to move %ls to %ls, xrefs: 005C96BC
                                                                                                                                                                                                                        • cache.cpp, xrefs: 005C95FB
                                                                                                                                                                                                                        • Failed to verify payload signature: %ls, xrefs: 005C9632
                                                                                                                                                                                                                        • Failed to open payload in working path: %ls, xrefs: 005C9606
                                                                                                                                                                                                                        • Moving, xrefs: 005C9686, 005C968E
                                                                                                                                                                                                                        • Copying, xrefs: 005C9679
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                        • String ID: %ls payload from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open payload in working path: %ls$Failed to verify payload hash: %ls$Failed to verify payload signature: %ls$Moving$cache.cpp
                                                                                                                                                                                                                        • API String ID: 2528220319-1604654059
                                                                                                                                                                                                                        • Opcode ID: 404e9cc85e521a47b7eec638c3c331ce125316292212059bbdad331e309eb7a8
                                                                                                                                                                                                                        • Instruction ID: f11b463f98792140c4b916ef904f86b7b8188202b64628826c57145aae5099af
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 404e9cc85e521a47b7eec638c3c331ce125316292212059bbdad331e309eb7a8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D131E371E802257FEB221AA58C0EF7B3E6DFF81F50F06011DBD05AA2C1D660AD40D6E5
                                                                                                                                                                                                                        Function 005D1341 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 80synchronizationCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SetEvent.KERNEL32(005FB468,=S[,00000000,?,005BC06D,=S[,005B52B5,00000000,?,005C763B,?,005B5565,005B5371,005B5371,00000000,?), ref: 005D135E
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005BC06D,=S[,005B52B5,00000000,?,005C763B,?,005B5565,005B5371,005B5371,00000000,?,005B5381,FFF9E89D,005B5381), ref: 005D1368
                                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(005FB478,000000FF,?,005BC06D,=S[,005B52B5,00000000,?,005C763B,?,005B5565,005B5371,005B5371,00000000,?,005B5381), ref: 005D13A2
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005BC06D,=S[,005B52B5,00000000,?,005C763B,?,005B5565,005B5371,005B5371,00000000,?,005B5381,FFF9E89D,005B5381), ref: 005D13AC
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,005B5381,=S[,00000000,?,005BC06D,=S[,005B52B5,00000000,?,005C763B,?,005B5565,005B5371,005B5371,00000000), ref: 005D13F7
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,005B5381,=S[,00000000,?,005BC06D,=S[,005B52B5,00000000,?,005C763B,?,005B5565,005B5371,005B5371,00000000), ref: 005D1406
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,005B5381,=S[,00000000,?,005BC06D,=S[,005B52B5,00000000,?,005C763B,?,005B5565,005B5371,005B5371,00000000), ref: 005D1415
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseHandle$ErrorLast$EventObjectSingleWait
                                                                                                                                                                                                                        • String ID: =S[$=S[$Failed to set begin operation event.$Failed to wait for thread to terminate.$cabextract.cpp
                                                                                                                                                                                                                        • API String ID: 1206859064-2819870784
                                                                                                                                                                                                                        • Opcode ID: d8589a812f98b0b88b3295259e3be6c2fcc5ef2c0b326cfb53cdbf52df008fa8
                                                                                                                                                                                                                        • Instruction ID: a3721c29ee16081b21a7ce7c69173a99f802e07b59238812f08acac7f9b33a6a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d8589a812f98b0b88b3295259e3be6c2fcc5ef2c0b326cfb53cdbf52df008fa8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 57212932240B00EBF7305B2ACC49B677AF6FF84311F01462EE54A919E0DB79D444DB29
                                                                                                                                                                                                                        Function 005C3E47 Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 220sleepCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005C3955: RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,005C3E61,feclient.dll,?,00000000,?,?,?,005B4A0C), ref: 005C39F1
                                                                                                                                                                                                                        • Sleep.KERNEL32(000007D0,00000001,feclient.dll,?,00000000,?,?,?,005B4A0C,?,?,005FB478,?,00000001,00000000,00000000), ref: 005C3EF8
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseSleep
                                                                                                                                                                                                                        • String ID: Failed to copy full log path to prefix.$Failed to copy log extension to extension.$Failed to copy log path to prefix.$Failed to get current directory.$Failed to get non-session specific TEMP folder.$Failed to open log: %ls$Setup$clbcatq.dll$crypt32.dll$feclient.dll$log$msasn1.dll
                                                                                                                                                                                                                        • API String ID: 2834455192-2673269691
                                                                                                                                                                                                                        • Opcode ID: 3bf4a39328637bcd9936afcc1074c2c7641462b27a87db01dc537f112e5724d1
                                                                                                                                                                                                                        • Instruction ID: d3d6adb4b987a7552921140c8ed5b7cd56a0b7ce68f362154959b24b9712e1ba
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3bf4a39328637bcd9936afcc1074c2c7641462b27a87db01dc537f112e5724d1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4961B271A0021AAFDB159FA4C84AF7A7FA8FF40300B04851DF901DB281E775EE50DB91
                                                                                                                                                                                                                        Function 005B6C5D Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 167COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(00000001,?,00000000,005B533D,00000000,00000001), ref: 005B6C6E
                                                                                                                                                                                                                          • Part of subcall function 005B55B6: CompareStringW.KERNEL32(0000007F,00001000,?,000000FF,version.dll,000000FF,?,00000000,00000007,005B648B,005B648B,?,005B554A,?,?,00000000), ref: 005B55F2
                                                                                                                                                                                                                          • Part of subcall function 005B55B6: GetLastError.KERNEL32(?,005B554A,?,?,00000000,?,00000000,005B648B,?,005B7DDC,?,?,?,?,?), ref: 005B5621
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(00000001,?,00000001), ref: 005B6E02
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to find variable value '%ls'., xrefs: 005B6C89
                                                                                                                                                                                                                        • Attempt to set built-in variable value: %ls, xrefs: 005B6CFC
                                                                                                                                                                                                                        • Failed to insert variable '%ls'., xrefs: 005B6CB3
                                                                                                                                                                                                                        • variable.cpp, xrefs: 005B6CF1
                                                                                                                                                                                                                        • Setting numeric variable '%ls' to value %lld, xrefs: 005B6DA3
                                                                                                                                                                                                                        • Failed to set value of variable: %ls, xrefs: 005B6DEA
                                                                                                                                                                                                                        • Setting variable failed: ID '%ls', HRESULT 0x%x, xrefs: 005B6E14
                                                                                                                                                                                                                        • Setting version variable '%ls' to value '%hu.%hu.%hu.%hu', xrefs: 005B6D79
                                                                                                                                                                                                                        • Setting hidden variable '%ls', xrefs: 005B6D2C
                                                                                                                                                                                                                        • Setting string variable '%ls' to value '%ls', xrefs: 005B6D96
                                                                                                                                                                                                                        • Unsetting variable '%ls', xrefs: 005B6DBE
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalSection$CompareEnterErrorLastLeaveString
                                                                                                                                                                                                                        • String ID: Attempt to set built-in variable value: %ls$Failed to find variable value '%ls'.$Failed to insert variable '%ls'.$Failed to set value of variable: %ls$Setting hidden variable '%ls'$Setting numeric variable '%ls' to value %lld$Setting string variable '%ls' to value '%ls'$Setting variable failed: ID '%ls', HRESULT 0x%x$Setting version variable '%ls' to value '%hu.%hu.%hu.%hu'$Unsetting variable '%ls'$variable.cpp
                                                                                                                                                                                                                        • API String ID: 2716280545-445000439
                                                                                                                                                                                                                        • Opcode ID: 8732fbe91e9634573147d8d8009ea8fdd0c6cd21c2dad485fa301998d7e93dfd
                                                                                                                                                                                                                        • Instruction ID: da8ce7cc9047e7ea2698b14afa9b04a11d69e5a81ec822fb9b3132c73e576d9d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8732fbe91e9634573147d8d8009ea8fdd0c6cd21c2dad485fa301998d7e93dfd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F751E271A40219ABCB309F14CD4AFBB7F69FB95B00F140529F9449A282C27DFD51CAE1
                                                                                                                                                                                                                        Function 005C2A60 Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 298COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(00000000,00000001,006C0064,000000FF,002C002B,000000FF,?,00000000,?,wininet.dll,?,crypt32.dll,?,?,?,00000000), ref: 005C2ACD
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to add dependents ignored from command-line., xrefs: 005C2B82
                                                                                                                                                                                                                        • wininet.dll, xrefs: 005C2D1E
                                                                                                                                                                                                                        • Failed to create the string dictionary., xrefs: 005C2B06
                                                                                                                                                                                                                        • Failed to check for remaining dependents during planning., xrefs: 005C2C73
                                                                                                                                                                                                                        • Failed to add dependent bundle provider key to ignore dependents., xrefs: 005C2C37
                                                                                                                                                                                                                        • Failed to add registration action for dependent related bundle., xrefs: 005C2DD5
                                                                                                                                                                                                                        • crypt32.dll, xrefs: 005C2B18, 005C2C16, 005C2D0B, 005C2D80
                                                                                                                                                                                                                        • Failed to add registration action for self dependent., xrefs: 005C2D9E
                                                                                                                                                                                                                        • Failed to allocate registration action., xrefs: 005C2B36
                                                                                                                                                                                                                        • Failed to add self-dependent to ignore dependents., xrefs: 005C2B51
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CompareString
                                                                                                                                                                                                                        • String ID: Failed to add dependent bundle provider key to ignore dependents.$Failed to add dependents ignored from command-line.$Failed to add registration action for dependent related bundle.$Failed to add registration action for self dependent.$Failed to add self-dependent to ignore dependents.$Failed to allocate registration action.$Failed to check for remaining dependents during planning.$Failed to create the string dictionary.$crypt32.dll$wininet.dll
                                                                                                                                                                                                                        • API String ID: 1825529933-1705955799
                                                                                                                                                                                                                        • Opcode ID: 58c6f5339029c0f4a52ca482ae5c421bdd9ab7c3be3c632b2837586953f8339e
                                                                                                                                                                                                                        • Instruction ID: a527b43c4096d6298f3d89da3620c30125ac6bf79415d5b556477f92ca1d1d3c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 58c6f5339029c0f4a52ca482ae5c421bdd9ab7c3be3c632b2837586953f8339e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CFB18A70A0061AEFCB29DFA8C885FAA7FA1FF54310F04816EF805AA251D770DD91DB91
                                                                                                                                                                                                                        Function 005B49DF Relevance: 19.4, APIs: 2, Strings: 9, Instructions: 144windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • IsWindow.USER32(?), ref: 005B4B5E
                                                                                                                                                                                                                        • PostMessageW.USER32(?,00000010,00000000,00000000), ref: 005B4B6F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • WixBundleLayoutDirectory, xrefs: 005B4AEF
                                                                                                                                                                                                                        • Failed to query registration., xrefs: 005B4AA8
                                                                                                                                                                                                                        • Failed to create the message window., xrefs: 005B4A92
                                                                                                                                                                                                                        • Failed to check global conditions, xrefs: 005B4A43
                                                                                                                                                                                                                        • Failed to set layout directory variable to value provided from command-line., xrefs: 005B4B00
                                                                                                                                                                                                                        • Failed to open log., xrefs: 005B4A12
                                                                                                                                                                                                                        • Failed while running , xrefs: 005B4B24
                                                                                                                                                                                                                        • Failed to set action variables., xrefs: 005B4ABE
                                                                                                                                                                                                                        • Failed to set registration variables., xrefs: 005B4AD8
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: MessagePostWindow
                                                                                                                                                                                                                        • String ID: Failed to check global conditions$Failed to create the message window.$Failed to open log.$Failed to query registration.$Failed to set action variables.$Failed to set layout directory variable to value provided from command-line.$Failed to set registration variables.$Failed while running $WixBundleLayoutDirectory
                                                                                                                                                                                                                        • API String ID: 3618638489-3051724725
                                                                                                                                                                                                                        • Opcode ID: 5afc082558a4b0a26f8c62b5fe08e3a85af29705fae3296982a91f1f6f66804d
                                                                                                                                                                                                                        • Instruction ID: 4529dd309b82dc0ece1d146e1bd8501e43507dd4cf15556ecca8c5325eb82287
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5afc082558a4b0a26f8c62b5fe08e3a85af29705fae3296982a91f1f6f66804d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3241AF71A40A2BBBDB365A60CC4AFFABE6CFF04750F000615BA04A6552EB64FD10DAD1
                                                                                                                                                                                                                        Function 005BCABE Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 144COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,FFFEB88D,000000FF,?,000000FF,005B5381,?,005B52B5,00000000,005B5381,FFF9E89D,005B5381,005B53B5,005B533D,?), ref: 005BCB15
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CompareString
                                                                                                                                                                                                                        • String ID: =S[$=S[$Failed to concat file paths.$Failed to ensure directory exists$Failed to extract file.$Failed to find embedded payload: %ls$Failed to get directory portion of local file path$Failed to get next stream.$Payload was not found in container: %ls$payload.cpp
                                                                                                                                                                                                                        • API String ID: 1825529933-3475383373
                                                                                                                                                                                                                        • Opcode ID: bc26c49809a7fda9cd8a011dc11572c63bc77bd3c5d82beb67cfa66b5da26c8c
                                                                                                                                                                                                                        • Instruction ID: f746cda00267c516d3dbd4a15d22d6528a37020909b85b6c854218cb37d01e1a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bc26c49809a7fda9cd8a011dc11572c63bc77bd3c5d82beb67cfa66b5da26c8c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C541C03190021AEBCF25DF44CD869EEBFB5FF80710F5041A9EA15AB251C775AD40DB98
                                                                                                                                                                                                                        Function 005CEDFE Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 124COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: GetProcessHeap.KERNEL32(?,000001C7,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38E5
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: RtlAllocateHeap.NTDLL(00000000,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38EC
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(?,00000014,00000001), ref: 005CEE1B
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(?), ref: 005CEF48
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • UX requested unknown approved exe with id: %ls, xrefs: 005CEE7B
                                                                                                                                                                                                                        • Failed to copy the id., xrefs: 005CEEAD
                                                                                                                                                                                                                        • Engine is active, cannot change engine state., xrefs: 005CEE36
                                                                                                                                                                                                                        • Failed to copy the arguments., xrefs: 005CEEDA
                                                                                                                                                                                                                        • Failed to post launch approved exe message., xrefs: 005CEF33
                                                                                                                                                                                                                        • EngineForApplication.cpp, xrefs: 005CEF29
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalHeapSection$AllocateEnterLeaveProcess
                                                                                                                                                                                                                        • String ID: Engine is active, cannot change engine state.$EngineForApplication.cpp$Failed to copy the arguments.$Failed to copy the id.$Failed to post launch approved exe message.$UX requested unknown approved exe with id: %ls
                                                                                                                                                                                                                        • API String ID: 1367039788-528931743
                                                                                                                                                                                                                        • Opcode ID: ff87d479782547c629c66b723e1b4ae26d477c2ba35c6905305bf615d4e5cf3b
                                                                                                                                                                                                                        • Instruction ID: ebad3158330bc6315ca11bee0e77a48733210d584720ade358ba79774b9378ca
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ff87d479782547c629c66b723e1b4ae26d477c2ba35c6905305bf615d4e5cf3b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CF31B332A40315AFEB119FA4DC4AF6B7BA8FF44760B058029FD04EB291D674DD00D7A1
                                                                                                                                                                                                                        Function 005C9496 Relevance: 19.4, APIs: 3, Strings: 8, Instructions: 101fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateFileW.KERNEL32(?,80000000,00000005,00000000,00000003,08000000,00000000,?,00000000,?,005CA5CE,?,00000000,?,?,005DB041), ref: 005C94B1
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005CA5CE,?,00000000,?,?,005DB041,?,00000000,?,00000000,?,?,005DB041,?), ref: 005C94BF
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,005DB041,00000001,00000003,000007D0,?,?,005DB041,?), ref: 005C959E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                        • String ID: %ls container from working path '%ls' to path '%ls'$Copying$Failed to copy %ls to %ls$Failed to move %ls to %ls$Failed to open container in working path: %ls$Failed to verify container hash: %ls$Moving$cache.cpp
                                                                                                                                                                                                                        • API String ID: 2528220319-1187406825
                                                                                                                                                                                                                        • Opcode ID: 973e610dea448c9c8d2c0bb863c5195b6fb63e036a2ac1e46c9293f5f6c1721e
                                                                                                                                                                                                                        • Instruction ID: 0b7f6e19a15a69fa9923f779c07d91ab3cd31d599ca3446c6f24f8ea5a765a6e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 973e610dea448c9c8d2c0bb863c5195b6fb63e036a2ac1e46c9293f5f6c1721e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 85212271E807297FE7222A648C4EF7B2E6DEF95B10F050018BE05BA2C1D6A1AE01D5E0
                                                                                                                                                                                                                        Function 005B6E5A Relevance: 18.2, APIs: 2, Strings: 10, Instructions: 227COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(00000000,?,00000000,?,00000000,?,?,?,00000000,?,?,?,?,?,?,00000000), ref: 005B6E89
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(?), ref: 005B7095
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to set variable value., xrefs: 005B7048
                                                                                                                                                                                                                        • Failed to read variable literal flag., xrefs: 005B7070
                                                                                                                                                                                                                        • Failed to read variable count., xrefs: 005B6EA9
                                                                                                                                                                                                                        • Failed to read variable name., xrefs: 005B707E
                                                                                                                                                                                                                        • Failed to read variable included flag., xrefs: 005B7085
                                                                                                                                                                                                                        • Failed to read variable value type., xrefs: 005B7077
                                                                                                                                                                                                                        • Failed to read variable value as number., xrefs: 005B704F
                                                                                                                                                                                                                        • Unsupported variable type., xrefs: 005B705B
                                                                                                                                                                                                                        • Failed to set variable., xrefs: 005B7069
                                                                                                                                                                                                                        • Failed to read variable value as string., xrefs: 005B7062
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                        • String ID: Failed to read variable count.$Failed to read variable included flag.$Failed to read variable literal flag.$Failed to read variable name.$Failed to read variable value as number.$Failed to read variable value as string.$Failed to read variable value type.$Failed to set variable value.$Failed to set variable.$Unsupported variable type.
                                                                                                                                                                                                                        • API String ID: 3168844106-528957463
                                                                                                                                                                                                                        • Opcode ID: 189d15bc375641ba460683fff9e5a5e8e4b0ae0279aabe1e92e052686d4f6d87
                                                                                                                                                                                                                        • Instruction ID: 71d156397b74699b28033d3cb9c920151a50e297d19c16f6641c7bdb0f3c5869
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 189d15bc375641ba460683fff9e5a5e8e4b0ae0279aabe1e92e052686d4f6d87
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 53717172C0525EAADF21EE54D849EFEBF79FB84710F104162B900A6150D635AE159BA0
                                                                                                                                                                                                                        Function 005F43A6 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 247fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000080,00000000,?,?,00000000,?,00000000,?,?,?), ref: 005F4425
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005F443B
                                                                                                                                                                                                                        • GetFileSizeEx.KERNEL32(00000000,?), ref: 005F4486
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005F4490
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 005F4650
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorFileLast$CloseCreateHandleSize
                                                                                                                                                                                                                        • String ID: fileutil.cpp
                                                                                                                                                                                                                        • API String ID: 3555958901-2967768451
                                                                                                                                                                                                                        • Opcode ID: 334e8488d944829ab5fb00ff1cf3153e35b1e86956970e70f2518fc2d7482b53
                                                                                                                                                                                                                        • Instruction ID: 8c32f40999380c4b6174788ea18ec3f71a910c45aa0c0bdb2cc5ba3d6689b3dd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 334e8488d944829ab5fb00ff1cf3153e35b1e86956970e70f2518fc2d7482b53
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5171E571A4021AEBEB219E698C49BBB7AD8FB40350F114529FE15EB290E77DDD009F90
                                                                                                                                                                                                                        Function 005C4B96 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 122COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • UuidCreate.RPCRT4(?), ref: 005C4BC9
                                                                                                                                                                                                                        • StringFromGUID2.OLE32(?,?,00000027), ref: 005C4BF8
                                                                                                                                                                                                                        • UuidCreate.RPCRT4(?), ref: 005C4C43
                                                                                                                                                                                                                        • StringFromGUID2.OLE32(?,?,00000027), ref: 005C4C6F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CreateFromStringUuid
                                                                                                                                                                                                                        • String ID: BurnPipe.%s$Failed to allocate pipe name.$Failed to allocate pipe secret.$Failed to convert pipe guid into string.$Failed to create pipe guid.$pipe.cpp
                                                                                                                                                                                                                        • API String ID: 4041566446-2510341293
                                                                                                                                                                                                                        • Opcode ID: bb803122f627abc1ac888432ec5b02df9b57bba7626f04ef5699d63c4e7cbda6
                                                                                                                                                                                                                        • Instruction ID: d79d0ea709865e3ae21a5bd365cb87373b0bc3d91c8d3021e5e72ed86605eb9e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bb803122f627abc1ac888432ec5b02df9b57bba7626f04ef5699d63c4e7cbda6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9B415172D41319AFDB10DBE4C945FEEBBB8BB44711F11452AE505FB290DA789E04CB90
                                                                                                                                                                                                                        Function 005B5F14 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 105timeCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetSystemTime.KERNEL32(?), ref: 005B5F3F
                                                                                                                                                                                                                        • GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,00000000,00000000), ref: 005B5F53
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B5F65
                                                                                                                                                                                                                        • GetDateFormatW.KERNEL32(00000400,00000001,?,00000000,?,00000000,?,00000000), ref: 005B5FB8
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B5FC2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to allocate the buffer for the Date., xrefs: 005B5FA0
                                                                                                                                                                                                                        • Failed to set variant value., xrefs: 005B5FFF
                                                                                                                                                                                                                        • variable.cpp, xrefs: 005B5F7F, 005B5FDC
                                                                                                                                                                                                                        • Failed to get the Date., xrefs: 005B5FE6
                                                                                                                                                                                                                        • Failed to get the required buffer length for the Date., xrefs: 005B5F89
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: DateErrorFormatLast$SystemTime
                                                                                                                                                                                                                        • String ID: Failed to allocate the buffer for the Date.$Failed to get the Date.$Failed to get the required buffer length for the Date.$Failed to set variant value.$variable.cpp
                                                                                                                                                                                                                        • API String ID: 2700948981-3682088697
                                                                                                                                                                                                                        • Opcode ID: 2e2a80c6ce9ae08a445eac544fc752f28a0e145d55f110d05024ea4f55a22497
                                                                                                                                                                                                                        • Instruction ID: 6dc5c5d6eaa651c392fd024132936e77272210c42aa15536b9ee44794787f1e3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2e2a80c6ce9ae08a445eac544fc752f28a0e145d55f110d05024ea4f55a22497
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 60319C72A4061EABDB21ABE5CC46FFFBE78FB44710F100025FB05F6190EA649D0496A1
                                                                                                                                                                                                                        Function 005CE82A Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 99threadCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,?,005B5386,?,?), ref: 005CE84A
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005B5386,?,?), ref: 005CE857
                                                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,005CE563,?,00000000,00000000), ref: 005CE8B0
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005B5386,?,?), ref: 005CE8BD
                                                                                                                                                                                                                        • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,005B5386,?,?), ref: 005CE8F8
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,005B5386,?,?), ref: 005CE917
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,005B5386,?,?), ref: 005CE924
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
                                                                                                                                                                                                                        • String ID: Failed to create initialization event.$Failed to create the UI thread.$uithread.cpp
                                                                                                                                                                                                                        • API String ID: 2351989216-3599963359
                                                                                                                                                                                                                        • Opcode ID: 64c86fe0aac158e762205348ab837ddc5eff14fffba5e75bf1788cbbeceb584b
                                                                                                                                                                                                                        • Instruction ID: a395822c8efa6a032f21b710d53e989416e95a8d6235c2697334fbc633562318
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 64c86fe0aac158e762205348ab837ddc5eff14fffba5e75bf1788cbbeceb584b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 08312375E40219BFEB109FA99D85AAFBAEDFB08350F11416AF905F3191D6309E0096A1
                                                                                                                                                                                                                        Function 005CE3F4 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 95threadCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,00000000,?,?,005B5386,?,?), ref: 005CE415
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,005B5386,?,?), ref: 005CE422
                                                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,005CE177,00000000,00000000,00000000), ref: 005CE481
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,005B5386,?,?), ref: 005CE48E
                                                                                                                                                                                                                        • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,?,005B5386,?,?), ref: 005CE4C9
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?,005B5386,?,?), ref: 005CE4DD
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?,005B5386,?,?), ref: 005CE4EA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseCreateErrorHandleLast$EventMultipleObjectsThreadWait
                                                                                                                                                                                                                        • String ID: Failed to create UI thread.$Failed to create modal event.$splashscreen.cpp
                                                                                                                                                                                                                        • API String ID: 2351989216-1977201954
                                                                                                                                                                                                                        • Opcode ID: e66ef5afd914501f75f811f7c27913692d65db4a0bee728b6648d2fe240522a4
                                                                                                                                                                                                                        • Instruction ID: 0730904344e792093e407140f3ebb3cefc9554c8cfddffe43c94de0e57634536
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e66ef5afd914501f75f811f7c27913692d65db4a0bee728b6648d2fe240522a4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2C316B75D00319BFEB109BA9DC46EAFBBF9EB44710F11812AFD15F2190D7744A00DAA0
                                                                                                                                                                                                                        Function 005D1224 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88threadCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,?,74DF2F60,?,?,005B52FD,005B52B5,00000000,005B533D), ref: 005D1249
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005D125C
                                                                                                                                                                                                                        • GetExitCodeThread.KERNEL32(005FB478,?), ref: 005D129E
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005D12AC
                                                                                                                                                                                                                        • ResetEvent.KERNEL32(005FB450), ref: 005D12E7
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005D12F1
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
                                                                                                                                                                                                                        • String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$cabextract.cpp
                                                                                                                                                                                                                        • API String ID: 2979751695-3400260300
                                                                                                                                                                                                                        • Opcode ID: 00e7a029e5c14dc6b30403120c1623673e79d150a362167fe8c4e9fea46ccd52
                                                                                                                                                                                                                        • Instruction ID: 5613c63847356815a67c2764e2c6e90ddfea76dd57c0c17ea56f50efaec41701
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 00e7a029e5c14dc6b30403120c1623673e79d150a362167fe8c4e9fea46ccd52
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B021A0B5740304FFEB189B698D0AABE7AE8FB04710F00412FE946E62E0E6759A009A15
                                                                                                                                                                                                                        Function 005BD5C0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 61libraryloaderCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • LoadLibraryW.KERNEL32(?,00000000,?,005B46F8,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,005B5386,?,?), ref: 005BD5CD
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005B46F8,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,005B5386,?,?), ref: 005BD5DA
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 005BD612
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005B46F8,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,005B5386,?,?), ref: 005BD61E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$AddressLibraryLoadProc
                                                                                                                                                                                                                        • String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$userexperience.cpp$wininet.dll
                                                                                                                                                                                                                        • API String ID: 1866314245-1140179540
                                                                                                                                                                                                                        • Opcode ID: e8bf2572f7de398b22bee1bafae0ac31aafe455464127c67964411c83a7133f3
                                                                                                                                                                                                                        • Instruction ID: 943cba63d468892be461da4766887d931dca4342f60ab8d01ed19b0588580ea1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e8bf2572f7de398b22bee1bafae0ac31aafe455464127c67964411c83a7133f3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A8119132A40725ABEB215B699C09EB73BD8BF04750F01412AFE09E7690EB29DC00D7E4
                                                                                                                                                                                                                        Function 005C91F7 Relevance: 16.7, APIs: 2, Strings: 9, Instructions: 223COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,?,00000000,00000000,00000003,00000000,00000000), ref: 005C9297
                                                                                                                                                                                                                        • GetLastError.KERNEL32(000007D0,000007D0,00000000,00000000,000007D0,00000001), ref: 005C92BB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast
                                                                                                                                                                                                                        • String ID: $$0$Could not close verify handle.$Could not verify file %ls.$Failed to allocate memory$Failed to allocate string.$Failed to encode file hash.$Failed to get file hash.$cache.cpp
                                                                                                                                                                                                                        • API String ID: 1452528299-4263581490
                                                                                                                                                                                                                        • Opcode ID: 25b7b1f5db06e0e5eceaf91d9143d0ad814c24186d221a6f2a5ed18d0c8f0fd4
                                                                                                                                                                                                                        • Instruction ID: b527d58a7f3c9e2ad7de42fa5b255790d8a2c1b54d50bf2fe99f770eea0d6ec8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 25b7b1f5db06e0e5eceaf91d9143d0ad814c24186d221a6f2a5ed18d0c8f0fd4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7E714271D40229AEDF15DBE9CC85FEEBBF8BB48710F11012AE915F7291E77499018BA0
                                                                                                                                                                                                                        Function 005CE31B Relevance: 16.6, APIs: 11, Instructions: 86windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000EB), ref: 005CE326
                                                                                                                                                                                                                        • DefWindowProcW.USER32(?,00000082,?,?), ref: 005CE364
                                                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000EB,00000000), ref: 005CE371
                                                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000EB,?), ref: 005CE380
                                                                                                                                                                                                                        • DefWindowProcW.USER32(?,?,?,?), ref: 005CE38E
                                                                                                                                                                                                                        • CreateCompatibleDC.GDI32(?), ref: 005CE39A
                                                                                                                                                                                                                        • SelectObject.GDI32(00000000,00000000), ref: 005CE3AB
                                                                                                                                                                                                                        • StretchBlt.GDI32(?,00000000,00000000,?,?,00000000,00000000,00000000,?,?,00CC0020), ref: 005CE3CD
                                                                                                                                                                                                                        • SelectObject.GDI32(00000000,00000000), ref: 005CE3D5
                                                                                                                                                                                                                        • DeleteDC.GDI32(00000000), ref: 005CE3D8
                                                                                                                                                                                                                        • PostQuitMessage.USER32(00000000), ref: 005CE3E6
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Window$Long$ObjectProcSelect$CompatibleCreateDeleteMessagePostQuitStretch
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 409979828-0
                                                                                                                                                                                                                        • Opcode ID: c14334843041764b4a0db8db8918089a8a5237c1964396caccfcd37a2d7f4039
                                                                                                                                                                                                                        • Instruction ID: 9e2a936570b31c466e862e0ff4a5b23d8cd1b92ba932cc8d7d79c9e77f75a644
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c14334843041764b4a0db8db8918089a8a5237c1964396caccfcd37a2d7f4039
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 57218932100148FFEB255FA8DC4DE7B3FAAFB49721B158918FA16D71A0D735A810EB61
                                                                                                                                                                                                                        Function 005C9F36 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 220COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to combine last source with source., xrefs: 005CA00C
                                                                                                                                                                                                                        • WixBundleLayoutDirectory, xrefs: 005CA068
                                                                                                                                                                                                                        • WixBundleLastUsedSource, xrefs: 005C9F9D
                                                                                                                                                                                                                        • Failed to combine layout source with source., xrefs: 005CA0A0
                                                                                                                                                                                                                        • WixBundleOriginalSource, xrefs: 005C9FB3
                                                                                                                                                                                                                        • Failed to get current process directory., xrefs: 005C9FEF
                                                                                                                                                                                                                        • Failed to get bundle layout directory property., xrefs: 005CA083
                                                                                                                                                                                                                        • Failed to copy source path., xrefs: 005CA113
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Find$CloseFileFirstlstrlen
                                                                                                                                                                                                                        • String ID: Failed to combine last source with source.$Failed to combine layout source with source.$Failed to copy source path.$Failed to get bundle layout directory property.$Failed to get current process directory.$WixBundleLastUsedSource$WixBundleLayoutDirectory$WixBundleOriginalSource
                                                                                                                                                                                                                        • API String ID: 2767606509-3003062821
                                                                                                                                                                                                                        • Opcode ID: 5f4830e9d771ce638a4c0075f2d7a84e26e86fe381f7d61424b999d93585cec2
                                                                                                                                                                                                                        • Instruction ID: 16f7f74d3f0843b90084453cdae7ab7ab67406acca8db955d522b1067efe87ef
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5f4830e9d771ce638a4c0075f2d7a84e26e86fe381f7d61424b999d93585cec2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 03714A71D0021EAEDF169BE4C849EFEBFB5BF48354F15012AEA00B6290E7359D40DBA1
                                                                                                                                                                                                                        Function 005B3083 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 206COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,00000000,00000040,00000000,00000000), ref: 005B30C7
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B30D1
                                                                                                                                                                                                                        • ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 005B3129
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B3133
                                                                                                                                                                                                                        • GetFullPathNameW.KERNEL32(00000000,00000040,00000000,00000000,00000000,00000040,00000000,00000000), ref: 005B31EC
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B31F6
                                                                                                                                                                                                                        • GetFullPathNameW.KERNEL32(00000000,00000007,00000000,00000000,00000000,00000007), ref: 005B324D
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B3257
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$EnvironmentExpandFullNamePathStrings
                                                                                                                                                                                                                        • String ID: pathutil.cpp
                                                                                                                                                                                                                        • API String ID: 1547313835-741606033
                                                                                                                                                                                                                        • Opcode ID: 61e6932107b6c2ddf23ba256910d4a584cb468dfffc19b6425c240897b16b7f9
                                                                                                                                                                                                                        • Instruction ID: d1b66e14389e2bea413a3899b60340152be4fa2bbba6d4eddb81b41c679cb627
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 61e6932107b6c2ddf23ba256910d4a584cb468dfffc19b6425c240897b16b7f9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 58618F36E00629ABEB219AA98849BEEBEE8FF44750F114165ED05F7150E735AF00DB90
                                                                                                                                                                                                                        Function 005B2DE0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 198sleepfiletimeCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetTempPathW.KERNEL32(00000104,?,00000001,00000000,00000000), ref: 005B2E7A
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B2E84
                                                                                                                                                                                                                        • GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 005B2F1F
                                                                                                                                                                                                                        • CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000001,00000080,00000000), ref: 005B2FAD
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B2FBA
                                                                                                                                                                                                                        • Sleep.KERNEL32(00000064), ref: 005B2FCC
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 005B302C
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • %ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls, xrefs: 005B2F7D
                                                                                                                                                                                                                        • pathutil.cpp, xrefs: 005B2EA8
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$CloseCreateFileHandleLocalPathSleepTempTime
                                                                                                                                                                                                                        • String ID: %ls_%04u%02u%02u%02u%02u%02u%ls%ls%ls$pathutil.cpp
                                                                                                                                                                                                                        • API String ID: 3480017824-1101990113
                                                                                                                                                                                                                        • Opcode ID: 5ef9436462d042de8bb24f49c0b6d0422bc05bc8bb1285b721f6cf64e15cc192
                                                                                                                                                                                                                        • Instruction ID: 6c2dcc88e86e67c5f0805dac98235c875e2599cc485e558788677800c8575af2
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5ef9436462d042de8bb24f49c0b6d0422bc05bc8bb1285b721f6cf64e15cc192
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D0714571941229ABDB30ABA5DC4DBFABBF9BF48710F000195FA05E7190D734AE84DB60
                                                                                                                                                                                                                        Function 005B4690 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 128windowthreadCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 005B46B5
                                                                                                                                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 005B46BB
                                                                                                                                                                                                                          • Part of subcall function 005CFC51: new.LIBCMT ref: 005CFC58
                                                                                                                                                                                                                        • GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 005B4749
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to start bootstrapper application., xrefs: 005B4717
                                                                                                                                                                                                                        • Unexpected return value from message pump., xrefs: 005B479F
                                                                                                                                                                                                                        • engine.cpp, xrefs: 005B4795
                                                                                                                                                                                                                        • wininet.dll, xrefs: 005B46E8
                                                                                                                                                                                                                        • Failed to create engine for UX., xrefs: 005B46D5
                                                                                                                                                                                                                        • Failed to load UX., xrefs: 005B46FE
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Message$CurrentPeekThread
                                                                                                                                                                                                                        • String ID: Failed to create engine for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$engine.cpp$wininet.dll
                                                                                                                                                                                                                        • API String ID: 673430819-2573580774
                                                                                                                                                                                                                        • Opcode ID: bf2cb98ce07723b474f5a5f0377a3644996f8123ec977c468bb1e74915f2aeea
                                                                                                                                                                                                                        • Instruction ID: 5f0463a106d488afe630e1ac3d167e84470b6a8bf70cd3ffa80f152df5828023
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bf2cb98ce07723b474f5a5f0377a3644996f8123ec977c468bb1e74915f2aeea
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2041817160011ABFE7249BA4CC89EFA7BACFF05314F100525F905E7181EB24BD46DBA1
                                                                                                                                                                                                                        Function 005C8CB5 Relevance: 15.9, APIs: 2, Strings: 7, Instructions: 127COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • LocalFree.KERNEL32(00000000,?,00000001,80000005,?,00000000,00000000,00000000,00000003,000007D0), ref: 005C8E01
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to allocate access for SYSTEM group to path: %ls, xrefs: 005C8D29
                                                                                                                                                                                                                        • Failed to allocate access for Administrators group to path: %ls, xrefs: 005C8D08
                                                                                                                                                                                                                        • Failed to create ACL to secure cache path: %ls, xrefs: 005C8DB7
                                                                                                                                                                                                                        • Failed to allocate access for Everyone group to path: %ls, xrefs: 005C8D4A
                                                                                                                                                                                                                        • Failed to allocate access for Users group to path: %ls, xrefs: 005C8D6B
                                                                                                                                                                                                                        • cache.cpp, xrefs: 005C8DAC
                                                                                                                                                                                                                        • Failed to secure cache path: %ls, xrefs: 005C8DE4
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FreeLocal
                                                                                                                                                                                                                        • String ID: Failed to allocate access for Administrators group to path: %ls$Failed to allocate access for Everyone group to path: %ls$Failed to allocate access for SYSTEM group to path: %ls$Failed to allocate access for Users group to path: %ls$Failed to create ACL to secure cache path: %ls$Failed to secure cache path: %ls$cache.cpp
                                                                                                                                                                                                                        • API String ID: 2826327444-4113288589
                                                                                                                                                                                                                        • Opcode ID: 4a33f4477ff2bde8a9df418e3191028f224dd9c874d632c1ed479c5c68353b2d
                                                                                                                                                                                                                        • Instruction ID: 06ab72cab3acecfa47742930b3638bdb48e08621d1b9e496892305cdb99fc0d2
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4a33f4477ff2bde8a9df418e3191028f224dd9c874d632c1ed479c5c68353b2d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F641B671A4162ABAEB3196948C49FFB7EACFB50710F014069B905FA1C1DE70AD48D7A0
                                                                                                                                                                                                                        Function 005D9A57 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 125COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SetFileAttributesW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,?,?,005DADE5,?,00000001,00000000), ref: 005D9AE1
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,005DADE5,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 005D9AEB
                                                                                                                                                                                                                        • CopyFileExW.KERNEL32(00000000,00000000,005D993C,00000000,00000020,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000), ref: 005D9B39
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,005DADE5,?,00000001,00000000,00000000,00000000,00000001,00000000), ref: 005D9B68
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorFileLast$AttributesCopy
                                                                                                                                                                                                                        • String ID: BA aborted copy of payload from: '%ls' to: %ls.$Failed attempt to copy payload from: '%ls' to: %ls.$Failed to clear readonly bit on payload destination path: %ls$apply.cpp$copy
                                                                                                                                                                                                                        • API String ID: 1969131206-836986073
                                                                                                                                                                                                                        • Opcode ID: e9ed652c01b21a19a0c801d89f36e9472375ec505cf06481a88127af8552f606
                                                                                                                                                                                                                        • Instruction ID: 7319f00cba4c7d381b1da7c797b7130ecd124c8bcf51ed5c1318f8088366e2c1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e9ed652c01b21a19a0c801d89f36e9472375ec505cf06481a88127af8552f606
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2131F571B40216BBFB249A69DC45EBBBB9DFF40740B11412BBC05E7291E725DE00C6E1
                                                                                                                                                                                                                        Function 005F6ACD Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 116COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,74DEDFD0,000000FF,name,000000FF,74DEDFD0,?,74DEDFD0,?,74DEDFD0), ref: 005F6B2B
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,000000FF,000000FF,email,000000FF), ref: 005F6B48
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F6B86
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F6BCD
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: String$CompareFree
                                                                                                                                                                                                                        • String ID: 9q_$email$name$uri
                                                                                                                                                                                                                        • API String ID: 3589242889-3757664207
                                                                                                                                                                                                                        • Opcode ID: ecf1dc1caafc333d566682c079363cd663ed0f3f7bb72d503b2e219485f740e9
                                                                                                                                                                                                                        • Instruction ID: 30b8abc152f6946b428ac08a562d24c76dc26badaaabc675767fbf4052625f75
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ecf1dc1caafc333d566682c079363cd663ed0f3f7bb72d503b2e219485f740e9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A8413B35A0521DBBDB11DBA4CC55FAEBBB5FF04720F2042A5EA21EB290C7359E44DB90
                                                                                                                                                                                                                        Function 005CE05E Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • LoadBitmapW.USER32(?,00000001), ref: 005CE094
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005CE0A0
                                                                                                                                                                                                                        • GetObjectW.GDI32(00000000,00000018,?), ref: 005CE0E7
                                                                                                                                                                                                                        • GetCursorPos.USER32(?), ref: 005CE108
                                                                                                                                                                                                                        • MonitorFromPoint.USER32(?,?,00000002), ref: 005CE11A
                                                                                                                                                                                                                        • GetMonitorInfoW.USER32(00000000,?), ref: 005CE130
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Monitor$BitmapCursorErrorFromInfoLastLoadObjectPoint
                                                                                                                                                                                                                        • String ID: ($Failed to load splash screen bitmap.$splashscreen.cpp
                                                                                                                                                                                                                        • API String ID: 2342928100-598475503
                                                                                                                                                                                                                        • Opcode ID: ffad4f34fb8ea551cbd91b1c1a7fc4ea98c51db9f0119969cc80e98f14032f04
                                                                                                                                                                                                                        • Instruction ID: 7534154a9e905cb38e19650187b4197414f3564905448a9811ee5405c753f0d0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ffad4f34fb8ea551cbd91b1c1a7fc4ea98c51db9f0119969cc80e98f14032f04
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EF313071A40209DFDB10DFB8D94AA9EBBF5FB08710F148519F904EB281DB74D905CBA0
                                                                                                                                                                                                                        Function 005BC7DF Relevance: 15.8, APIs: 2, Strings: 7, Instructions: 97fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005BCC57: CompareStringW.KERNEL32(0000007F,00000000,00000000,000000FF,005BE336,000000FF,00000000,00000000,005BE336,?,?,005BDADD,?,?,?,?), ref: 005BCC82
                                                                                                                                                                                                                        • CreateFileW.KERNEL32(E9005FBA,80000000,00000005,00000000,00000003,08000000,00000000,005B52BD,005FB450,00000000,005B53B5,04680A79,?,005B52B5,00000000,005B5381), ref: 005BC84F
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,005C75F7,005B5565,005B5371,005B5371,00000000,?,005B5381,FFF9E89D,005B5381,005B53B5,005B533D,?,005B533D), ref: 005BC894
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CompareCreateErrorFileLastString
                                                                                                                                                                                                                        • String ID: =S[$=S[$Failed to find payload for catalog file.$Failed to get catalog local file path$Failed to open catalog in working path: %ls$Failed to verify catalog signature: %ls$catalog.cpp
                                                                                                                                                                                                                        • API String ID: 1774366664-375656653
                                                                                                                                                                                                                        • Opcode ID: 3e32669028dd23d808f39a3ce98ffeb576ebfd20847b4dc14bbaad98ab950528
                                                                                                                                                                                                                        • Instruction ID: 225ed071e805461734f2e4b1c22ab9fe49a7c70b9c75b0052e4a8eeff12a3b7f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3e32669028dd23d808f39a3ce98ffeb576ebfd20847b4dc14bbaad98ab950528
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3531E431A0061ABFD7119B64CC46FA9BFA4FF04710F108129F908EB690E770BD509BD4
                                                                                                                                                                                                                        Function 005B64B6 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 93COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetSystemWow64DirectoryW.KERNEL32(?,00000104), ref: 005B64F7
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B6505
                                                                                                                                                                                                                        • GetSystemDirectoryW.KERNEL32(?,00000104), ref: 005B6546
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B6550
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • variable.cpp, xrefs: 005B6535, 005B6574
                                                                                                                                                                                                                        • Failed to set system folder variant value., xrefs: 005B65BE
                                                                                                                                                                                                                        • Failed to backslash terminate system folder., xrefs: 005B65A2
                                                                                                                                                                                                                        • Failed to get 32-bit system folder., xrefs: 005B653F
                                                                                                                                                                                                                        • Failed to get 64-bit system folder., xrefs: 005B657E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: DirectoryErrorLastSystem$Wow64
                                                                                                                                                                                                                        • String ID: Failed to backslash terminate system folder.$Failed to get 32-bit system folder.$Failed to get 64-bit system folder.$Failed to set system folder variant value.$variable.cpp
                                                                                                                                                                                                                        • API String ID: 2634638900-1590374846
                                                                                                                                                                                                                        • Opcode ID: 6f1d3849b2e376045987c5c1eb0e64dff402995e1ed6471ffaa6639e3f50f73c
                                                                                                                                                                                                                        • Instruction ID: e49c183a92bf221bc1bf1554f4687dae35d8303c9eac7d896da256ca077feed4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6f1d3849b2e376045987c5c1eb0e64dff402995e1ed6471ffaa6639e3f50f73c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F321D7B1A41339A6EB3067659C09BFA3EE8BB40750F114166FD09E71C0EA68AE04C6E1
                                                                                                                                                                                                                        Function 005C4ED2 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 84COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,00000000,?,?,005FB4F0), ref: 005C4EDB
                                                                                                                                                                                                                        • GetProcessId.KERNEL32(000000FF,?,?,open,00000000,00000000,?,000000FF,?,?), ref: 005C4F79
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000), ref: 005C4F92
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Process$CloseCurrentHandle
                                                                                                                                                                                                                        • String ID: -q -%ls %ls %ls %u$Failed to allocate parameters for elevated process.$Failed to launch elevated child process: %ls$burn.elevated$open$runas
                                                                                                                                                                                                                        • API String ID: 2815245435-1352204306
                                                                                                                                                                                                                        • Opcode ID: 91ebf087dbfc56761711dd7cef12db5f29ff1131bdb117856794c3f5af324d55
                                                                                                                                                                                                                        • Instruction ID: 3db1296df2a33b8f2e1806fa24b831b417e380268fff1eb2c4ff54e36fb14391
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 91ebf087dbfc56761711dd7cef12db5f29ff1131bdb117856794c3f5af324d55
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4B2146B5E00209BFDB15AF94C895DAEBFB9FF08350B10816EFA04A2240DB759E10DB90
                                                                                                                                                                                                                        Function 005B671C Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 74libraryloaderCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(msi,DllGetVersion), ref: 005B6746
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 005B674D
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B6757
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to set variant value., xrefs: 005B67C3
                                                                                                                                                                                                                        • variable.cpp, xrefs: 005B677B
                                                                                                                                                                                                                        • msi, xrefs: 005B673D
                                                                                                                                                                                                                        • DllGetVersion, xrefs: 005B6738
                                                                                                                                                                                                                        • Failed to get msi.dll version info., xrefs: 005B679F
                                                                                                                                                                                                                        • Failed to find DllGetVersion entry point in msi.dll., xrefs: 005B6785
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressErrorHandleLastModuleProc
                                                                                                                                                                                                                        • String ID: DllGetVersion$Failed to find DllGetVersion entry point in msi.dll.$Failed to get msi.dll version info.$Failed to set variant value.$msi$variable.cpp
                                                                                                                                                                                                                        • API String ID: 4275029093-842451892
                                                                                                                                                                                                                        • Opcode ID: 120b0ba8a94feb68b58d4fbb3f5c289a935c50f3cac090f9987d7155f4fb5d5c
                                                                                                                                                                                                                        • Instruction ID: 9ee23ac5176844fdd6857a90aa6c82f2405dfa370f800e4ed6e56a7ed1e488d5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 120b0ba8a94feb68b58d4fbb3f5c289a935c50f3cac090f9987d7155f4fb5d5c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3711DA71A01629BAE720AB79DC45ABF7FE8FB04714F000529FE05F7180DE68AD0492F1
                                                                                                                                                                                                                        Function 005B1174 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 53libraryloadermemoryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,005B111A,cabinet.dll,00000009,?,?,00000000), ref: 005B1185
                                                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,005B111A,cabinet.dll,00000009,?,?,00000000), ref: 005B1190
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 005B119E
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,005B111A,cabinet.dll,00000009,?,?,00000000), ref: 005B11B9
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 005B11C1
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,005B111A,cabinet.dll,00000009,?,?,00000000), ref: 005B11D6
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressErrorLastProc$HandleHeapInformationModule
                                                                                                                                                                                                                        • String ID: SetDefaultDllDirectories$SetDllDirectoryW$kernel32
                                                                                                                                                                                                                        • API String ID: 3104334766-1824683568
                                                                                                                                                                                                                        • Opcode ID: 157bc9283e0acbb336a45139a2e9423f9bc5b85648c5b76288badd62b888a48f
                                                                                                                                                                                                                        • Instruction ID: aa9934690bd1d11b07907841f04a839df87e70c40de814b4c672adaa8d01df82
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 157bc9283e0acbb336a45139a2e9423f9bc5b85648c5b76288badd62b888a48f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1E019271600619FAAB206BAADC0ADBB7F5CFB547917408011FA15D2140DF79EA05DBB4
                                                                                                                                                                                                                        Function 005CF3E6 Relevance: 15.2, APIs: 2, Strings: 8, Instructions: 155COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(?), ref: 005CF3FB
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(?), ref: 005CF576
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to set download user., xrefs: 005CF4FE
                                                                                                                                                                                                                        • UX did not provide container or payload id., xrefs: 005CF565
                                                                                                                                                                                                                        • Engine is active, cannot change engine state., xrefs: 005CF415
                                                                                                                                                                                                                        • UX requested unknown payload with id: %ls, xrefs: 005CF450
                                                                                                                                                                                                                        • UX requested unknown container with id: %ls, xrefs: 005CF4A0
                                                                                                                                                                                                                        • Failed to set download URL., xrefs: 005CF4D5
                                                                                                                                                                                                                        • Failed to set download password., xrefs: 005CF524
                                                                                                                                                                                                                        • UX denied while trying to set download URL on embedded payload: %ls, xrefs: 005CF466
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                        • String ID: Engine is active, cannot change engine state.$Failed to set download URL.$Failed to set download password.$Failed to set download user.$UX denied while trying to set download URL on embedded payload: %ls$UX did not provide container or payload id.$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
                                                                                                                                                                                                                        • API String ID: 3168844106-2615595102
                                                                                                                                                                                                                        • Opcode ID: 0dabff3716c9861f25ad2bf54ab24473df005d8b179526c3fee27109e0c68d0c
                                                                                                                                                                                                                        • Instruction ID: b2694868b7063185d2cab6955480d52d7b424f8ff429be2741e5ed62d5f4b9b0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0dabff3716c9861f25ad2bf54ab24473df005d8b179526c3fee27109e0c68d0c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5E41D472A00616AFDB159FA4C849F6B7F6AFF40710F15817AEA0597280EB74ED40C7A0
                                                                                                                                                                                                                        Function 005CA998 Relevance: 15.1, APIs: 2, Strings: 8, Instructions: 138COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,000000FF,00AAC56B,?,005B52B5,00000000,=S[), ref: 005CAA90
                                                                                                                                                                                                                        • GetLastError.KERNEL32(00000000,00000000,00000000,00000000,?,000000FF,00AAC56B,?,005B52B5,00000000,=S[), ref: 005CAAD4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to get signer chain from authenticode certificate., xrefs: 005CAB02
                                                                                                                                                                                                                        • Failed authenticode verification of payload: %ls, xrefs: 005CAA71
                                                                                                                                                                                                                        • qS[qS[, xrefs: 005CA9B1
                                                                                                                                                                                                                        • Failed to verify expected payload against actual certificate chain., xrefs: 005CAB1A
                                                                                                                                                                                                                        • Failed to get provider state from authenticode certificate., xrefs: 005CAABE
                                                                                                                                                                                                                        • =S[, xrefs: 005CA9A8
                                                                                                                                                                                                                        • cache.cpp, xrefs: 005CAA66, 005CAAB4, 005CAAF8
                                                                                                                                                                                                                        • =S[, xrefs: 005CA9AB
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast
                                                                                                                                                                                                                        • String ID: =S[$=S[$Failed authenticode verification of payload: %ls$Failed to get provider state from authenticode certificate.$Failed to get signer chain from authenticode certificate.$Failed to verify expected payload against actual certificate chain.$cache.cpp$qS[qS[
                                                                                                                                                                                                                        • API String ID: 1452528299-3794415294
                                                                                                                                                                                                                        • Opcode ID: a16bc974c2b0ee9780b3dc1d59c59c87e13029529eb84999e05184f30541d4be
                                                                                                                                                                                                                        • Instruction ID: bbd93899b6861ac2e5f43f24a64af03e829570da614688860f3e7a5e30bbd039
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a16bc974c2b0ee9780b3dc1d59c59c87e13029529eb84999e05184f30541d4be
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EB4194B1E40219ABEB159BA9CD45FEF7FE9FB48310F01012AF905F7281EB749904C6A5
                                                                                                                                                                                                                        Function 005F5916 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 194filememoryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateFileW.KERNEL32(000000FF,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,00000000,00000000,00000078,00000000,000000FF,?,00000000,00000000), ref: 005F5955
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005F5963
                                                                                                                                                                                                                        • VirtualAlloc.KERNEL32(00000000,00010000,00003000,00000004), ref: 005F59A4
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005F59B1
                                                                                                                                                                                                                        • VirtualFree.KERNEL32(?,00000000,00008000), ref: 005F5B26
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?), ref: 005F5B35
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLastVirtual$AllocCloseCreateFileFreeHandle
                                                                                                                                                                                                                        • String ID: GET$dlutil.cpp
                                                                                                                                                                                                                        • API String ID: 2028584396-3303425918
                                                                                                                                                                                                                        • Opcode ID: ad0d8d494044664402e7d616c22389a94bb2d3e46301692e1478cfe58de4848f
                                                                                                                                                                                                                        • Instruction ID: 060224f0d2a9f4ab4388d78f9c7d45869757e48ca769584e87a3054c4d713f41
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ad0d8d494044664402e7d616c22389a94bb2d3e46301692e1478cfe58de4848f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A8614671A0061AABDB11DFA8CC84BFE7EB9BF48351F114219FF05A6250E7789950DBA0
                                                                                                                                                                                                                        Function 005C0AAE Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 182COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005C0E7E: CompareStringW.KERNEL32(00000000,00000000,feclient.dll,000000FF,00000000,000000FF,00000000,00000000,?,?,005C0ACD,?,00000000,?,00000000,00000000), ref: 005C0EAD
                                                                                                                                                                                                                        • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,00000000,?,00000000,?,00000000,00000001,?,?,00000000,?,00000000), ref: 005C0C51
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005C0C5E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to append cache action., xrefs: 005C0BA8
                                                                                                                                                                                                                        • plan.cpp, xrefs: 005C0C82
                                                                                                                                                                                                                        • Failed to append package start action., xrefs: 005C0AF3
                                                                                                                                                                                                                        • Failed to create syncpoint event., xrefs: 005C0C8C
                                                                                                                                                                                                                        • Failed to append payload cache action., xrefs: 005C0C08
                                                                                                                                                                                                                        • Failed to append rollback cache action., xrefs: 005C0B2D
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CompareCreateErrorEventLastString
                                                                                                                                                                                                                        • String ID: Failed to append cache action.$Failed to append package start action.$Failed to append payload cache action.$Failed to append rollback cache action.$Failed to create syncpoint event.$plan.cpp
                                                                                                                                                                                                                        • API String ID: 801187047-2489563283
                                                                                                                                                                                                                        • Opcode ID: 6f2750ee409da0b21cd80494c0cd3fbf8301460718de4b94b2c4e641fd0f7e1b
                                                                                                                                                                                                                        • Instruction ID: 5fcb9887f6a6eac856668471bd95eccf3c52f6f03d606e346ce7dd5d9748a958
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6f2750ee409da0b21cd80494c0cd3fbf8301460718de4b94b2c4e641fd0f7e1b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 80618C79500605EFDB05DFA8C884EAABBF9FF84314F21945EE8059B281EB30EE41DB50
                                                                                                                                                                                                                        Function 005B9DB4 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 147COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 005B9DDA
                                                                                                                                                                                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 005B9DFF
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to get component path: %d, xrefs: 005B9E63
                                                                                                                                                                                                                        • Failed to format component id string., xrefs: 005B9DE5
                                                                                                                                                                                                                        • MsiComponentSearch failed: ID '%ls', HRESULT 0x%x, xrefs: 005B9EF3
                                                                                                                                                                                                                        • Failed to format product code string., xrefs: 005B9E0A
                                                                                                                                                                                                                        • Failed to set variable., xrefs: 005B9EE3
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Open@16
                                                                                                                                                                                                                        • String ID: Failed to format component id string.$Failed to format product code string.$Failed to get component path: %d$Failed to set variable.$MsiComponentSearch failed: ID '%ls', HRESULT 0x%x
                                                                                                                                                                                                                        • API String ID: 3613110473-1671347822
                                                                                                                                                                                                                        • Opcode ID: b36ccaacb14cdf05b5fe5ded3d58cc7f0f9b6af184587e99cf63b3761438a61e
                                                                                                                                                                                                                        • Instruction ID: f274eb76234b8eb6e1e295a38c82c3489ee7bc71bc1e0c1e4c95bb0ad6329651
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b36ccaacb14cdf05b5fe5ded3d58cc7f0f9b6af184587e99cf63b3761438a61e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4341D47290061ABACB21DA688C46AFEBF6DFF84310F244A16F301E5191D734FE50D6A2
                                                                                                                                                                                                                        Function 005CD01A Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 117threadCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateThread.KERNEL32(00000000,00000000,005CAB3C,?,00000000,00000000), ref: 005CD0B8
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?), ref: 005CD0C4
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,00000000,?,?,005CC59C,00000001,?,?,?,?,?,00000000,00000000,?,?,?), ref: 005CD145
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseCreateErrorHandleLastThread
                                                                                                                                                                                                                        • String ID: Failed to create elevated cache thread.$Failed to pump messages in child process.$LD[$^S[$elevation.cpp
                                                                                                                                                                                                                        • API String ID: 747004058-550049182
                                                                                                                                                                                                                        • Opcode ID: 3334e8ce02c2962c4ae85be633094ee90d44922e168472830b186394eb0d4a07
                                                                                                                                                                                                                        • Instruction ID: 29e9bcb066ac40312330d67a1ebb0201c5d16b53fbdbcf23a41c2dd841ad19c8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3334e8ce02c2962c4ae85be633094ee90d44922e168472830b186394eb0d4a07
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4D41B4B5E01219AF9B04DFA9D8859EEBBF9FF48350F10412AF909E7340D774A941CBA4
                                                                                                                                                                                                                        Function 005C473A Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 115fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,?,00000008,?,00000000,?,00000000,00000000,?,00000000,@G[,?,?,00000000,?,00000000), ref: 005C4765
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005C4772
                                                                                                                                                                                                                        • ReadFile.KERNEL32(?,00000000,?,?,00000000,?,00000000), ref: 005C481B
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005C4825
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorFileLastRead
                                                                                                                                                                                                                        • String ID: Failed to allocate data for message.$Failed to read data for message.$Failed to read message from pipe.$pipe.cpp
                                                                                                                                                                                                                        • API String ID: 1948546556-3912962418
                                                                                                                                                                                                                        • Opcode ID: e4a491c9ec5a8b0c8fcaf34197502d808753f0ac7315adc271dab730b280b14c
                                                                                                                                                                                                                        • Instruction ID: 5675fd9caf31d804ee202a509b603d6eac979136970003c1ab6c42599e11e6ed
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e4a491c9ec5a8b0c8fcaf34197502d808753f0ac7315adc271dab730b280b14c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3031D871A40226BFEB109FA5DC59FABBBA9FB05711F118129F805E6180EB759E00CBD0
                                                                                                                                                                                                                        Function 005BF2DC Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 109stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 005BF315
                                                                                                                                                                                                                          • Part of subcall function 005B4013: CreateDirectoryW.KERNELBASE(005B533D,005B53B5,00000000,00000000,?,005C9EE4,00000000,00000000,005B533D,00000000,005B52B5,00000000,?,=S[,005BD4AC,=S[), ref: 005B4021
                                                                                                                                                                                                                          • Part of subcall function 005B4013: GetLastError.KERNEL32(?,005C9EE4,00000000,00000000,005B533D,00000000,005B52B5,00000000,?,=S[,005BD4AC,=S[,00000000,00000000), ref: 005B402F
                                                                                                                                                                                                                        • lstrlenA.KERNEL32(005FB4F0,00000000,00000094,00000000,00000094,?,?,005C0328,swidtag,00000094,?,005FB508,005C0328,00000000,?,00000000), ref: 005BF368
                                                                                                                                                                                                                          • Part of subcall function 005F4C67: CreateFileW.KERNEL32(005FB4F0,40000000,00000001,00000000,00000002,00000080,00000000,005C0328,00000000,?,005BF37F,?,00000080,005FB4F0,00000000), ref: 005F4C7F
                                                                                                                                                                                                                          • Part of subcall function 005F4C67: GetLastError.KERNEL32(?,005BF37F,?,00000080,005FB4F0,00000000,?,005C0328,?,00000094,?,?,?,?,?,00000000), ref: 005F4C8C
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to allocate regid file path., xrefs: 005BF3C0
                                                                                                                                                                                                                        • swidtag, xrefs: 005BF328
                                                                                                                                                                                                                        • Failed to allocate regid folder path., xrefs: 005BF3C7
                                                                                                                                                                                                                        • Failed to create regid folder: %ls, xrefs: 005BF3B0
                                                                                                                                                                                                                        • Failed to write tag xml to file: %ls, xrefs: 005BF3A6
                                                                                                                                                                                                                        • Failed to format tag folder path., xrefs: 005BF3CE
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CreateErrorLast$DirectoryFileOpen@16lstrlen
                                                                                                                                                                                                                        • String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to create regid folder: %ls$Failed to format tag folder path.$Failed to write tag xml to file: %ls$swidtag
                                                                                                                                                                                                                        • API String ID: 904508749-1201533908
                                                                                                                                                                                                                        • Opcode ID: 562bbe6696d96a95a6739a35801d40bde18e6658f32f5938010b23b77673d3de
                                                                                                                                                                                                                        • Instruction ID: 38d946bbad716455f51c1d8583177a4775dc7e68569efbb132db30bce16f5490
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 562bbe6696d96a95a6739a35801d40bde18e6658f32f5938010b23b77673d3de
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2A315E32D4061ABFCB119BA4DC45BEEBFB5BF04710F108576EA00AA191D775AA50AB90
                                                                                                                                                                                                                        Function 005C51E9 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 90synchronizationCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,0002BF20,?,F0000003,00000000,00000000,?,00000000,00000000,00000000,005B5386,00000000,00000000,?,00000000), ref: 005C5292
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,005B4B5B,?,?,00000000,?,?,?,?,?,?,005FB490,?,?), ref: 005C529D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to wait for child process exit., xrefs: 005C52CB
                                                                                                                                                                                                                        • Failed to write exit code to message buffer., xrefs: 005C520D
                                                                                                                                                                                                                        • pipe.cpp, xrefs: 005C52C1
                                                                                                                                                                                                                        • Failed to post terminate message to child process., xrefs: 005C527D
                                                                                                                                                                                                                        • Failed to write restart to message buffer., xrefs: 005C5235
                                                                                                                                                                                                                        • Failed to post terminate message to child process cache thread., xrefs: 005C5261
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLastObjectSingleWait
                                                                                                                                                                                                                        • String ID: Failed to post terminate message to child process cache thread.$Failed to post terminate message to child process.$Failed to wait for child process exit.$Failed to write exit code to message buffer.$Failed to write restart to message buffer.$pipe.cpp
                                                                                                                                                                                                                        • API String ID: 1211598281-2161881128
                                                                                                                                                                                                                        • Opcode ID: 6d74f6be491a935d754e791d845f52c5556da005880ecc6bd52ab82a8bc6877e
                                                                                                                                                                                                                        • Instruction ID: ae5cffcdc78d3d8d3630ea54d2a1c90d946cecac50d1f336cc33a3cac31558f9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6d74f6be491a935d754e791d845f52c5556da005880ecc6bd52ab82a8bc6877e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7821C576940A29BFDB1656D49C05F9F7FE9FB00721F110219F900A6190EB35AD90D7E0
                                                                                                                                                                                                                        Function 005C8E92 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 88fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateFileW.KERNEL32(00000000,80000000,00000005,00000000,00000003,08000000,00000000,00000000,00000101,?,005C9CFF,00000003,000007D0,00000003,?,000007D0), ref: 005C8EAC
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005C9CFF,00000003,000007D0,00000003,?,000007D0,00000000,000007D0,00000000,00000003,00000000,00000003,000007D0,00000000,-00000004), ref: 005C8EB9
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,005C9CFF,00000003,000007D0,00000003,?,000007D0,00000000,000007D0,00000000,00000003,00000000,00000003,000007D0,00000000), ref: 005C8F80
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to verify catalog signature of payload: %ls, xrefs: 005C8F47
                                                                                                                                                                                                                        • Failed to open payload at path: %ls, xrefs: 005C8EFC
                                                                                                                                                                                                                        • Failed to verify hash of payload: %ls, xrefs: 005C8F6B
                                                                                                                                                                                                                        • cache.cpp, xrefs: 005C8EEF
                                                                                                                                                                                                                        • Failed to verify signature of payload: %ls, xrefs: 005C8F28
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                        • String ID: Failed to open payload at path: %ls$Failed to verify catalog signature of payload: %ls$Failed to verify hash of payload: %ls$Failed to verify signature of payload: %ls$cache.cpp
                                                                                                                                                                                                                        • API String ID: 2528220319-2757871984
                                                                                                                                                                                                                        • Opcode ID: 43c97e50f4567d4f00d2ddfdbd94847559e41493be73cde54528ef641222c3b0
                                                                                                                                                                                                                        • Instruction ID: c43ee5981452c4d1e3108e5cd54bc2ceb0869db188bed7766fb4226b3770fc25
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 43c97e50f4567d4f00d2ddfdbd94847559e41493be73cde54528ef641222c3b0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6D21E535A40625BFD7222AA48C4DF7B7F2ABF05760F15421DFD00652D0DB35AD60EAD1
                                                                                                                                                                                                                        Function 005B69B8 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 86COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 005B6A03
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B6A0D
                                                                                                                                                                                                                        • GetVolumePathNameW.KERNEL32(?,?,00000104), ref: 005B6A51
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B6A5B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$DirectoryNamePathVolumeWindows
                                                                                                                                                                                                                        • String ID: Failed to get volume path name.$Failed to get windows directory.$Failed to set variant value.$variable.cpp
                                                                                                                                                                                                                        • API String ID: 124030351-4026719079
                                                                                                                                                                                                                        • Opcode ID: 03c4e4918313546ba841a63c2d76591fa557f514244c80ba6134139a35d599c8
                                                                                                                                                                                                                        • Instruction ID: 8bae765eb8f8a7f7f8444ec8b251441b51f8b83bc6b86b465e1488122dfad93b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 03c4e4918313546ba841a63c2d76591fa557f514244c80ba6134139a35d599c8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E321EC72A00329A7EB20A6649D09FEB7BECFB44710F014167BE05F7181D638AD44C6A5
                                                                                                                                                                                                                        Function 005B9B3F Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 86COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 005B9B5A
                                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,00000100), ref: 005B9B72
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B9B81
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to format variable string., xrefs: 005B9B65
                                                                                                                                                                                                                        • search.cpp, xrefs: 005B9BB3
                                                                                                                                                                                                                        • Failed get to file attributes. '%ls', xrefs: 005B9BC0
                                                                                                                                                                                                                        • File search: %ls, did not find path: %ls, xrefs: 005B9BD5
                                                                                                                                                                                                                        • Failed to set variable., xrefs: 005B9C07
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AttributesErrorFileLastOpen@16
                                                                                                                                                                                                                        • String ID: Failed get to file attributes. '%ls'$Failed to format variable string.$Failed to set variable.$File search: %ls, did not find path: %ls$search.cpp
                                                                                                                                                                                                                        • API String ID: 1811509786-2053429945
                                                                                                                                                                                                                        • Opcode ID: f9cf19763a59ed1015a0b5629e5f88d96ca5331a8aafc119c68368e90bfa9cd4
                                                                                                                                                                                                                        • Instruction ID: a2927877533be140b7214a65aa44bcb7317b44ad6bb0f43ef38ad8b93e1c5e5d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f9cf19763a59ed1015a0b5629e5f88d96ca5331a8aafc119c68368e90bfa9cd4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B5212932E40219BBDB1166A49D07AFEBF6AFF55310F204215FA00E5191E774BE50D6E1
                                                                                                                                                                                                                        Function 005CAB3C Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • TlsSetValue.KERNEL32(?,?), ref: 005CAB53
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005CAB5D
                                                                                                                                                                                                                        • CoInitializeEx.OLE32(00000000,00000000), ref: 005CAB9C
                                                                                                                                                                                                                        • CoUninitialize.OLE32(?,005CC4F4,?,?), ref: 005CABD9
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to pump messages in child process., xrefs: 005CABC7
                                                                                                                                                                                                                        • Failed to set elevated cache pipe into thread local storage for logging., xrefs: 005CAB8B
                                                                                                                                                                                                                        • elevation.cpp, xrefs: 005CAB81
                                                                                                                                                                                                                        • Failed to initialize COM., xrefs: 005CABA8
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorInitializeLastUninitializeValue
                                                                                                                                                                                                                        • String ID: Failed to initialize COM.$Failed to pump messages in child process.$Failed to set elevated cache pipe into thread local storage for logging.$elevation.cpp
                                                                                                                                                                                                                        • API String ID: 876858697-113251691
                                                                                                                                                                                                                        • Opcode ID: 211e907eafea0c7b05d367e968048816c3bf97d0f0ad4100b019ca77174daeec
                                                                                                                                                                                                                        • Instruction ID: 3471fdda66afc1dd59658166e74fd8359c289ffb55b39689e52cb0f5460a1c42
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 211e907eafea0c7b05d367e968048816c3bf97d0f0ad4100b019ca77174daeec
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1E112772A40229BFA71157A9DC09EABBFA9FF00720B01411AFD04F3140DB695C00E6D1
                                                                                                                                                                                                                        Function 005B5BF0 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 54registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005F0E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,005F5699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 005F0E52
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 005B5C77
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseOpen
                                                                                                                                                                                                                        • String ID: +$CommonFilesDir$Failed to ensure path was backslash terminated.$Failed to open Windows folder key.$Failed to read folder path for '%ls'.$ProgramFilesDir$SOFTWARE\Microsoft\Windows\CurrentVersion
                                                                                                                                                                                                                        • API String ID: 47109696-3209209246
                                                                                                                                                                                                                        • Opcode ID: 20d77e38822de9171fe851b315d9a83808f027fc6173d391de942b22dbbd4850
                                                                                                                                                                                                                        • Instruction ID: f8dcd7b136b568c6878d72fd3b32baf77a1bc8a1df6f165c0d392958a545dc63
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 20d77e38822de9171fe851b315d9a83808f027fc6173d391de942b22dbbd4850
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D601D632A4062DB7CB165A549D06FEE7F7AFB40750F140165FA00B6141EA78AE10E6A4
                                                                                                                                                                                                                        Function 005E6A76 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 305COMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: __alldvrm$_strrchr
                                                                                                                                                                                                                        • String ID: &.^$&.^$&.^
                                                                                                                                                                                                                        • API String ID: 1036877536-289038333
                                                                                                                                                                                                                        • Opcode ID: f3a74c95afe91129e83f4a200ae329e72b68e1b987d16e4549aa364eb4fd1ab8
                                                                                                                                                                                                                        • Instruction ID: bbc22c14d7a3e070a4486d7394c1c750d70dcc3ed472c0e15a26d684a6932c8e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f3a74c95afe91129e83f4a200ae329e72b68e1b987d16e4549aa364eb4fd1ab8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: ECA12472A007C69FDB298F2AC8917AEBFE5FF613D0F2441A9E5C59B281C2389D41C751
                                                                                                                                                                                                                        Function 005DA024 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 172COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SetFileAttributesW.KERNEL32(?,00000000,?,00000000,?,?,?,00000001,00000000,?), ref: 005DA0F1
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000001,00000000,?), ref: 005DA0FB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to clear readonly bit on payload destination path: %ls, xrefs: 005DA12A
                                                                                                                                                                                                                        • Failed attempt to download URL: '%ls' to: '%ls', xrefs: 005DA1D8
                                                                                                                                                                                                                        • download, xrefs: 005DA0BB
                                                                                                                                                                                                                        • :, xrefs: 005DA174
                                                                                                                                                                                                                        • apply.cpp, xrefs: 005DA11F
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AttributesErrorFileLast
                                                                                                                                                                                                                        • String ID: :$Failed attempt to download URL: '%ls' to: '%ls'$Failed to clear readonly bit on payload destination path: %ls$apply.cpp$download
                                                                                                                                                                                                                        • API String ID: 1799206407-1905830404
                                                                                                                                                                                                                        • Opcode ID: f79d44aafd3102c2f376728afece29b00f00683404a41a93f18d5206bdd2b748
                                                                                                                                                                                                                        • Instruction ID: eca16c0393ddf7d997fd1c3ca2681cb2cbdcca99a73d4b0adef1f3922c37386e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f79d44aafd3102c2f376728afece29b00f00683404a41a93f18d5206bdd2b748
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 24518C71A00219EFDB21DFA8C844AABBBB5FF44710F10845BE915EB251E775DE40CB92
                                                                                                                                                                                                                        Function 005F6DA8 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 159COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,74DEDFD0,000000FF,type,000000FF,?,74DEDFD0,74DEDFD0,74DEDFD0), ref: 005F6DFE
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F6E49
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F6EC5
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F6F11
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: String$Free$Compare
                                                                                                                                                                                                                        • String ID: type$url
                                                                                                                                                                                                                        • API String ID: 1324494773-1247773906
                                                                                                                                                                                                                        • Opcode ID: 67ae3f61c3eff9ca060be76752927dd2afb75e060eab0ed1989cda6d43e947df
                                                                                                                                                                                                                        • Instruction ID: 1dc0771e568bebbbef28dee01172c6a1e5bb36e05e59a586258cfa9b1dbee11f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 67ae3f61c3eff9ca060be76752927dd2afb75e060eab0ed1989cda6d43e947df
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7751687690121DFBCF11DBA4C848EBEBBB8BF04710F1042A9EA11EB1A4D7399E04DB50
                                                                                                                                                                                                                        Function 005F837F Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 156COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: GetProcessHeap.KERNEL32(?,000001C7,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38E5
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: RtlAllocateHeap.NTDLL(00000000,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38EC
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,http://appsyndication.org/2006/appsyn,000000FF,00000010,00000001,00000000,00000000,00000000,?,?,005D8E1F,000002C0,00000100), ref: 005F83AD
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,?,000000FF,application,000000FF,?,?,005D8E1F,000002C0,00000100,000002C0,000002C0,00000100,000002C0,00000410), ref: 005F83C8
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CompareHeapString$AllocateProcess
                                                                                                                                                                                                                        • String ID: application$apuputil.cpp$http://appsyndication.org/2006/appsyn$type
                                                                                                                                                                                                                        • API String ID: 2664528157-4206478990
                                                                                                                                                                                                                        • Opcode ID: 0c079ef584742a9776974cda7b6f5c43de1a94e50b4be4cac85bca03dc087101
                                                                                                                                                                                                                        • Instruction ID: 001d8267cbd397adafb315355b2bc16c2696bf4ec77332ba3b5984b5aa46fa9f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0c079ef584742a9776974cda7b6f5c43de1a94e50b4be4cac85bca03dc087101
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FD51B17164460ABBEF208F14CC85F7A7BA5BB44720F208214FA69EB2D1DB78E940DB10
                                                                                                                                                                                                                        Function 005F635A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 152fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005F63B7
                                                                                                                                                                                                                        • DeleteFileW.KERNEL32(00000000,00000000,00000000,?,?,00000078,000000FF,00000000,?,?,?,00000078,000000FF,?,?,00000078), ref: 005F64AE
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(000000FF,00000000,00000000,?,?,00000078,000000FF,00000000,?,?,?,00000078,000000FF,?,?,00000078), ref: 005F64BD
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseDeleteErrorFileHandleLast
                                                                                                                                                                                                                        • String ID: Burn$DownloadTimeout$WiX\Burn$dlutil.cpp
                                                                                                                                                                                                                        • API String ID: 3522763407-1704223933
                                                                                                                                                                                                                        • Opcode ID: 8eb2f404ad5f5562f12a74e4409131e1c2aff2c16ac6da69150459da220a567a
                                                                                                                                                                                                                        • Instruction ID: 0e73178d3bb2e6ff8b41d9946ee4f16aad67276f29d20f60fddde736f1359148
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8eb2f404ad5f5562f12a74e4409131e1c2aff2c16ac6da69150459da220a567a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 68514C7290021DBBDF11AFA4CC89EFEBEB9FB08710F014155FA14E6190E7358A50DBA0
                                                                                                                                                                                                                        Function 005C9080 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 138COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • _memcmp.LIBVCRUNTIME ref: 005C910E
                                                                                                                                                                                                                          • Part of subcall function 005F5587: GetLastError.KERNEL32(?,?,005C9133,?,00000003,00000000,?), ref: 005F55A6
                                                                                                                                                                                                                        • _memcmp.LIBVCRUNTIME ref: 005C9148
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005C91C2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to read certificate thumbprint., xrefs: 005C91B6
                                                                                                                                                                                                                        • Failed to find expected public key in certificate chain., xrefs: 005C9183
                                                                                                                                                                                                                        • cache.cpp, xrefs: 005C91E6
                                                                                                                                                                                                                        • Failed to get certificate public key identifier., xrefs: 005C91F0
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast_memcmp
                                                                                                                                                                                                                        • String ID: Failed to find expected public key in certificate chain.$Failed to get certificate public key identifier.$Failed to read certificate thumbprint.$cache.cpp
                                                                                                                                                                                                                        • API String ID: 3428363238-3408201827
                                                                                                                                                                                                                        • Opcode ID: 3be55e73e6c6f3e8073c2bdfb30b76995930905df17b40d1ba74838c3d64b174
                                                                                                                                                                                                                        • Instruction ID: 3dc0ee6665a235a700fb5d0cebb5855e93f90e099a6f3b7c56bada46ef33fd1d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3be55e73e6c6f3e8073c2bdfb30b76995930905df17b40d1ba74838c3d64b174
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AB413071E00216AFDB10DFA9C84AFAABBF9FB08750F05412AF905E7251D675ED04CBA4
                                                                                                                                                                                                                        Function 005C0419 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 133registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,?,00000000,?), ref: 005C054A
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,?,?,00000000,?), ref: 005C0559
                                                                                                                                                                                                                          • Part of subcall function 005F0AD5: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,005C0491,?,00000000,00020006), ref: 005F0AFA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to update resume mode., xrefs: 005C052E
                                                                                                                                                                                                                        • %ls.RebootRequired, xrefs: 005C0467
                                                                                                                                                                                                                        • Failed to open registration key., xrefs: 005C0591
                                                                                                                                                                                                                        • Failed to delete registration key: %ls, xrefs: 005C04F8
                                                                                                                                                                                                                        • Failed to write volatile reboot required registry key., xrefs: 005C0495
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Close$Create
                                                                                                                                                                                                                        • String ID: %ls.RebootRequired$Failed to delete registration key: %ls$Failed to open registration key.$Failed to update resume mode.$Failed to write volatile reboot required registry key.
                                                                                                                                                                                                                        • API String ID: 359002179-2517785395
                                                                                                                                                                                                                        • Opcode ID: d77dc2dc2e9391050465d23eb443cdfd3b906bd808cd3ebd1aa6d14032291089
                                                                                                                                                                                                                        • Instruction ID: 5feda3140f0efd96950976e0b0a02d0db19f43d51caad75d54187fbd12552b3b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d77dc2dc2e9391050465d23eb443cdfd3b906bd808cd3ebd1aa6d14032291089
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2C416D31900619FFDF22AEA4DC0AFAF7FBABF80310F14542DFA4161092D775AA50EA50
                                                                                                                                                                                                                        Function 005F143C Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 123stringregistryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,00000000,00000000,BundleUpgradeCode,?,00020006,00000000,?,?,?,00000001), ref: 005F1479
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,00000000,00000000,?,00000000,00000001,00000000,00000000,BundleUpgradeCode,?,00020006,00000000,?,?,?,00000001), ref: 005F14F1
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,?,?,?,00000001), ref: 005F14FD
                                                                                                                                                                                                                        • RegSetValueExW.ADVAPI32(00020006,?,00000000,00000007,00000000,?,00000000,?,?,00000000,00000001,00000000,00000000,BundleUpgradeCode,?,00020006), ref: 005F153D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: lstrlen$Value
                                                                                                                                                                                                                        • String ID: @da$BundleUpgradeCode$regutil.cpp
                                                                                                                                                                                                                        • API String ID: 198323757-3940013353
                                                                                                                                                                                                                        • Opcode ID: 900026e9d87f9c9fce469af91e0848c691b78e6dbed1dfe8816246cd07a10352
                                                                                                                                                                                                                        • Instruction ID: 75396ae8b2a974b9b8b2c2be8f1420ee3544bc08548818785746b0c657945331
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 900026e9d87f9c9fce469af91e0848c691b78e6dbed1dfe8816246cd07a10352
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F441C132A0062AEFCF15DFA8C845AAE7FAAFF84710F114169FE01E7251DA34DD119B94
                                                                                                                                                                                                                        Function 005BF69D Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 117registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 005BF7CD
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 005BF7DA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to format pending restart registry key to read., xrefs: 005BF6D1
                                                                                                                                                                                                                        • %ls.RebootRequired, xrefs: 005BF6BA
                                                                                                                                                                                                                        • Resume, xrefs: 005BF741
                                                                                                                                                                                                                        • Failed to open registration key., xrefs: 005BF736
                                                                                                                                                                                                                        • Failed to read Resume value., xrefs: 005BF763
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Close
                                                                                                                                                                                                                        • String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
                                                                                                                                                                                                                        • API String ID: 3535843008-3890505273
                                                                                                                                                                                                                        • Opcode ID: 96f1c01f2839b2639863efc75e3b6b8cde22d2186c61d2cae1f38ffa89b83912
                                                                                                                                                                                                                        • Instruction ID: 6398da61bd05429bd168c87d5d8f1b5f2b730f8fc3c58ed497a62feb91f26cd9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 96f1c01f2839b2639863efc75e3b6b8cde22d2186c61d2cae1f38ffa89b83912
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9E416F36940119EFCB119F98CC81AEDBFB5FB05310F2581B6E914AB252D776BE40DB90
                                                                                                                                                                                                                        Function 005CA7FA Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 111COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: Failed to determine length of relative path.$Failed to determine length of source path.$Failed to set last source.$Failed to trim source folder.$WixBundleLastUsedSource
                                                                                                                                                                                                                        • API String ID: 0-660234312
                                                                                                                                                                                                                        • Opcode ID: 3a27b74f39fb19d67fe1d07ced635bb5e4cdfdac0138d9779ed364be0a106ec4
                                                                                                                                                                                                                        • Instruction ID: 3ce3fd9ed746f6366c08c0df7e79a21356b1a5c6f1efe3912654fee755c383dd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3a27b74f39fb19d67fe1d07ced635bb5e4cdfdac0138d9779ed364be0a106ec4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3831B831D4022EBFDF219AD4CC49FAE7F79BB44724F214269F920A61D1E6309E41D791
                                                                                                                                                                                                                        Function 005DD677 Relevance: 12.4, APIs: 1, Strings: 6, Instructions: 106comCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CoCreateInstance.OLE32(00610A84,00000000,00000017,00610A94,?,?,00000000,00000000,?,?,?,?,?,005DDCAE,00000000,00000000), ref: 005DD6AF
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to set progress timeout., xrefs: 005DD719
                                                                                                                                                                                                                        • Failed to create BITS job., xrefs: 005DD6E9
                                                                                                                                                                                                                        • Failed to create IBackgroundCopyManager., xrefs: 005DD6BB
                                                                                                                                                                                                                        • Failed to set notification flags for BITS job., xrefs: 005DD701
                                                                                                                                                                                                                        • Failed to set BITS job to foreground., xrefs: 005DD730
                                                                                                                                                                                                                        • WixBurn, xrefs: 005DD6DA
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CreateInstance
                                                                                                                                                                                                                        • String ID: Failed to create BITS job.$Failed to create IBackgroundCopyManager.$Failed to set BITS job to foreground.$Failed to set notification flags for BITS job.$Failed to set progress timeout.$WixBurn
                                                                                                                                                                                                                        • API String ID: 542301482-468763447
                                                                                                                                                                                                                        • Opcode ID: 3207a08abd1fa58989985121ed12e75cf497ed377936e3d9cfbd821d4752e957
                                                                                                                                                                                                                        • Instruction ID: 42368e8e3750d2855fee9f218c5f0281e3db018c813c438ab69501938bb530fd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3207a08abd1fa58989985121ed12e75cf497ed377936e3d9cfbd821d4752e957
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5F317E31A4021AAF9B25CBA8C855EBFBFB5FF48710B15055AF905EB350CA70EC41CBA1
                                                                                                                                                                                                                        Function 005F5C68 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 98fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateFileW.KERNEL32(00000000,C0000000,00000004,00000000,00000004,00000080,00000000,00000000,?,?,?,?,?,WiX\Burn,DownloadTimeout,00000078), ref: 005F5CB2
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005F5CBF
                                                                                                                                                                                                                        • ReadFile.KERNEL32(00000000,00000008,00000008,?,00000000), ref: 005F5D06
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,dlutil.cpp,000000C8,00000000), ref: 005F5D6E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: File$CloseCreateErrorHandleLastRead
                                                                                                                                                                                                                        • String ID: %ls.R$dlutil.cpp
                                                                                                                                                                                                                        • API String ID: 2136311172-657863730
                                                                                                                                                                                                                        • Opcode ID: 66261fbd220911d6bec2bcc7cb633b8cc0c865d03b805e1863427bd4c4c068ba
                                                                                                                                                                                                                        • Instruction ID: 376f2110655dae349a89717c143a8831108b71903dbf76c6f611cee7083966cf
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 66261fbd220911d6bec2bcc7cb633b8cc0c865d03b805e1863427bd4c4c068ba
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1C31B372A41A14ABEB208B68CC49BBA7AE8FB45721F114219FF05EB1D0E7745D01D7A1
                                                                                                                                                                                                                        Function 005DD12C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 92synchronizationCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,000000FF,74DF30B0,00000000,?,?,?,?,005DD439,?), ref: 005DD145
                                                                                                                                                                                                                        • ReleaseMutex.KERNEL32(?,?,?,?,005DD439,?), ref: 005DD161
                                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,000000FF), ref: 005DD1A4
                                                                                                                                                                                                                        • ReleaseMutex.KERNEL32(?), ref: 005DD1BB
                                                                                                                                                                                                                        • SetEvent.KERNEL32(?), ref: 005DD1C4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to send files in use message from netfx chainer., xrefs: 005DD20A
                                                                                                                                                                                                                        • Failed to get message from netfx chainer., xrefs: 005DD1E5
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: MutexObjectReleaseSingleWait$Event
                                                                                                                                                                                                                        • String ID: Failed to get message from netfx chainer.$Failed to send files in use message from netfx chainer.
                                                                                                                                                                                                                        • API String ID: 2608678126-3424578679
                                                                                                                                                                                                                        • Opcode ID: 4b48429ef4de63b76f641ef18042c181bc017695f475d4505d074406091e8945
                                                                                                                                                                                                                        • Instruction ID: 74f6f249db1b7339ff234b993462ffd37f3db64463a4791c4179e2376fb069e4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4b48429ef4de63b76f641ef18042c181bc017695f475d4505d074406091e8945
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EA31E43190060AEFDB229FA8CC48EAEBFB5FF54320F148666F515E6261C734D944DBA0
                                                                                                                                                                                                                        Function 005F082D Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 89processCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateProcessW.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 005F089A
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 005F08A4
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?,?,?,00000000,00000000,00000000), ref: 005F08ED
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 005F08FA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseHandle$CreateErrorLastProcess
                                                                                                                                                                                                                        • String ID: "%ls" %ls$D$procutil.cpp
                                                                                                                                                                                                                        • API String ID: 161867955-2732225242
                                                                                                                                                                                                                        • Opcode ID: 5295cbae0b4b103085ab9a50acccf63ba6136599d3de6b918989a4a955f65f35
                                                                                                                                                                                                                        • Instruction ID: e3f35b8d7efa973015f393cb8ebafe0b9551624577723270dfb6b7ca47f2275f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5295cbae0b4b103085ab9a50acccf63ba6136599d3de6b918989a4a955f65f35
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3E21287190021EEFEB10AFA4C9449EEBBB9FF04351F10002AEA05B6262D7749E44DBA1
                                                                                                                                                                                                                        Function 005B9A6D Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 005B9A86
                                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,00000000,?,005BA7A9,00000100,000002C0,000002C0,00000100), ref: 005B9AA6
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005BA7A9,00000100,000002C0,000002C0,00000100), ref: 005B9AB1
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to set directory search path variable., xrefs: 005B9AE1
                                                                                                                                                                                                                        • Failed to format variable string., xrefs: 005B9A91
                                                                                                                                                                                                                        • Failed while searching directory search: %ls, for path: %ls, xrefs: 005B9B06
                                                                                                                                                                                                                        • Directory search: %ls, did not find path: %ls, reason: 0x%x, xrefs: 005B9B1C
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AttributesErrorFileLastOpen@16
                                                                                                                                                                                                                        • String ID: Directory search: %ls, did not find path: %ls, reason: 0x%x$Failed to format variable string.$Failed to set directory search path variable.$Failed while searching directory search: %ls, for path: %ls
                                                                                                                                                                                                                        • API String ID: 1811509786-2966038646
                                                                                                                                                                                                                        • Opcode ID: f28fc5a89def6ee092d7e5de17d6116098ef5f35b8c3ed3a2eb3113334e8f457
                                                                                                                                                                                                                        • Instruction ID: b66f7f07f855ffbea877ac40043f8092784fbfd06bae0e3c8fcdf6165dec7ec7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f28fc5a89def6ee092d7e5de17d6116098ef5f35b8c3ed3a2eb3113334e8f457
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7E11E732940529FBDB126694DD06FEEBF69FF54720F200215FE04B61A1D72A6E10E6E1
                                                                                                                                                                                                                        Function 005B9C39 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 71COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 005B9C52
                                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,?,005BA781,00000100,000002C0,000002C0,?,000002C0,00000100), ref: 005B9C72
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005BA781,00000100,000002C0,000002C0,?,000002C0,00000100,000002C0,000002C0,00000100), ref: 005B9C7D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to format variable string., xrefs: 005B9C5D
                                                                                                                                                                                                                        • File search: %ls, did not find path: %ls, xrefs: 005B9CE0
                                                                                                                                                                                                                        • Failed while searching file search: %ls, for path: %ls, xrefs: 005B9CAA
                                                                                                                                                                                                                        • Failed to set variable to file search path., xrefs: 005B9CD4
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AttributesErrorFileLastOpen@16
                                                                                                                                                                                                                        • String ID: Failed to format variable string.$Failed to set variable to file search path.$Failed while searching file search: %ls, for path: %ls$File search: %ls, did not find path: %ls
                                                                                                                                                                                                                        • API String ID: 1811509786-3425311760
                                                                                                                                                                                                                        • Opcode ID: e4cbacf168b0dddfe3de3560aec094ee0a8985bca29bb20cfe93ce4f9c86b5c1
                                                                                                                                                                                                                        • Instruction ID: d563637675849945cc8a590670a15afa7915f6802b641dc2b8a4cfa7900b9446
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e4cbacf168b0dddfe3de3560aec094ee0a8985bca29bb20cfe93ce4f9c86b5c1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C911D532940129B7DB122AA4CE47BEDBFA9FF50720F204111FE00B61A1D7296E10F7D5
                                                                                                                                                                                                                        Function 005C444C Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 64COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: GetProcessHeap.KERNEL32(?,000001C7,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38E5
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: RtlAllocateHeap.NTDLL(00000000,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38EC
                                                                                                                                                                                                                        • _memcpy_s.LIBCMT ref: 005C449E
                                                                                                                                                                                                                        • _memcpy_s.LIBCMT ref: 005C44B1
                                                                                                                                                                                                                        • _memcpy_s.LIBCMT ref: 005C44CC
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: _memcpy_s$Heap$AllocateProcess
                                                                                                                                                                                                                        • String ID: @G[$Failed to allocate memory for message.$feclient.dll$pipe.cpp
                                                                                                                                                                                                                        • API String ID: 886498622-390232960
                                                                                                                                                                                                                        • Opcode ID: f0e6ba09f7f0a7726cda8f84f8915ecf89f67cd4f28aae5f527d7462ccba59f9
                                                                                                                                                                                                                        • Instruction ID: 447081bb546b159605fc1280eed823624c21ac86b1fba64b60f5be14d915252d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f0e6ba09f7f0a7726cda8f84f8915ecf89f67cd4f28aae5f527d7462ccba59f9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8C1186B250031EABDB059E94CC86EDB779CFF44700B10442BFA0097141EB70DA10CBE0
                                                                                                                                                                                                                        Function 005CCCF4 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 53synchronizationthreadCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(00000001,000493E0,00000000,?,?,005CD134,00000000,?,?,005CC59C,00000001,?,?,?,?,?), ref: 005CCD06
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,005CD134,00000000,?,?,005CC59C,00000001,?,?,?,?,?,00000000,00000000,?), ref: 005CCD10
                                                                                                                                                                                                                        • GetExitCodeThread.KERNEL32(00000001,?,?,?,005CD134,00000000,?,?,005CC59C,00000001,?,?,?,?,?,00000000), ref: 005CCD4C
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,005CD134,00000000,?,?,005CC59C,00000001,?,?,?,?,?,00000000,00000000,?), ref: 005CCD56
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$CodeExitObjectSingleThreadWait
                                                                                                                                                                                                                        • String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$elevation.cpp
                                                                                                                                                                                                                        • API String ID: 3686190907-1954264426
                                                                                                                                                                                                                        • Opcode ID: 44f8c4ea264df0a7872e3a9740e13c726520022a360aba5c0437079d6f602333
                                                                                                                                                                                                                        • Instruction ID: ad74dbee9c8f7250a5243bb7973c333ad3b0f614c27d60844a3d90da6fe6d015
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 44f8c4ea264df0a7872e3a9740e13c726520022a360aba5c0437079d6f602333
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0801B972B80734ABF7106BB59D0AFAB7ED9EF04790F024125FD0AE6090EA559E00D5E5
                                                                                                                                                                                                                        Function 005C67B0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 52synchronizationthreadCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(00000001,000000FF,00000000,?,005C6CFB,@G[,?,00000000,?,00000000,00000001), ref: 005C67BD
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005C6CFB,@G[,?,00000000,?,00000000,00000001), ref: 005C67C7
                                                                                                                                                                                                                        • GetExitCodeThread.KERNEL32(00000001,00000000,?,005C6CFB,@G[,?,00000000,?,00000000,00000001), ref: 005C6806
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005C6CFB,@G[,?,00000000,?,00000000,00000001), ref: 005C6810
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$CodeExitObjectSingleThreadWait
                                                                                                                                                                                                                        • String ID: Failed to get cache thread exit code.$Failed to wait for cache thread to terminate.$core.cpp
                                                                                                                                                                                                                        • API String ID: 3686190907-2546940223
                                                                                                                                                                                                                        • Opcode ID: 4dcbaab5fe5e0855dde7f230e17b12c7db0c0cdabd217cc9ac28d48b47581506
                                                                                                                                                                                                                        • Instruction ID: 31caac5b394dd92eff5895aad7e91b8ae758d03fa9c77fc34dc863d97970e400
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4dcbaab5fe5e0855dde7f230e17b12c7db0c0cdabd217cc9ac28d48b47581506
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5D012171340305FFFB089BA5DD1AB7E7AE5EB00710F10416DB906D51E0EB799F10A618
                                                                                                                                                                                                                        Function 005CF586 Relevance: 12.1, APIs: 2, Strings: 6, Instructions: 118COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(?), ref: 005CF59B
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(?), ref: 005CF6A8
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Engine is active, cannot change engine state., xrefs: 005CF5B5
                                                                                                                                                                                                                        • UX requested unknown payload with id: %ls, xrefs: 005CF607
                                                                                                                                                                                                                        • Failed to set source path for payload., xrefs: 005CF637
                                                                                                                                                                                                                        • UX denied while trying to set source on embedded payload: %ls, xrefs: 005CF61D
                                                                                                                                                                                                                        • UX requested unknown container with id: %ls, xrefs: 005CF667
                                                                                                                                                                                                                        • Failed to set source path for container., xrefs: 005CF68D
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                        • String ID: Engine is active, cannot change engine state.$Failed to set source path for container.$Failed to set source path for payload.$UX denied while trying to set source on embedded payload: %ls$UX requested unknown container with id: %ls$UX requested unknown payload with id: %ls
                                                                                                                                                                                                                        • API String ID: 3168844106-4121889706
                                                                                                                                                                                                                        • Opcode ID: b6287872e626b4c5b3513d8d0252d2ca044e7ba8ac5d0772204304f2257139e9
                                                                                                                                                                                                                        • Instruction ID: f07aaf2068979a7f6e2eaf9f8f326f24c9a7cfe43893f959676677ff529d14c6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b6287872e626b4c5b3513d8d0252d2ca044e7ba8ac5d0772204304f2257139e9
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5C31F872A40215AFCB119B94CC05EAB7FAAFF54724B15802EF804EB250DB74ED8087A0
                                                                                                                                                                                                                        Function 005B70D4 Relevance: 12.1, APIs: 1, Strings: 7, Instructions: 99stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(00000000), ref: 005B70E7
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to format escape sequence., xrefs: 005B7181
                                                                                                                                                                                                                        • Failed to append characters., xrefs: 005B7173
                                                                                                                                                                                                                        • Failed to append escape sequence., xrefs: 005B717A
                                                                                                                                                                                                                        • Failed to copy string., xrefs: 005B719B
                                                                                                                                                                                                                        • Failed to allocate buffer for escaped string., xrefs: 005B70FE
                                                                                                                                                                                                                        • []{}, xrefs: 005B7111
                                                                                                                                                                                                                        • [\%c], xrefs: 005B7146
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: lstrlen
                                                                                                                                                                                                                        • String ID: Failed to allocate buffer for escaped string.$Failed to append characters.$Failed to append escape sequence.$Failed to copy string.$Failed to format escape sequence.$[\%c]$[]{}
                                                                                                                                                                                                                        • API String ID: 1659193697-3250950999
                                                                                                                                                                                                                        • Opcode ID: f7dcc6acbd2b536da282450a7784f0951b28f0ef1edf22bbd30037d5c1f64c98
                                                                                                                                                                                                                        • Instruction ID: d63957f19891cb485077109d8fca92d9756e8d1338add592647dd1372b9bbfca
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f7dcc6acbd2b536da282450a7784f0951b28f0ef1edf22bbd30037d5c1f64c98
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FA219B3294861EBADB115698DC46FFEBF6DBB94710F200165FA00B6141DB78BE40D6B4
                                                                                                                                                                                                                        Function 005D59B0 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 207COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(00000000,00000000,005FB4F0,000000FF,feclient.dll,000000FF,00000000,00000000,?,?,?,005D659B,?,00000001,?,005FB490), ref: 005D5A19
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed grow array of ordered patches., xrefs: 005D5AB2
                                                                                                                                                                                                                        • feclient.dll, xrefs: 005D5A0F, 005D5B39
                                                                                                                                                                                                                        • Failed to plan action for target product., xrefs: 005D5AC4
                                                                                                                                                                                                                        • Failed to insert execute action., xrefs: 005D5A6E
                                                                                                                                                                                                                        • Failed to copy target product code., xrefs: 005D5B4C
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CompareString
                                                                                                                                                                                                                        • String ID: Failed grow array of ordered patches.$Failed to copy target product code.$Failed to insert execute action.$Failed to plan action for target product.$feclient.dll
                                                                                                                                                                                                                        • API String ID: 1825529933-3477540455
                                                                                                                                                                                                                        • Opcode ID: dc9d4af6837ad3ce4ecd8035651498732ae539720e0a54e62bfefb13ce301919
                                                                                                                                                                                                                        • Instruction ID: 06ea0578e57c092d359fcb9bd27de18bf10ab69ec55c49f2f88866e13ee49b6c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dc9d4af6837ad3ce4ecd8035651498732ae539720e0a54e62bfefb13ce301919
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 858104B560075A9FCB25CF58C880AAA7BA5FF48325B158A6BEC158B352E730EC51CF50
                                                                                                                                                                                                                        Function 005D9039 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 171COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(00000000,00000001,?,000000FF,?,000000FF,00000000,00000100,00000000,?,?,?,005C6F20,000000B8,0000001C,00000100), ref: 005D9068
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(00000000,00000001,?,000000FF,005FB4A8,000000FF,?,?,?,005C6F20,000000B8,0000001C,00000100,00000100,00000100,000000B0), ref: 005D9101
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to initialize update bundle., xrefs: 005D91A9
                                                                                                                                                                                                                        • comres.dll, xrefs: 005D9187
                                                                                                                                                                                                                        • BA aborted detect forward compatible bundle., xrefs: 005D916D
                                                                                                                                                                                                                        • detect.cpp, xrefs: 005D9163
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CompareString
                                                                                                                                                                                                                        • String ID: BA aborted detect forward compatible bundle.$Failed to initialize update bundle.$comres.dll$detect.cpp
                                                                                                                                                                                                                        • API String ID: 1825529933-439563586
                                                                                                                                                                                                                        • Opcode ID: eecb93902ce5d22e80374930f7636d161f9dde30315c4115d2648a8efa898a96
                                                                                                                                                                                                                        • Instruction ID: 6dcd6806ee119f4ef3338b0db690b2a85aa2810b1e41c050427a2cf18fe906be
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: eecb93902ce5d22e80374930f7636d161f9dde30315c4115d2648a8efa898a96
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8E518271600216BFDF259F78CC89E7ABBAAFF05310B10466AF915DA291D731DC50DB90
                                                                                                                                                                                                                        Function 005EC9BD Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetConsoleCP.KERNEL32(?,00000000,?,?,?,?,?,?,?,005ED132,?,00000000,?,00000000,00000000), ref: 005EC9FF
                                                                                                                                                                                                                        • __fassign.LIBCMT ref: 005ECA7A
                                                                                                                                                                                                                        • __fassign.LIBCMT ref: 005ECA95
                                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,?,00000005,00000000,00000000), ref: 005ECABB
                                                                                                                                                                                                                        • WriteFile.KERNEL32(?,?,00000000,005ED132,00000000,?,?,?,?,?,?,?,?,?,005ED132,?), ref: 005ECADA
                                                                                                                                                                                                                        • WriteFile.KERNEL32(?,?,00000001,005ED132,00000000,?,?,?,?,?,?,?,?,?,005ED132,?), ref: 005ECB13
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FileWrite__fassign$ByteCharConsoleMultiWide
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1324828854-0
                                                                                                                                                                                                                        • Opcode ID: 29e1be7aef282f1919e111bb807aa4fd4375735567cc4b2b910cac961bd953f2
                                                                                                                                                                                                                        • Instruction ID: f6127ef73cc4538b9cf2d77adcd875c816a974a90d0ca0d53486ec4b22dcbd53
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 29e1be7aef282f1919e111bb807aa4fd4375735567cc4b2b910cac961bd953f2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 82519071A002899FDB14CFA9D886AEEBFF9FF09300F14411AE995E7291D730D945CBA0
                                                                                                                                                                                                                        Function 005CD206 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 120COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,00000001,005FB4F0,?,00000001,000000FF,?,?,75C0B390,00000000,00000001,00000000,?,005C72F3), ref: 005CD32F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to create pipe name and client token., xrefs: 005CD270
                                                                                                                                                                                                                        • UX aborted elevation requirement., xrefs: 005CD244
                                                                                                                                                                                                                        • Failed to create pipe and cache pipe., xrefs: 005CD28C
                                                                                                                                                                                                                        • Failed to connect to elevated child process., xrefs: 005CD318
                                                                                                                                                                                                                        • Failed to elevate., xrefs: 005CD311
                                                                                                                                                                                                                        • elevation.cpp, xrefs: 005CD23A
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseHandle
                                                                                                                                                                                                                        • String ID: Failed to connect to elevated child process.$Failed to create pipe and cache pipe.$Failed to create pipe name and client token.$Failed to elevate.$UX aborted elevation requirement.$elevation.cpp
                                                                                                                                                                                                                        • API String ID: 2962429428-3003415917
                                                                                                                                                                                                                        • Opcode ID: 97eea19c932609344d477452315117d90335f90818a621fe066b53e78d4e225f
                                                                                                                                                                                                                        • Instruction ID: 36aac5cf2865794ac218dc94ed15569b737d4889133b8e80484f95b1ca21101e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 97eea19c932609344d477452315117d90335f90818a621fe066b53e78d4e225f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 99312A72A446637EEB2556E08C4AFAF6F6DFF40720F10052DF905E61C2DA51BE0086B5
                                                                                                                                                                                                                        Function 005F041B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 118fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(0061B60C,00000000,?,?,?,005B5407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 005F042B
                                                                                                                                                                                                                        • CreateFileW.KERNEL32(40000000,00000001,00000000,00000002,00000080,00000000,?,00000000,?,?,?,0061B604,?,005B5407,00000000,Setup), ref: 005F04CC
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005B5407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 005F04DC
                                                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,005B5407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 005F0515
                                                                                                                                                                                                                          • Part of subcall function 005B2DE0: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 005B2F1F
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(0061B60C,?,?,0061B604,?,005B5407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 005F056E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
                                                                                                                                                                                                                        • String ID: logutil.cpp
                                                                                                                                                                                                                        • API String ID: 4111229724-3545173039
                                                                                                                                                                                                                        • Opcode ID: 2f8ce7cc34dc60c402725145a77f5d3eb1b6d9f13e2b6f515dfa62f4305ad9e6
                                                                                                                                                                                                                        • Instruction ID: 52424d6efcc05380e4c03587dbfde8a28711c18afda99190e21ad5e3189838a8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2f8ce7cc34dc60c402725145a77f5d3eb1b6d9f13e2b6f515dfa62f4305ad9e6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3E31717190121DAFEB219FA0DC49EBA3E69FB10750F096125BB00E61A2D778CD40DBE0
                                                                                                                                                                                                                        Function 005D3750 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 112COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 005D37B7
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to format property value., xrefs: 005D3840
                                                                                                                                                                                                                        • Failed to escape string., xrefs: 005D3839
                                                                                                                                                                                                                        • Failed to format property string part., xrefs: 005D3832
                                                                                                                                                                                                                        • Failed to append property string part., xrefs: 005D382B
                                                                                                                                                                                                                        • %s%="%s", xrefs: 005D37EA
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Open@16
                                                                                                                                                                                                                        • String ID: %s%="%s"$Failed to append property string part.$Failed to escape string.$Failed to format property string part.$Failed to format property value.
                                                                                                                                                                                                                        • API String ID: 3613110473-515423128
                                                                                                                                                                                                                        • Opcode ID: 6707f46bd50cc4cc2363cff8e25b1cb70876c59535f5f2de5120c0816cc758b4
                                                                                                                                                                                                                        • Instruction ID: 2b2e965bf70e315e977348e9f00de03ec5d0658055ce16b70c1e2957c35e6b15
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6707f46bd50cc4cc2363cff8e25b1cb70876c59535f5f2de5120c0816cc758b4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 183191B290521AAFCB259F98CC45AAEBF69FF40710F10416BF90166341D770AF10EB92
                                                                                                                                                                                                                        Function 005B7203 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 92COMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,?,?,005B583F,000002C0,000002C0,00000000,00000100,00000001,00000000,000002C0,00000002), ref: 005B7215
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(00000000,00000000,00000002,00000000,?,?,?,005B583F,000002C0,000002C0,00000000,00000100,00000001,00000000,000002C0,00000002), ref: 005B72F4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to format value '%ls' of variable: %ls, xrefs: 005B72BE
                                                                                                                                                                                                                        • Failed to get variable: %ls, xrefs: 005B7256
                                                                                                                                                                                                                        • *****, xrefs: 005B72B0, 005B72BD
                                                                                                                                                                                                                        • Failed to get value as string for variable: %ls, xrefs: 005B72E3
                                                                                                                                                                                                                        • Failed to get unformatted string., xrefs: 005B7285
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                        • String ID: *****$Failed to format value '%ls' of variable: %ls$Failed to get unformatted string.$Failed to get value as string for variable: %ls$Failed to get variable: %ls
                                                                                                                                                                                                                        • API String ID: 3168844106-2873099529
                                                                                                                                                                                                                        • Opcode ID: dc2b23d745ccb43407416dd26385b2a5656fbaf1d795e9dbaa3cd143dfd174ec
                                                                                                                                                                                                                        • Instruction ID: 36460b65f82f6f1432a4ce46932dede44bde749645eded5175f47acd190c37ff
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dc2b23d745ccb43407416dd26385b2a5656fbaf1d795e9dbaa3cd143dfd174ec
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E1319136904A1EBBDF225B50CC05BEEBF65FF98320F104125FA146A650D735BA60DBD4
                                                                                                                                                                                                                        Function 005C8BE5 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 77COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • InitializeAcl.ADVAPI32(?,00000008,00000002,0000001A,00000000,?,00000000,00000000,?,?,00000000,00000000,?,?,-00000004,00000000), ref: 005C8C30
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000001), ref: 005C8C3A
                                                                                                                                                                                                                        • SetFileAttributesW.KERNEL32(?,00000080,?,00000001,20000004,00000000,00000000,?,00000000,00000003,000007D0,?,00000000,00000000,?,?), ref: 005C8C9A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to initialize ACL., xrefs: 005C8C68
                                                                                                                                                                                                                        • Failed to allocate administrator SID., xrefs: 005C8C16
                                                                                                                                                                                                                        • cache.cpp, xrefs: 005C8C5E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AttributesErrorFileInitializeLast
                                                                                                                                                                                                                        • String ID: Failed to allocate administrator SID.$Failed to initialize ACL.$cache.cpp
                                                                                                                                                                                                                        • API String ID: 669721577-1117388985
                                                                                                                                                                                                                        • Opcode ID: e6530f38ec54f7567c3a6abd95a7191187bb8fe407af09595d12261a0ef050d0
                                                                                                                                                                                                                        • Instruction ID: bd700650a368c34487b82b4a18c2b3ace9ab65a9d2db4b288b945195d4f8f26b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e6530f38ec54f7567c3a6abd95a7191187bb8fe407af09595d12261a0ef050d0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E921EB72E41314BFEB109AD5DC89FBBBBA9FB40710F114129FD04FB180EA745E0096A0
                                                                                                                                                                                                                        Function 005B410D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 75COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetCurrentDirectoryW.KERNEL32(00000000,00000000,?,00000000,crypt32.dll,?,?,005C3ED4,00000001,feclient.dll,?,00000000,?,?,?,005B4A0C), ref: 005B4148
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,005C3ED4,00000001,feclient.dll,?,00000000,?,?,?,005B4A0C,?,?,005FB478,?,00000001), ref: 005B4154
                                                                                                                                                                                                                        • GetCurrentDirectoryW.KERNEL32(00000000,?,?,00000000,?,?,005C3ED4,00000001,feclient.dll,?,00000000,?,?,?,005B4A0C,?), ref: 005B418F
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,005C3ED4,00000001,feclient.dll,?,00000000,?,?,?,005B4A0C,?,?,005FB478,?,00000001), ref: 005B4199
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CurrentDirectoryErrorLast
                                                                                                                                                                                                                        • String ID: crypt32.dll$dirutil.cpp
                                                                                                                                                                                                                        • API String ID: 152501406-1104880720
                                                                                                                                                                                                                        • Opcode ID: c1310631b256a2287c3c51586715d34e520f7640ab0574544d58f21049e900f6
                                                                                                                                                                                                                        • Instruction ID: 4ec143e229d2f94b0695a3d31c868b4d5f26a0de5a8b13ba8c52774cac41a0dc
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c1310631b256a2287c3c51586715d34e520f7640ab0574544d58f21049e900f6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A111B776E00726ABA7309AAD8C84AA7BADCFF14790B110135FD04E7211EB25EC40DAF0
                                                                                                                                                                                                                        Function 005B999B Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 75COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 005B99B6
                                                                                                                                                                                                                        • GetFileAttributesW.KERNEL32(00000000,000002C0,?,00000000,00000000,000002C0,00000100,000002C0,00000100), ref: 005B99CE
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B99D9
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to format variable string., xrefs: 005B99C1
                                                                                                                                                                                                                        • Failed while searching directory search: %ls, for path: %ls, xrefs: 005B9A16
                                                                                                                                                                                                                        • Failed to set variable., xrefs: 005B9A4E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AttributesErrorFileLastOpen@16
                                                                                                                                                                                                                        • String ID: Failed to format variable string.$Failed to set variable.$Failed while searching directory search: %ls, for path: %ls
                                                                                                                                                                                                                        • API String ID: 1811509786-402580132
                                                                                                                                                                                                                        • Opcode ID: 2518cbe19db6897e217e5cde2cdc2dda33baaba7248f6ad3826f5b6c8ef15345
                                                                                                                                                                                                                        • Instruction ID: 244db9f5dcf4e725a0e764cbd77ed0531b248dc383c473e29a922ac9328ec1ef
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2518cbe19db6897e217e5cde2cdc2dda33baaba7248f6ad3826f5b6c8ef15345
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EE21A432E40229B7DB11AAA4DC46BEDBF65FF54720F208316FA10A6190D7357E50EAD1
                                                                                                                                                                                                                        Function 005D08F0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 72fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to write during cabinet extraction., xrefs: 005D0997
                                                                                                                                                                                                                        • Unexpected call to CabWrite()., xrefs: 005D0923
                                                                                                                                                                                                                        • cabextract.cpp, xrefs: 005D098D
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorFileLastWrite_memcpy_s
                                                                                                                                                                                                                        • String ID: Failed to write during cabinet extraction.$Unexpected call to CabWrite().$cabextract.cpp
                                                                                                                                                                                                                        • API String ID: 1970631241-3111339858
                                                                                                                                                                                                                        • Opcode ID: ad858864f111fc8eceb2b73fdd523818a689bf72cd9876bd420ca243a4da826c
                                                                                                                                                                                                                        • Instruction ID: a2c21224ce783cd42017d7bb95f4e8d9c7763f391930fad59ac1c0f9163ae18a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ad858864f111fc8eceb2b73fdd523818a689bf72cd9876bd420ca243a4da826c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1321BB76640204EFEB14DFACDD84EAA3BE9FF88320F11415AFA08C7296D631DA00CB50
                                                                                                                                                                                                                        Function 005D09B8 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 70timeCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • DosDateTimeToFileTime.KERNEL32(?,?,?), ref: 005D0A25
                                                                                                                                                                                                                        • LocalFileTimeToFileTime.KERNEL32(?,?), ref: 005D0A37
                                                                                                                                                                                                                        • SetFileTime.KERNEL32(?,?,?,?), ref: 005D0A4A
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(000000FF,?,?,?,?,?,?,?,?,?,?,?,?,005D0616,?,?), ref: 005D0A59
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Invalid operation for this state., xrefs: 005D09FE
                                                                                                                                                                                                                        • cabextract.cpp, xrefs: 005D09F4
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Time$File$CloseDateHandleLocal
                                                                                                                                                                                                                        • String ID: Invalid operation for this state.$cabextract.cpp
                                                                                                                                                                                                                        • API String ID: 609741386-1751360545
                                                                                                                                                                                                                        • Opcode ID: df5680775db3c77cae48154e553cfa684f24cd6893dff5fa91096a7af0e221bf
                                                                                                                                                                                                                        • Instruction ID: b4ead0f5d320a6cc92c59af463901c1da9d3ae2f0633df6ce2dbc8a5a884a2bd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: df5680775db3c77cae48154e553cfa684f24cd6893dff5fa91096a7af0e221bf
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F021C37291061AEB8720DFACDC489BA7FBCFE04720B545217F811D66D0C774DA11CB90
                                                                                                                                                                                                                        Function 005F8803 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 69timeCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005F884C
                                                                                                                                                                                                                        • SystemTimeToFileTime.KERNEL32(?,00000000), ref: 005F8874
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005F887E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLastTime$FileSystem
                                                                                                                                                                                                                        • String ID: Qd_$feclient.dll$inetutil.cpp
                                                                                                                                                                                                                        • API String ID: 1528435940-1839795727
                                                                                                                                                                                                                        • Opcode ID: 46ac8536dc9cfd5e8b0124f1b6aa25b4343c6411a8eabf1a6e4f3d159fb59f4f
                                                                                                                                                                                                                        • Instruction ID: 0f8b41f500ed35ec4b73b45ef3f631512deca735cce9b85a380bfb0abe0aae47
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 46ac8536dc9cfd5e8b0124f1b6aa25b4343c6411a8eabf1a6e4f3d159fb59f4f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A4116672A01229ABE710DBB9CD44BFBB7ECEF48690F114526AE05E7150EA249D0497E1
                                                                                                                                                                                                                        Function 005F3B4A Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 60COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ShellExecuteExW.SHELL32(?), ref: 005F3B98
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,00000000), ref: 005F3BA2
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?,00000000), ref: 005F3BD5
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseErrorExecuteHandleLastShell
                                                                                                                                                                                                                        • String ID: <$PDu$shelutil.cpp
                                                                                                                                                                                                                        • API String ID: 3023784893-2418939910
                                                                                                                                                                                                                        • Opcode ID: 2c3e622344e8b2e603472da720bd2199113020afec95067fdb330544600ae04f
                                                                                                                                                                                                                        • Instruction ID: a3aee357ba57a58a464322eda2461d1a61a18c3ab75d4eddac3869356f3a19ca
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2c3e622344e8b2e603472da720bd2199113020afec95067fdb330544600ae04f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BC11D6B5E01219ABEB10DFA9D845ADEBBF8BB08350F00412AFD05E7350E7349A00CBA4
                                                                                                                                                                                                                        Function 005B9908 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 57COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005B997F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to get Condition inner text., xrefs: 005B994F
                                                                                                                                                                                                                        • =S[, xrefs: 005B9908
                                                                                                                                                                                                                        • Failed to copy condition string from BSTR, xrefs: 005B9969
                                                                                                                                                                                                                        • Condition, xrefs: 005B991A
                                                                                                                                                                                                                        • Failed to select condition node., xrefs: 005B9936
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FreeString
                                                                                                                                                                                                                        • String ID: =S[$Condition$Failed to copy condition string from BSTR$Failed to get Condition inner text.$Failed to select condition node.
                                                                                                                                                                                                                        • API String ID: 3341692771-1744483438
                                                                                                                                                                                                                        • Opcode ID: 26015dc0251fcffb826c028d2c9c0558d1ba2cebfcd80089d895f8fb85144645
                                                                                                                                                                                                                        • Instruction ID: c4b3c9849c4da41e1a7e2c75f8cdeef3da532784bc588c46a3ad1363c5d5fd1d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 26015dc0251fcffb826c028d2c9c0558d1ba2cebfcd80089d895f8fb85144645
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D1118E3295522CBBDB159B90CD09FFEBF69BF00751F104158FA00B6190DB79AE00EA90
                                                                                                                                                                                                                        Function 005F9555 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 50COMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: AcquireSRWLockExclusive$KERNEL32.DLL$ReleaseSRWLockExclusive
                                                                                                                                                                                                                        • API String ID: 0-1718035505
                                                                                                                                                                                                                        • Opcode ID: 488ef6f3608814c64b4aac848d79d603eeb6c1127ff389e9b7243a757c930be1
                                                                                                                                                                                                                        • Instruction ID: a9d49464d1bfb1312bd132e84137b85fe4efbfa7eb66c32c6062d4694084fe35
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 488ef6f3608814c64b4aac848d79d603eeb6c1127ff389e9b7243a757c930be1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6401D675742A259B4F325E719C847F71ACABE46711305512AE611C2180DB1AC849DBE0
                                                                                                                                                                                                                        Function 005F09BB Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 40libraryloaderCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,005B5D8F,00000000), ref: 005F09CF
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000), ref: 005F09D6
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,005B5D8F,00000000), ref: 005F09ED
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressErrorHandleLastModuleProc
                                                                                                                                                                                                                        • String ID: IsWow64Process$kernel32$procutil.cpp
                                                                                                                                                                                                                        • API String ID: 4275029093-1586155540
                                                                                                                                                                                                                        • Opcode ID: c5c05a999a02684350b170d2b9a2b2071c74462898053fc0f303dc188b25107c
                                                                                                                                                                                                                        • Instruction ID: 505121ef970b19a05027c67a67488cb3a4f15b7990fe392faee51ae54e385c7e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c5c05a999a02684350b170d2b9a2b2071c74462898053fc0f303dc188b25107c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 83F0C875A00329FBA7209FA5DC099BBBF98FF14750B014115BD05E7280EB798E00D7E0
                                                                                                                                                                                                                        Function 005EA059 Relevance: 9.2, APIs: 6, Instructions: 216COMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,005E3382,005E3382,?,?,?,005EA2AA,00000001,00000001,E3E85006), ref: 005EA0B3
                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,005EA2AA,00000001,00000001,E3E85006,?,?,?), ref: 005EA139
                                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,E3E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 005EA233
                                                                                                                                                                                                                        • __freea.LIBCMT ref: 005EA240
                                                                                                                                                                                                                          • Part of subcall function 005E5154: HeapAlloc.KERNEL32(00000000,?,?,?,005E1E90,?,0000015D,?,?,?,?,005E32E9,000000FF,00000000,?,?), ref: 005E5186
                                                                                                                                                                                                                        • __freea.LIBCMT ref: 005EA249
                                                                                                                                                                                                                        • __freea.LIBCMT ref: 005EA26E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ByteCharMultiWide__freea$AllocHeap
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3147120248-0
                                                                                                                                                                                                                        • Opcode ID: f5349cd01bf54f81ceb85b5478ac654247831d04671cd444c5668e73c349dd70
                                                                                                                                                                                                                        • Instruction ID: fe58854ba7e6248332f81c742056bc2c1ca498308fa1541e8d0a5cfac4b6913a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f5349cd01bf54f81ceb85b5478ac654247831d04671cd444c5668e73c349dd70
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5D51D172600286ABDB2D8F76CC85EBB7FA9FB84750F144629F944E6140EB35EC44C662
                                                                                                                                                                                                                        Function 005F5D7F Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 159stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: lstrlen
                                                                                                                                                                                                                        • String ID: Qd_$dlutil.cpp$msasn1.dll
                                                                                                                                                                                                                        • API String ID: 1659193697-6644929
                                                                                                                                                                                                                        • Opcode ID: 1cffa88c1e5288a5efa3ef4429149ac80d04dca9f04b1ef30798526ff1f98ec7
                                                                                                                                                                                                                        • Instruction ID: 024264b187e6a0fd72afe986927824f3cb9a21261f2b9ab2b69f2b0a78a84273
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1cffa88c1e5288a5efa3ef4429149ac80d04dca9f04b1ef30798526ff1f98ec7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E251A172901619ABDB119FA48C88DBFBBBDFF88750B064055FF05E7210EB358E4197A0
                                                                                                                                                                                                                        Function 005CF6B8 Relevance: 9.1, APIs: 2, Strings: 4, Instructions: 138COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(?), ref: 005CF6D0
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(?,?), ref: 005CF81D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to default local update source, xrefs: 005CF742
                                                                                                                                                                                                                        • Failed to recreate command-line for update bundle., xrefs: 005CF79C
                                                                                                                                                                                                                        • update\%ls, xrefs: 005CF72E
                                                                                                                                                                                                                        • Failed to set update bundle., xrefs: 005CF7F3
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                        • String ID: Failed to default local update source$Failed to recreate command-line for update bundle.$Failed to set update bundle.$update\%ls
                                                                                                                                                                                                                        • API String ID: 3168844106-1266646976
                                                                                                                                                                                                                        • Opcode ID: b7d34a891d53cd362c79c5c3186eb14a8b5e1765c1477add7bcb9f9ec42a8c6b
                                                                                                                                                                                                                        • Instruction ID: 3390fa69257c04142e288908406ebc9c87673d47756ca9799fb3ffd5ca762e07
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b7d34a891d53cd362c79c5c3186eb14a8b5e1765c1477add7bcb9f9ec42a8c6b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4141583294020AEFDF168F94CC4AFAA7BA6FF04350F058279F905A71A1D775AD60DB90
                                                                                                                                                                                                                        Function 005C8AA3 Relevance: 9.1, APIs: 1, Strings: 5, Instructions: 122sleepCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • Sleep.KERNEL32(000007D0,00000000,00000000), ref: 005C8B0F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Sleep
                                                                                                                                                                                                                        • String ID: Failed to calculate cache path.$Failed to get %hs package cache root directory.$Failed to get old %hs package cache root directory.$per-machine$per-user
                                                                                                                                                                                                                        • API String ID: 3472027048-398165853
                                                                                                                                                                                                                        • Opcode ID: 80daa78af2c7f89dfbcc871812e3d90c694efea9891dc2635b0b542c073c4286
                                                                                                                                                                                                                        • Instruction ID: 7a2db353c603aec10e0e4be817a50752a7d360fb94d2b53d6d404a820bda73bf
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 80daa78af2c7f89dfbcc871812e3d90c694efea9891dc2635b0b542c073c4286
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7731F8B2A40229BFEB15AA94CC46FBFBE6DFF40714F05042DFE05E6181DA799D1092A1
                                                                                                                                                                                                                        Function 005CE705 Relevance: 9.1, APIs: 6, Instructions: 85windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • DefWindowProcW.USER32(?,00000082,?,?), ref: 005CE734
                                                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000EB,00000000), ref: 005CE743
                                                                                                                                                                                                                        • SetWindowLongW.USER32(?,000000EB,?), ref: 005CE757
                                                                                                                                                                                                                        • DefWindowProcW.USER32(?,?,?,?), ref: 005CE767
                                                                                                                                                                                                                        • GetWindowLongW.USER32(?,000000EB), ref: 005CE781
                                                                                                                                                                                                                        • PostQuitMessage.USER32(00000000), ref: 005CE7DE
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Window$Long$Proc$MessagePostQuit
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3812958022-0
                                                                                                                                                                                                                        • Opcode ID: 6e066b51e46a566fa0f2bc4f8a54e885b6e53086783e093913acb403b0c60a6b
                                                                                                                                                                                                                        • Instruction ID: 99a84d8646b507e9c38d2af6c21ebcc15b66b61c738440fd3225c217febe5d92
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6e066b51e46a566fa0f2bc4f8a54e885b6e53086783e093913acb403b0c60a6b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2B216D32104119BFEB119FA4DD4AFAA3FAAFF55351F148928F906EA1A0C731DD10EB60
                                                                                                                                                                                                                        Function 005CC59C Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 163synchronizationCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to save state., xrefs: 005CC661
                                                                                                                                                                                                                        • elevation.cpp, xrefs: 005CC788
                                                                                                                                                                                                                        • Unexpected elevated message sent to child process, msg: %u, xrefs: 005CC794
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseHandleMutexRelease
                                                                                                                                                                                                                        • String ID: Failed to save state.$Unexpected elevated message sent to child process, msg: %u$elevation.cpp
                                                                                                                                                                                                                        • API String ID: 4207627910-1576875097
                                                                                                                                                                                                                        • Opcode ID: 1875120650dd5c2d71e57f75b43e7eda86d1099444d7e0211e7da5ac052a7300
                                                                                                                                                                                                                        • Instruction ID: 2e357eb28fb5890a8aaf1adb0e694cff8cc27b7484d7e1c17aa67a1ac4218b4c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1875120650dd5c2d71e57f75b43e7eda86d1099444d7e0211e7da5ac052a7300
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2061B03A100604EFCB229F94C945D56BFF2FF49710715899CFAAA5A632C732E920EF40
                                                                                                                                                                                                                        Function 005F10C5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 149registrystringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 005F10ED
                                                                                                                                                                                                                        • RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,005C6EF3,00000100,000000B0,00000088,00000410,000002C0), ref: 005F1126
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,?,?,00000000,?,-00000001,00000004,00000000), ref: 005F121A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: QueryValue$lstrlen
                                                                                                                                                                                                                        • String ID: BundleUpgradeCode$regutil.cpp
                                                                                                                                                                                                                        • API String ID: 3790715954-1648651458
                                                                                                                                                                                                                        • Opcode ID: d9c036de657e0499ef58eb36b9a6b8bcbd3147797872f46cb115cb47324ea758
                                                                                                                                                                                                                        • Instruction ID: 623fb0b8edacbca33f7a493616df840f391eae8174d58d966d18d6f8ddbacbcd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d9c036de657e0499ef58eb36b9a6b8bcbd3147797872f46cb115cb47324ea758
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AF41CF35A0061EEBDB218F99C884EBEBBB9FF44710F114169EA05EB210D635DD01CBA4
                                                                                                                                                                                                                        Function 005F61FA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005F47D3: SetFilePointerEx.KERNELBASE(?,?,?,?,?,00000000,?,?,?,005C8564,00000000,00000000,00000000,00000000,00000000), ref: 005F47EB
                                                                                                                                                                                                                          • Part of subcall function 005F47D3: GetLastError.KERNEL32(?,?,?,005C8564,00000000,00000000,00000000,00000000,00000000), ref: 005F47F5
                                                                                                                                                                                                                        • WriteFile.KERNEL32(?,?,00000000,?,00000000,?,005F5AC5,?,?,?,?,?,?,?,00010000,?), ref: 005F6263
                                                                                                                                                                                                                        • WriteFile.KERNEL32(000000FF,00000008,00000008,?,00000000,000000FF,00000000,00000000,00000000,00000000,?,005F5AC5,?,?,?,?), ref: 005F62B5
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005F5AC5,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 005F62FB
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005F5AC5,?,?,?,?,?,?,?,00010000,?,00000001,?,GET,?,?), ref: 005F6321
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorFileLast$Write$Pointer
                                                                                                                                                                                                                        • String ID: dlutil.cpp
                                                                                                                                                                                                                        • API String ID: 133221148-2067379296
                                                                                                                                                                                                                        • Opcode ID: b249f5b0ba2304c1c18c873c6998fecff332d5c7e09a85ed6902711c5a18b05c
                                                                                                                                                                                                                        • Instruction ID: b7c8337fa2fd65d507ea05e4600dc40dc89958b166257e544fd80cc837d70923
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b249f5b0ba2304c1c18c873c6998fecff332d5c7e09a85ed6902711c5a18b05c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 11416D72A0021EEFEB119E94CD49BFABBA9FF04351F150225BE04E6090D779DD64DBA0
                                                                                                                                                                                                                        Function 005B2436 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 118COMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(00000000,00000000,005EFEE7,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,005EFEE7,?,00000000,00000000), ref: 005B247C
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,005EFEE7,?,00000000,00000000,0000FDE9), ref: 005B2488
                                                                                                                                                                                                                          • Part of subcall function 005B3B51: GetProcessHeap.KERNEL32(00000000,000001C7,?,005B21DC,000001C7,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B3B59
                                                                                                                                                                                                                          • Part of subcall function 005B3B51: HeapSize.KERNEL32(00000000,?,005B21DC,000001C7,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B3B60
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
                                                                                                                                                                                                                        • String ID: strutil.cpp
                                                                                                                                                                                                                        • API String ID: 3662877508-3612885251
                                                                                                                                                                                                                        • Opcode ID: f38360d1cf4315a73d60facf1fcfb8a975548c0b66b8c85f67ce8706e5377ea6
                                                                                                                                                                                                                        • Instruction ID: 373014de10b8edbf968c03feded7f6409d5ab1dfbfe8cb839eb7b304809f9cdb
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f38360d1cf4315a73d60facf1fcfb8a975548c0b66b8c85f67ce8706e5377ea6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5031AF71200219AFFB119E698C94AFA3ADDFB94364F108629F915DB1A0EA65EC40D770
                                                                                                                                                                                                                        Function 005DAAE8 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 107COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to skip the extraction of payload: %ls from container: %ls, xrefs: 005DABEF
                                                                                                                                                                                                                        • Failed to open container: %ls., xrefs: 005DAB2A
                                                                                                                                                                                                                        • Failed to extract all payloads from container: %ls, xrefs: 005DAB9C
                                                                                                                                                                                                                        • Failed to extract payload: %ls from container: %ls, xrefs: 005DABE3
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CreateErrorFileLast
                                                                                                                                                                                                                        • String ID: Failed to extract all payloads from container: %ls$Failed to extract payload: %ls from container: %ls$Failed to open container: %ls.$Failed to skip the extraction of payload: %ls from container: %ls
                                                                                                                                                                                                                        • API String ID: 1214770103-3891707333
                                                                                                                                                                                                                        • Opcode ID: eb59228ec2dcf70412d3b8307373ea1c84b4efdcf62841f814b2ad2f261a515b
                                                                                                                                                                                                                        • Instruction ID: 8c728e80bb65eeb1c040b021f18c85bebf9f3d7130c87eaa8d1b076fc2222254
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: eb59228ec2dcf70412d3b8307373ea1c84b4efdcf62841f814b2ad2f261a515b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A131E732D4012ABBDF21AAE8CC46E9F7F69BF04310F100527F911A6291D775D951DB91
                                                                                                                                                                                                                        Function 005F40C8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 99COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • MoveFileExW.KERNEL32(00000003,00000001,00000000,00000000,00000101,?,005F4203,00000003,00000001,00000001,000007D0,00000003,00000000,?,005C9E5F,00000000), ref: 005F40ED
                                                                                                                                                                                                                        • GetLastError.KERNEL32(00000001,?,005F4203,00000003,00000001,00000001,000007D0,00000003,00000000,?,005C9E5F,00000000,000007D0,00000001,00000001,00000003), ref: 005F40FC
                                                                                                                                                                                                                        • MoveFileExW.KERNEL32(00000003,00000001,000007D0,00000001,00000000,?,005F4203,00000003,00000001,00000001,000007D0,00000003,00000000,?,005C9E5F,00000000), ref: 005F417F
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005F4203,00000003,00000001,00000001,000007D0,00000003,00000000,?,005C9E5F,00000000,000007D0,00000001,00000001,00000003,000007D0), ref: 005F4189
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorFileLastMove
                                                                                                                                                                                                                        • String ID: fileutil.cpp
                                                                                                                                                                                                                        • API String ID: 55378915-2967768451
                                                                                                                                                                                                                        • Opcode ID: d5709d0df4e08f39f412f353090cbdf3b0bbca6bfbdd091d61ca18b54fdbd414
                                                                                                                                                                                                                        • Instruction ID: 74391fc8a2b2aa9a984175564ea4dd729ca784056da8e4fa8235e8d1dc0cc94b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d5709d0df4e08f39f412f353090cbdf3b0bbca6bfbdd091d61ca18b54fdbd414
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 9821E636A0032A97EB212E64CC45EBF7A99FBA07A1F120126FF05D7150D7388C91DAE0
                                                                                                                                                                                                                        Function 005F4212 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 95registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005F4315: FindFirstFileW.KERNEL32(005D8FFA,?,000002C0,00000000,00000000), ref: 005F4350
                                                                                                                                                                                                                          • Part of subcall function 005F4315: FindClose.KERNEL32(00000000), ref: 005F435C
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,00000000,?,00000000,?,00000000,?,00000000,?,wininet.dll), ref: 005F4305
                                                                                                                                                                                                                          • Part of subcall function 005F0E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,005F5699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 005F0E52
                                                                                                                                                                                                                          • Part of subcall function 005F10C5: RegQueryValueExW.ADVAPI32(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 005F10ED
                                                                                                                                                                                                                          • Part of subcall function 005F10C5: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,005C6EF3,00000100,000000B0,00000088,00000410,000002C0), ref: 005F1126
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseFindQueryValue$FileFirstOpen
                                                                                                                                                                                                                        • String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager$\$crypt32.dll
                                                                                                                                                                                                                        • API String ID: 3397690329-3978359083
                                                                                                                                                                                                                        • Opcode ID: 297aadb5885f4f158bd80586d4abebd51a803373686f7e0bef9463f315325e74
                                                                                                                                                                                                                        • Instruction ID: 3df97b8bc13d02501e646ae985c54c230122bb35b908bdf9a848e4e32223d573
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 297aadb5885f4f158bd80586d4abebd51a803373686f7e0bef9463f315325e74
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F8319A39A0021DAADF21AFD5C841ABFBFB9FB00360F55817AFA00A6151D7399A80DF54
                                                                                                                                                                                                                        Function 005BEEF9 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 92registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000000,00000001,000000FF,?,000000FF,00000001,PackageVersion,00000001,?,005C04CB,00000001,00000001,00000001,005C04CB,00000000), ref: 005BEF70
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,00000001,PackageVersion,00000001,?,005C04CB,00000001,00000001,00000001,005C04CB,00000000,00000001,00000002,005C04CB,00000001), ref: 005BEF87
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to remove update registration key: %ls, xrefs: 005BEFB4
                                                                                                                                                                                                                        • Failed to format key for update registration., xrefs: 005BEF26
                                                                                                                                                                                                                        • PackageVersion, xrefs: 005BEF51
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseCompareString
                                                                                                                                                                                                                        • String ID: Failed to format key for update registration.$Failed to remove update registration key: %ls$PackageVersion
                                                                                                                                                                                                                        • API String ID: 446873843-3222553582
                                                                                                                                                                                                                        • Opcode ID: cc6d9ea701c994caf1d208c2b4614f914bef2e8212adbbefb54c9119edcd1486
                                                                                                                                                                                                                        • Instruction ID: 44908bb9031eafe61f3317e1cdbcf96f7ec54a2795d6c9961bc226ef547b690f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: cc6d9ea701c994caf1d208c2b4614f914bef2e8212adbbefb54c9119edcd1486
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E321B132A40219BBDB119BA4CC4AEFFBFB9FF40711F154179FA11A2291E734AE40D690
                                                                                                                                                                                                                        Function 005BEE0F Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 88COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 005BEE4A
                                                                                                                                                                                                                          • Part of subcall function 005F4038: SetFileAttributesW.KERNEL32(005D8FFA,00000080,00000000,005D8FFA,000000FF,00000000,?,?,005D8FFA), ref: 005F4067
                                                                                                                                                                                                                          • Part of subcall function 005F4038: GetLastError.KERNEL32(?,?,005D8FFA), ref: 005F4071
                                                                                                                                                                                                                          • Part of subcall function 005B3B6A: RemoveDirectoryW.KERNEL32(00000001,00000000,00000000,00000000,?,?,005BEE95,00000001,00000000,00000095,00000001,005C04DA,00000095,00000000,swidtag,00000001), ref: 005B3B87
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to allocate regid file path., xrefs: 005BEEA9
                                                                                                                                                                                                                        • swidtag, xrefs: 005BEE59
                                                                                                                                                                                                                        • Failed to allocate regid folder path., xrefs: 005BEEB0
                                                                                                                                                                                                                        • Failed to format tag folder path., xrefs: 005BEEB7
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AttributesDirectoryErrorFileLastOpen@16Remove
                                                                                                                                                                                                                        • String ID: Failed to allocate regid file path.$Failed to allocate regid folder path.$Failed to format tag folder path.$swidtag
                                                                                                                                                                                                                        • API String ID: 1428973842-4170906717
                                                                                                                                                                                                                        • Opcode ID: c1981dac0c4bd7612cbd157a0650c1ee6580495488c35b45170387a795aaa9e8
                                                                                                                                                                                                                        • Instruction ID: 777d1361121ce9e07819a54033c7e261dbfbd81faa89073510f33d32807447fd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c1981dac0c4bd7612cbd157a0650c1ee6580495488c35b45170387a795aaa9e8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C4217C32D00519BBCB15EB99CC46AEEBFB9FF84310F14C0A6F504AA1A1D731AE50DB90
                                                                                                                                                                                                                        Function 005D8B73 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 86registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005F0E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,005F5699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 005F0E52
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(00000000,00000001,00000000,000000FF,?,000000FF,00000000,00000000,00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4), ref: 005D8BF7
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,-80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00020019,00000000,00000100,00000100,000001B4,?,?,?,005BF66B,00000001,00000100,000001B4,00000000), ref: 005D8C45
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to open uninstall registry key., xrefs: 005D8BBA
                                                                                                                                                                                                                        • SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 005D8B94
                                                                                                                                                                                                                        • Failed to enumerate uninstall key for related bundles., xrefs: 005D8C56
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseCompareOpenString
                                                                                                                                                                                                                        • String ID: Failed to enumerate uninstall key for related bundles.$Failed to open uninstall registry key.$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
                                                                                                                                                                                                                        • API String ID: 2817536665-2531018330
                                                                                                                                                                                                                        • Opcode ID: 9d589ddf891dc4812fb527336d0f1d50a632b793b543ff99776df6f12599ff0f
                                                                                                                                                                                                                        • Instruction ID: 8ceb95c7e5a613c4e08802582870d1546171896a5ac0597328be53b86f9a9edf
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9d589ddf891dc4812fb527336d0f1d50a632b793b543ff99776df6f12599ff0f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0521B43295111DFBEB255BA8CC49FBEBF79FB00360F244567F500AA1A1CB350E90E690
                                                                                                                                                                                                                        Function 005F3F04 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CopyFileW.KERNEL32(00000000,005B4CB6,00000000,?,?,00000000,?,005F4012,00000000,005B4CB6,00000000,00000000,?,005C83E2,?,?), ref: 005F3F1E
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005F4012,00000000,005B4CB6,00000000,00000000,?,005C83E2,?,?,00000001,00000003,000007D0,?,?,?), ref: 005F3F2C
                                                                                                                                                                                                                        • CopyFileW.KERNEL32(00000000,005B4CB6,00000000,005B4CB6,00000000,?,005F4012,00000000,005B4CB6,00000000,00000000,?,005C83E2,?,?,00000001), ref: 005F3F92
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005F4012,00000000,005B4CB6,00000000,00000000,?,005C83E2,?,?,00000001,00000003,000007D0,?,?,?), ref: 005F3F9C
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CopyErrorFileLast
                                                                                                                                                                                                                        • String ID: fileutil.cpp
                                                                                                                                                                                                                        • API String ID: 374144340-2967768451
                                                                                                                                                                                                                        • Opcode ID: d9895765c364dec21f97e5dd298052df11c8dff6d991cdf40ca95f3ce411ed52
                                                                                                                                                                                                                        • Instruction ID: c8f6bd6d218e442cf6bea549590bc7d249a405e7616bb2729ff124c05af9acf7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d9895765c364dec21f97e5dd298052df11c8dff6d991cdf40ca95f3ce411ed52
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3921C976E4423A9AFB201E658C48B7B7EACFF50BA0B560426FE05DB150D72DCE0192E1
                                                                                                                                                                                                                        Function 005DD047 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80synchronizationCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: GetProcessHeap.KERNEL32(?,000001C7,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38E5
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: RtlAllocateHeap.NTDLL(00000000,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38EC
                                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,000000FF), ref: 005DD0DC
                                                                                                                                                                                                                        • ReleaseMutex.KERNEL32(?), ref: 005DD10A
                                                                                                                                                                                                                        • SetEvent.KERNEL32(?), ref: 005DD113
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Heap$AllocateEventMutexObjectProcessReleaseSingleWait
                                                                                                                                                                                                                        • String ID: Failed to allocate buffer.$NetFxChainer.cpp
                                                                                                                                                                                                                        • API String ID: 944053411-3611226795
                                                                                                                                                                                                                        • Opcode ID: 03fdb18a2f6c16deec66cc9a7a3af55e349ff70b22800b6f88fa8254ff11ae3a
                                                                                                                                                                                                                        • Instruction ID: e614ab2c4a7c528e202f284ef741f33ec772ede4279589d044685d5c20462938
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 03fdb18a2f6c16deec66cc9a7a3af55e349ff70b22800b6f88fa8254ff11ae3a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1121D6B460030AFFEB109F68DC49AA9BBF5FF48314F14862AF924A7351C775A950CB60
                                                                                                                                                                                                                        Function 005B55B6 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 78COMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00001000,?,000000FF,version.dll,000000FF,?,00000000,00000007,005B648B,005B648B,?,005B554A,?,?,00000000), ref: 005B55F2
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005B554A,?,?,00000000,?,00000000,005B648B,?,005B7DDC,?,?,?,?,?), ref: 005B5621
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CompareErrorLastString
                                                                                                                                                                                                                        • String ID: Failed to compare strings.$variable.cpp$version.dll
                                                                                                                                                                                                                        • API String ID: 1733990998-4228644734
                                                                                                                                                                                                                        • Opcode ID: a788a17d68d44aed32c9ba8fa975ca853585cf82ecd1db8b3db6ed93c6c6a210
                                                                                                                                                                                                                        • Instruction ID: e9a7a5c06cfdbc778ba5f9bd5528d160a0cd24dd23b95b6b50182d90e804ed09
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a788a17d68d44aed32c9ba8fa975ca853585cf82ecd1db8b3db6ed93c6c6a210
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7C21D732600615ABD7188FA8CC45BA9BFA4FF49760F610319E915EB2D0EA31AE018690
                                                                                                                                                                                                                        Function 005F57BF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 77COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • QueryServiceConfigW.ADVAPI32(00000000,00000000,00000000,?,00000001,00000000,?,?,005D68CE,00000000,?), ref: 005F57D5
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,005D68CE,00000000,?,?,?,?,?,?,?,?,?,005D6CE1,?,?), ref: 005F57E3
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: GetProcessHeap.KERNEL32(?,000001C7,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38E5
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: RtlAllocateHeap.NTDLL(00000000,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38EC
                                                                                                                                                                                                                        • QueryServiceConfigW.ADVAPI32(00000000,00000000,?,?,?,00000001,?,?,005D68CE,00000000,?), ref: 005F581D
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,005D68CE,00000000,?,?,?,?,?,?,?,?,?,005D6CE1,?,?), ref: 005F5827
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ConfigErrorHeapLastQueryService$AllocateProcess
                                                                                                                                                                                                                        • String ID: svcutil.cpp
                                                                                                                                                                                                                        • API String ID: 355237494-1746323212
                                                                                                                                                                                                                        • Opcode ID: 7388d57a1d21059d4dce7d532d9ed79d696af453c267efc604daed7be4816e1c
                                                                                                                                                                                                                        • Instruction ID: 467871a26ab6fa686b217a8315b7b311302e8498ccaf8964e747c7d28696d2ec
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7388d57a1d21059d4dce7d532d9ed79d696af453c267efc604daed7be4816e1c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F221D876A40629FBE7209A668D09BBB7E9DEF547D0F210115FF04F7110EA69CE00D6E0
                                                                                                                                                                                                                        Function 005B96F4 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 70COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: _memcpy_s
                                                                                                                                                                                                                        • String ID: Failed to find variable.$Failed to parse condition '%ls' at position: %u$Failed to read next symbol.$condition.cpp
                                                                                                                                                                                                                        • API String ID: 2001391462-1605196437
                                                                                                                                                                                                                        • Opcode ID: 9c55bf62a5bbc3272c1c3d8d715a12898c83e7f506ccd292e80fcebf788b8db7
                                                                                                                                                                                                                        • Instruction ID: c6c7d75da26543d5de39bd5f0a5ebeab1b3a19e8049328dc79a7ee6e4e20f89a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9c55bf62a5bbc3272c1c3d8d715a12898c83e7f506ccd292e80fcebf788b8db7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 17112B7229021577DB112D68DC8BEEB3F55FB46710F040451FB04AD2A2CE66E910D3E1
                                                                                                                                                                                                                        Function 005B9D03 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 68COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • _MREFOpen@16.MSPDB140-MSVCRT ref: 005B9D25
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to format path string., xrefs: 005B9D30
                                                                                                                                                                                                                        • Failed get file version., xrefs: 005B9D65
                                                                                                                                                                                                                        • File search: %ls, did not find path: %ls, xrefs: 005B9D90
                                                                                                                                                                                                                        • Failed to set variable., xrefs: 005B9D84
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Open@16
                                                                                                                                                                                                                        • String ID: Failed get file version.$Failed to format path string.$Failed to set variable.$File search: %ls, did not find path: %ls
                                                                                                                                                                                                                        • API String ID: 3613110473-2458530209
                                                                                                                                                                                                                        • Opcode ID: cb51b1d434db906516586b1d9c7fa9d245112dfc4f653868b5cf8e12239acbd5
                                                                                                                                                                                                                        • Instruction ID: e22c09007850e2b541b93460c7f63d0b057333b64c720cd1a1a3dd7096fd1ffe
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: cb51b1d434db906516586b1d9c7fa9d245112dfc4f653868b5cf8e12239acbd5
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0D11B132D0012DBE8B126E958C868FEBF39FF44710F144166FA0467111D6356E10ABD1
                                                                                                                                                                                                                        Function 005C4880 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 67fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • WriteFile.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,00000000,00000000,00000000,?,005C51A4), ref: 005C48CC
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • pipe.cpp, xrefs: 005C4904
                                                                                                                                                                                                                        • Failed to allocate message to write., xrefs: 005C48AB
                                                                                                                                                                                                                        • Failed to write message type to pipe., xrefs: 005C490E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FileWrite
                                                                                                                                                                                                                        • String ID: Failed to allocate message to write.$Failed to write message type to pipe.$pipe.cpp
                                                                                                                                                                                                                        • API String ID: 3934441357-1996674626
                                                                                                                                                                                                                        • Opcode ID: d27eb3f2fd60255a370ae1d8e909ea54a32ad6751202db1f2403d4b905021d38
                                                                                                                                                                                                                        • Instruction ID: 47e8add622476a549181ae6c8f7f868fb9b48a5582101ba290587b4c1bc93fd3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d27eb3f2fd60255a370ae1d8e909ea54a32ad6751202db1f2403d4b905021d38
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 17119D72A40229BFEB219F95DD09FAF7FA9FB40340F11012AF800A2150EB719E50DAA0
                                                                                                                                                                                                                        Function 005F5BBF Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 67timeCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005F5D7F: lstrlenW.KERNEL32(?), ref: 005F5E3D
                                                                                                                                                                                                                          • Part of subcall function 005F5D7F: lstrlenW.KERNEL32(?), ref: 005F5E55
                                                                                                                                                                                                                          • Part of subcall function 005F88BE: GetLastError.KERNEL32(?,?,Qd_,005F5C11,feclient.dll,clbcatq.dll,005FB508,005FB4F0,HEAD,00000000,005FB4D8,Qd_,00000000,?,?,00000000), ref: 005F88E8
                                                                                                                                                                                                                        • GetSystemTimeAsFileTime.KERNEL32(005FB478,feclient.dll,005FB478,feclient.dll,clbcatq.dll,005FB508,005FB4F0,HEAD,00000000,005FB4D8,Qd_,00000000,?,?,00000000,00000000), ref: 005F5C3D
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Timelstrlen$ErrorFileLastSystem
                                                                                                                                                                                                                        • String ID: HEAD$Qd_$clbcatq.dll$feclient.dll
                                                                                                                                                                                                                        • API String ID: 451455982-1776841562
                                                                                                                                                                                                                        • Opcode ID: c75e34bad2d98e0f12b3d94c3c77c697d14b534545492087d28cb195a7d5a88a
                                                                                                                                                                                                                        • Instruction ID: 9b94842477b0e2eef925e524ec57bb04511e0d970a331d6921e0073bc47f2efd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c75e34bad2d98e0f12b3d94c3c77c697d14b534545492087d28cb195a7d5a88a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D5218E7690160DABCB02DFA4CD809FEBBB9FF49354F154125FA05A3210EB359E509BA0
                                                                                                                                                                                                                        Function 005C8003 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 65COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: GetProcessHeap.KERNEL32(?,000001C7,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38E5
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: RtlAllocateHeap.NTDLL(00000000,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38EC
                                                                                                                                                                                                                        • CreateWellKnownSid.ADVAPI32(00000000,00000000,00000000,00000000,00000044,00000001,00000000,00000000,?,?,005C8C10,0000001A,00000000,?,00000000,00000000), ref: 005C804C
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,005C8C10,0000001A,00000000,?,00000000,00000000,?,?,00000000,00000000,?,?,-00000004,00000000), ref: 005C8056
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Heap$AllocateCreateErrorKnownLastProcessWell
                                                                                                                                                                                                                        • String ID: Failed to allocate memory for well known SID.$Failed to create well known SID.$cache.cpp
                                                                                                                                                                                                                        • API String ID: 2186923214-2110050797
                                                                                                                                                                                                                        • Opcode ID: 860603d01ce01b449e18e0c4d54e39d54a4ed3ed41d3ab724a1bdd29b1e54e2a
                                                                                                                                                                                                                        • Instruction ID: ebf87d5474663ece6dc67c0e6c97fa7ed87148394aca55836afdcb73bbc6fd9a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 860603d01ce01b449e18e0c4d54e39d54a4ed3ed41d3ab724a1bdd29b1e54e2a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AC01E972641315BAE72566659C0EFBB6F9DEF80B60F12001EFD04F7180ED659E0192E0
                                                                                                                                                                                                                        Function 005DDB67 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000003E8,000004FF), ref: 005DDB95
                                                                                                                                                                                                                        • PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 005DDBBF
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,005DDD8F,00000000,?,?,?,00000001,00000000), ref: 005DDBC7
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • bitsengine.cpp, xrefs: 005DDBEB
                                                                                                                                                                                                                        • Failed while waiting for download., xrefs: 005DDBF5
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLastMessageMultipleObjectsPeekWait
                                                                                                                                                                                                                        • String ID: Failed while waiting for download.$bitsengine.cpp
                                                                                                                                                                                                                        • API String ID: 435350009-228655868
                                                                                                                                                                                                                        • Opcode ID: 09aaf3561aa394da206c452ac85ab2e1d90a269b55a263911908103eea75e191
                                                                                                                                                                                                                        • Instruction ID: 1eb2243b13b08834261cd7cba801c307eda056b0bd6d7914aaca298b436fa000
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 09aaf3561aa394da206c452ac85ab2e1d90a269b55a263911908103eea75e191
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CE11C672A41329BBF7205AAD9C49EEB7EADFB44720F010127F904E62D0D9659940C5F4
                                                                                                                                                                                                                        Function 005B5E0B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 58COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetComputerNameW.KERNEL32(?,00000010), ref: 005B5E39
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B5E43
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ComputerErrorLastName
                                                                                                                                                                                                                        • String ID: Failed to get computer name.$Failed to set variant value.$variable.cpp
                                                                                                                                                                                                                        • API String ID: 3560734967-484636765
                                                                                                                                                                                                                        • Opcode ID: 6e66456382b13955742beca3264731dad1eedf379d2e1234a53c7a7ee53bcc1a
                                                                                                                                                                                                                        • Instruction ID: cd12c2356a8b27e5e4289e9893fd5eb4c7552475a440e056bf8ebe62cd24eecd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6e66456382b13955742beca3264731dad1eedf379d2e1234a53c7a7ee53bcc1a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 67018632A4161CABD711DAA99D05BEE7BECFB48710F010166ED05F7180EA75AE0886E1
                                                                                                                                                                                                                        Function 005B5D71 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 56COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(?), ref: 005B5D83
                                                                                                                                                                                                                          • Part of subcall function 005F09BB: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,005B5D8F,00000000), ref: 005F09CF
                                                                                                                                                                                                                          • Part of subcall function 005F09BB: GetProcAddress.KERNEL32(00000000), ref: 005F09D6
                                                                                                                                                                                                                          • Part of subcall function 005F09BB: GetLastError.KERNEL32(?,?,?,005B5D8F,00000000), ref: 005F09ED
                                                                                                                                                                                                                          • Part of subcall function 005F3BF7: SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,?), ref: 005F3C24
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to set variant value., xrefs: 005B5DE7
                                                                                                                                                                                                                        • variable.cpp, xrefs: 005B5DAD
                                                                                                                                                                                                                        • Failed to get 64-bit folder., xrefs: 005B5DCD
                                                                                                                                                                                                                        • Failed to get shell folder., xrefs: 005B5DB7
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressCurrentErrorFolderHandleLastModulePathProcProcess
                                                                                                                                                                                                                        • String ID: Failed to get 64-bit folder.$Failed to get shell folder.$Failed to set variant value.$variable.cpp
                                                                                                                                                                                                                        • API String ID: 2084161155-3906113122
                                                                                                                                                                                                                        • Opcode ID: 5ac98b48f3dc91974676b7f123a466bd107fc430c275911649faeab42ec7154b
                                                                                                                                                                                                                        • Instruction ID: e793f3d2f5951ea1db9842e6e0905e058456fe8490c0e7fa0c6bdbbec5d54ac6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5ac98b48f3dc91974676b7f123a466bd107fc430c275911649faeab42ec7154b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EB01707194162DBBDF16A794CC0EFEE7E69BB00750F104265F900B6191EAB8AB40D790
                                                                                                                                                                                                                        Function 005B6644 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 55COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetTempPathW.KERNEL32(00000104,?), ref: 005B667D
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005B6687
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLastPathTemp
                                                                                                                                                                                                                        • String ID: Failed to get temp path.$Failed to set variant value.$variable.cpp
                                                                                                                                                                                                                        • API String ID: 1238063741-2915113195
                                                                                                                                                                                                                        • Opcode ID: 9b31cb175ff79150d3676f82693ea045def63bcc6225743ec9e5e3a93c8aa97a
                                                                                                                                                                                                                        • Instruction ID: 252ca2726c41b92c99a788ec47792f50e1b66b62e85e47a5585c1a1745c3fd6c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9b31cb175ff79150d3676f82693ea045def63bcc6225743ec9e5e3a93c8aa97a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A0018C71A4133D67E720AB689D0AFBA7B98BB04750F104166FD04E7181EA646E0486D5
                                                                                                                                                                                                                        Function 005F4038 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 52fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005F4315: FindFirstFileW.KERNEL32(005D8FFA,?,000002C0,00000000,00000000), ref: 005F4350
                                                                                                                                                                                                                          • Part of subcall function 005F4315: FindClose.KERNEL32(00000000), ref: 005F435C
                                                                                                                                                                                                                        • SetFileAttributesW.KERNEL32(005D8FFA,00000080,00000000,005D8FFA,000000FF,00000000,?,?,005D8FFA), ref: 005F4067
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,005D8FFA), ref: 005F4071
                                                                                                                                                                                                                        • DeleteFileW.KERNEL32(005D8FFA,00000000,005D8FFA,000000FF,00000000,?,?,005D8FFA), ref: 005F4090
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,005D8FFA), ref: 005F409A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: File$ErrorFindLast$AttributesCloseDeleteFirst
                                                                                                                                                                                                                        • String ID: fileutil.cpp
                                                                                                                                                                                                                        • API String ID: 3967264933-2967768451
                                                                                                                                                                                                                        • Opcode ID: 00980c7cc278b81d6e9891279e99ddd5f9ffad67ef62acc57b8aec905217dd02
                                                                                                                                                                                                                        • Instruction ID: 6d695fb8a6c47cfeaf7c0a97c5f4bc6efa562199fe60e2846e0e931de3cd5dea
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 00980c7cc278b81d6e9891279e99ddd5f9ffad67ef62acc57b8aec905217dd02
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AD019231A01729A7E7215AA9CD0CABB7EDCFF00760F014211FE05EA0A0DB298E44E9E5
                                                                                                                                                                                                                        Function 005DD7CC Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(?), ref: 005DD7E1
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(?), ref: 005DD826
                                                                                                                                                                                                                        • SetEvent.KERNEL32(?,?,?,?), ref: 005DD83A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to get state during job modification., xrefs: 005DD7FA
                                                                                                                                                                                                                        • Failure while sending progress during BITS job modification., xrefs: 005DD815
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalSection$EnterEventLeave
                                                                                                                                                                                                                        • String ID: Failed to get state during job modification.$Failure while sending progress during BITS job modification.
                                                                                                                                                                                                                        • API String ID: 3094578987-1258544340
                                                                                                                                                                                                                        • Opcode ID: 6f3fac6d88001332f83292ef8dc611488c41b1925c1a2a7cb69e213e8e2d41f5
                                                                                                                                                                                                                        • Instruction ID: 033422e42d2584d23fdffa6fb5bffcda2790abe1b6c034b7be669500b1cb38bb
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6f3fac6d88001332f83292ef8dc611488c41b1925c1a2a7cb69e213e8e2d41f5
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7C018032601615EBDB229B59D849EAABBB8FB58321B004117F804D7740D774ED54EAE4
                                                                                                                                                                                                                        Function 005DDA45 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 50COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(00000008,?,00000000,00000000,00000000,?,005DDBB5), ref: 005DDA59
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(00000008,?,005DDBB5), ref: 005DDA9E
                                                                                                                                                                                                                        • SetEvent.KERNEL32(?,?,005DDBB5), ref: 005DDAB2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to get BITS job state., xrefs: 005DDA72
                                                                                                                                                                                                                        • Failure while sending progress., xrefs: 005DDA8D
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalSection$EnterEventLeave
                                                                                                                                                                                                                        • String ID: Failed to get BITS job state.$Failure while sending progress.
                                                                                                                                                                                                                        • API String ID: 3094578987-2876445054
                                                                                                                                                                                                                        • Opcode ID: 891bfa9fdd0b52320dd37146437e146269c9626d6555f6b1c1e08072c79b2156
                                                                                                                                                                                                                        • Instruction ID: 13500d9709f9b4c91cc0c48774cfff7c33c59f84e4a9c5fb1f23fee60fbed058
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 891bfa9fdd0b52320dd37146437e146269c9626d6555f6b1c1e08072c79b2156
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2401DE72A04626FBDB219B59D849DAEBBB8FF54321B004217E809D7210DB74AD44D7E4
                                                                                                                                                                                                                        Function 005DD5AF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 48COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • InitializeCriticalSection.KERNEL32(00000008,00000000,00000000,?,005DDD19,?,?,?,?,?,00000001,00000000,?), ref: 005DD5C9
                                                                                                                                                                                                                        • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,?,005DDD19,?,?,?,?,?,00000001,00000000,?), ref: 005DD5D4
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005DDD19,?,?,?,?,?,00000001,00000000,?), ref: 005DD5E1
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • bitsengine.cpp, xrefs: 005DD605
                                                                                                                                                                                                                        • Failed to create BITS job complete event., xrefs: 005DD60F
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CreateCriticalErrorEventInitializeLastSection
                                                                                                                                                                                                                        • String ID: Failed to create BITS job complete event.$bitsengine.cpp
                                                                                                                                                                                                                        • API String ID: 3069647169-3441864216
                                                                                                                                                                                                                        • Opcode ID: c159b276bd025977812ca1bf1b089cf233dddd6bc17a630319e9528ea29a2dc3
                                                                                                                                                                                                                        • Instruction ID: 1c7537fbcaea6bd74f6b4b4c05e7e33071b0539610929ac69ac2f25853836b25
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c159b276bd025977812ca1bf1b089cf233dddd6bc17a630319e9528ea29a2dc3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F9015E72601726BBE7109F6AD805A97BFE8FF49760B014126F908D7640EBB4D850CBE4
                                                                                                                                                                                                                        Function 005BD39D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(000000D0,?,000000B8,00000000,?,005C6E4B,000000B8,00000000,?,00000000,75C0B390), ref: 005BD3AC
                                                                                                                                                                                                                        • InterlockedCompareExchange.KERNEL32(000000E8,00000001,00000000), ref: 005BD3BB
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(000000D0,?,005C6E4B,000000B8,00000000,?,00000000,75C0B390), ref: 005BD3D0
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • userexperience.cpp, xrefs: 005BD3E9
                                                                                                                                                                                                                        • Engine active cannot be changed because it was already in that state., xrefs: 005BD3F3
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalSection$CompareEnterExchangeInterlockedLeave
                                                                                                                                                                                                                        • String ID: Engine active cannot be changed because it was already in that state.$userexperience.cpp
                                                                                                                                                                                                                        • API String ID: 3376869089-1544469594
                                                                                                                                                                                                                        • Opcode ID: 85106b69249e0e5bb466313b2167208bcbfea1343eed3ede16f214bc39b481c5
                                                                                                                                                                                                                        • Instruction ID: b72679d27687969127dec5d72d1c88022a83d31310be13e289d1d5a8912cc147
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 85106b69249e0e5bb466313b2167208bcbfea1343eed3ede16f214bc39b481c5
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4EF0AF76300309ABA7106FA6EC85EA77BBDFBD5764B04442AB601C3541EA78F905C730
                                                                                                                                                                                                                        Function 005F1B28 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 43libraryloaderCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(SRSetRestorePointW,srclient.dll), ref: 005F1B53
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005B48D4,00000001,?,?,005B444C,?,?,?,?,005B535E,?,?,?,?), ref: 005F1B62
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressErrorLastProc
                                                                                                                                                                                                                        • String ID: SRSetRestorePointW$srclient.dll$srputil.cpp
                                                                                                                                                                                                                        • API String ID: 199729137-398595594
                                                                                                                                                                                                                        • Opcode ID: def800c3c9ded0ce41c7f584e902552e0234e70280eb9060cf58cb9569640090
                                                                                                                                                                                                                        • Instruction ID: e74a2e802540e22f3a3b640bbee6a1efe0451f905d45d4264f19420c85f3937d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: def800c3c9ded0ce41c7f584e902552e0234e70280eb9060cf58cb9569640090
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D8F0D67AA41A3AD7E32126758C097B62D95EB10750F068122BE01E6251EA698C40D7E9
                                                                                                                                                                                                                        Function 005E4897 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,005E4848,00000000,?,005E47E8,00000000,00617CF8,0000000C,005E493F,00000000,00000002), ref: 005E48B7
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 005E48CA
                                                                                                                                                                                                                        • FreeLibrary.KERNEL32(00000000,?,?,?,005E4848,00000000,?,005E47E8,00000000,00617CF8,0000000C,005E493F,00000000,00000002), ref: 005E48ED
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressFreeHandleLibraryModuleProc
                                                                                                                                                                                                                        • String ID: CorExitProcess$mscoree.dll
                                                                                                                                                                                                                        • API String ID: 4061214504-1276376045
                                                                                                                                                                                                                        • Opcode ID: f27687f567d2b06ea571861679491121714edf59ce199dc085a4cdb67f864b49
                                                                                                                                                                                                                        • Instruction ID: 7a3f1bd2052a575b4742f7ca971b88e65dcd80f1c22cb185402004e424619305
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f27687f567d2b06ea571861679491121714edf59ce199dc085a4cdb67f864b49
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D8F08C30A00248FBDB159BA1DC09BEEBFB9FF48712F004169F805A6290DB344A44DB90
                                                                                                                                                                                                                        Function 005F937F Relevance: 7.6, APIs: 5, Instructions: 119registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005F0E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,005F5699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 005F0E52
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000001,00000001,?,00000000,00000001,?,00000000,00000001,00000000,00020019,00000001,00000000,00000000,00020019,00000000,00000001), ref: 005F9457
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,?,00000000,00000001,?,00000000,00000001,00000000,00020019), ref: 005F9492
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000001,00000001,00020019,00000000,00000000,00000000,00000000), ref: 005F94AE
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000), ref: 005F94BB
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,00000001,00020019,00000000,00000000,00000000,00000000), ref: 005F94C8
                                                                                                                                                                                                                          • Part of subcall function 005F0B49: RegCloseKey.ADVAPI32(00000000), ref: 005F0CA0
                                                                                                                                                                                                                          • Part of subcall function 005F0E9B: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,005F9444,00000001), ref: 005F0EB3
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Close$InfoOpenQuery
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 796878624-0
                                                                                                                                                                                                                        • Opcode ID: 1d1adc47d453733fed90d5940040cde38cd5ba477059c0e2125c52830a3cf768
                                                                                                                                                                                                                        • Instruction ID: 2457e04226dde73b154331a521a2d4d5ca1814e56fe91cebcefd9b894638b6d7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1d1adc47d453733fed90d5940040cde38cd5ba477059c0e2125c52830a3cf768
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 02413B76C0162DFFCF12AF95CC85AADFF79FF14760B15416AEA0066121C33A4E41AA91
                                                                                                                                                                                                                        Function 005B88DE Relevance: 7.6, APIs: 5, Instructions: 118stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,005B8A9E,005B95E7,?,005B95E7,?,?,005B95E7,?,?), ref: 005B88FE
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,?,00000000,00000000,?,?,005B8A9E,005B95E7,?,005B95E7,?,?,005B95E7,?,?), ref: 005B8906
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,?,?,?,?,00000000,?,00000000,00000000,?,?,005B8A9E,005B95E7,?,005B95E7,?), ref: 005B8955
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,005B8A9E,005B95E7,?,005B95E7,?), ref: 005B89B7
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,?,?,00000000,?,00000000,?,00000000,00000000,?,?,005B8A9E,005B95E7,?,005B95E7,?), ref: 005B89E4
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CompareString$lstrlen
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1657112622-0
                                                                                                                                                                                                                        • Opcode ID: 150420397265b476ee9b1fb01f00b1123f5074084a9dd0c329683f24d93baf40
                                                                                                                                                                                                                        • Instruction ID: 88fba9cad159844260662b0189f7f506525cc745e45af561e5eb24c79ec55f61
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 150420397265b476ee9b1fb01f00b1123f5074084a9dd0c329683f24d93baf40
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DA317372600109FFDF218E58CC88AFE7F6EFB893A0F145415F95997210CA31A990DB92
                                                                                                                                                                                                                        Function 005B21BC Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 117COMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(8007139F,00000000,?,?,00000000,00000000,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B2202
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00000000,00000000,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B220E
                                                                                                                                                                                                                          • Part of subcall function 005B3B51: GetProcessHeap.KERNEL32(00000000,000001C7,?,005B21DC,000001C7,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B3B59
                                                                                                                                                                                                                          • Part of subcall function 005B3B51: HeapSize.KERNEL32(00000000,?,005B21DC,000001C7,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B3B60
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Heap$ByteCharErrorLastMultiProcessSizeWide
                                                                                                                                                                                                                        • String ID: strutil.cpp
                                                                                                                                                                                                                        • API String ID: 3662877508-3612885251
                                                                                                                                                                                                                        • Opcode ID: ebba8c27d41c67da9b0432c0b61f72653a94d98901f7b12b56e325c4df906c30
                                                                                                                                                                                                                        • Instruction ID: f37641d4495d0185814084136906f9345763dcc96d2b538fe880d0fa908450e0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ebba8c27d41c67da9b0432c0b61f72653a94d98901f7b12b56e325c4df906c30
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7C31F836600216EBEB149A69CC48AE7BFD9FF45360F114229FD15DB2A0EA31EC00D7B0
                                                                                                                                                                                                                        Function 005B738E Relevance: 7.5, APIs: 2, Strings: 3, Instructions: 46COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(005B52B5,WixBundleOriginalSource,?,?,005CA41D,005B53B5,WixBundleOriginalSource,=S[,0061AA90,?,00000000,005B533D,?,005C7587,?,?), ref: 005B739A
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(005B52B5,005B52B5,00000000,00000000,?,?,005CA41D,005B53B5,WixBundleOriginalSource,=S[,0061AA90,?,00000000,005B533D,?,005C7587), ref: 005B7401
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to get value of variable: %ls, xrefs: 005B73D4
                                                                                                                                                                                                                        • WixBundleOriginalSource, xrefs: 005B7396
                                                                                                                                                                                                                        • Failed to get value as string for variable: %ls, xrefs: 005B73F0
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                        • String ID: Failed to get value as string for variable: %ls$Failed to get value of variable: %ls$WixBundleOriginalSource
                                                                                                                                                                                                                        • API String ID: 3168844106-30613933
                                                                                                                                                                                                                        • Opcode ID: bb1a644ffc0a8b23e157ca0a9729211c19fc797ee2582d68823dcacfbc50703e
                                                                                                                                                                                                                        • Instruction ID: 1ee679bb5f677be88d394f4ebac048e7e018fd5598e022c7acb121462938d36d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bb1a644ffc0a8b23e157ca0a9729211c19fc797ee2582d68823dcacfbc50703e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4C014C3294452DFBCB115F54CC09AEE3FA4BB58761F208525BD14AA220D739AE10E7D0
                                                                                                                                                                                                                        Function 005DCEF5 Relevance: 7.5, APIs: 5, Instructions: 41fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,00000000,?,00000000,?,005DCEEB,00000000), ref: 005DCF10
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,005DCEEB,00000000), ref: 005DCF1C
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(005FB508,00000000,?,00000000,?,005DCEEB,00000000), ref: 005DCF29
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,00000000,?,00000000,?,005DCEEB,00000000), ref: 005DCF36
                                                                                                                                                                                                                        • UnmapViewOfFile.KERNEL32(005FB4D8,00000000,?,005DCEEB,00000000), ref: 005DCF45
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseHandle$FileUnmapView
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 260491571-0
                                                                                                                                                                                                                        • Opcode ID: 7995fcc7fb6058378326064a99fa702484a0a2774d1b6d34300d02bb32b29225
                                                                                                                                                                                                                        • Instruction ID: 63eab8836db67db5ec4f576e4e0772291b0fe8c2cab8d14640c7f28dbf449fee
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7995fcc7fb6058378326064a99fa702484a0a2774d1b6d34300d02bb32b29225
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3801D276405B1ADFCB306F6AD890856FFEABF50711315883FE29692A21C771A840DF90
                                                                                                                                                                                                                        Function 005F79CC Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 162COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: GetProcessHeap.KERNEL32(?,000001C7,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38E5
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: RtlAllocateHeap.NTDLL(00000000,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38EC
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F7B2C
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F7B37
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F7B42
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FreeString$Heap$AllocateProcess
                                                                                                                                                                                                                        • String ID: atomutil.cpp
                                                                                                                                                                                                                        • API String ID: 2724874077-4059165915
                                                                                                                                                                                                                        • Opcode ID: 6d34700efad34c81e2f85a1ac063585b96675899dce8b399d5f1f7935fed6f75
                                                                                                                                                                                                                        • Instruction ID: 1b577d04feeab2816cfd90ee97828ef47d80aa97b4b2d9595c8789788b31486b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6d34700efad34c81e2f85a1ac063585b96675899dce8b399d5f1f7935fed6f75
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 93518171E0422EAFDB11DB64C844EBEBBB9BF49754F110564EA05AB150EB74EE00DBA0
                                                                                                                                                                                                                        Function 005F85CB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 137timeCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 005F86D8
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005F86E2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Time$ErrorFileLastSystem
                                                                                                                                                                                                                        • String ID: clbcatq.dll$timeutil.cpp
                                                                                                                                                                                                                        • API String ID: 2781989572-961924111
                                                                                                                                                                                                                        • Opcode ID: 81f96220ecbbb1511c9e7595a39e93ed0b2bd1cac7737c67b7cbf29c0a5a482d
                                                                                                                                                                                                                        • Instruction ID: ce455f503781e670e1ee4aa79858e6f13698d5d14ac0ca233bc1796779f64041
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 81f96220ecbbb1511c9e7595a39e93ed0b2bd1cac7737c67b7cbf29c0a5a482d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7E410771B4020A76EF24ABB88C45BBF7B69FFA1741F144519B601E7190DD39DE0083A5
                                                                                                                                                                                                                        Function 005F35A4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 122memoryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • VariantInit.OLEAUT32(000002C0), ref: 005F35BE
                                                                                                                                                                                                                        • SysAllocString.OLEAUT32(?), ref: 005F35CE
                                                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 005F36AF
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Variant$AllocClearInitString
                                                                                                                                                                                                                        • String ID: xmlutil.cpp
                                                                                                                                                                                                                        • API String ID: 2213243845-1270936966
                                                                                                                                                                                                                        • Opcode ID: 9ac56586060fc82a27e5623263b61476746afddb893152c5fb8211cdae53b276
                                                                                                                                                                                                                        • Instruction ID: 3d2ab689f1596095bfa5adad83202396f61b75e9c92abbd381af33966a1360e6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9ac56586060fc82a27e5623263b61476746afddb893152c5fb8211cdae53b276
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AF41637190062AABDF119FA5C888EBABBB8BF49710F1545A5FD05EB311D738DD008BA0
                                                                                                                                                                                                                        Function 005F0D1C Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,005D8BD8), ref: 005F0D77
                                                                                                                                                                                                                        • RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,005D8BD8,00000000), ref: 005F0D99
                                                                                                                                                                                                                        • RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000003,?,?,005D8BD8,00000000,00000000,00000000), ref: 005F0DF1
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Enum$InfoQuery
                                                                                                                                                                                                                        • String ID: regutil.cpp
                                                                                                                                                                                                                        • API String ID: 73471667-955085611
                                                                                                                                                                                                                        • Opcode ID: 8da9ec216d220935553c2c47a2c64282de5cc290c675d26755ed2cd465c2fee6
                                                                                                                                                                                                                        • Instruction ID: a15e2012f75f3fec2b92a4b3ebc690b9f88be945257a03276fe4555542bea305
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8da9ec216d220935553c2c47a2c64282de5cc290c675d26755ed2cd465c2fee6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7A31A3B6A0112DFFEB218A998D44EBBBFADFF04390F155066BE04E7191D7349E1096A0
                                                                                                                                                                                                                        Function 005F78C5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 106COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: GetProcessHeap.KERNEL32(?,000001C7,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38E5
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: RtlAllocateHeap.NTDLL(00000000,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38EC
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F79AA
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(?), ref: 005F79B5
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F79C0
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FreeString$Heap$AllocateProcess
                                                                                                                                                                                                                        • String ID: atomutil.cpp
                                                                                                                                                                                                                        • API String ID: 2724874077-4059165915
                                                                                                                                                                                                                        • Opcode ID: 31e00114ba90ee7d88e9b9b77d6eb822d06259f803d772766cbb94236ab8d2da
                                                                                                                                                                                                                        • Instruction ID: 5a6e0c994a4908d7144f3fed84011337ee12bff3c8c7b2ccc099ba15bdee1419
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 31e00114ba90ee7d88e9b9b77d6eb822d06259f803d772766cbb94236ab8d2da
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E6318672D0562EBBDB12AB64CD45ABEBFB8FF48710F0145A1FA04AB150D675ED00DBA0
                                                                                                                                                                                                                        Function 005D88CF Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005F0E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,005F5699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 005F0E52
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,00000000,00000088,00000000,000002C0,00000410,00020019,00000000,000002C0,00000000,?,?,?,005D8C14,00000000,00000000), ref: 005D898C
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to initialize package from related bundle id: %ls, xrefs: 005D8972
                                                                                                                                                                                                                        • Failed to open uninstall key for potential related bundle: %ls, xrefs: 005D88FB
                                                                                                                                                                                                                        • Failed to ensure there is space for related bundles., xrefs: 005D893F
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseOpen
                                                                                                                                                                                                                        • String ID: Failed to ensure there is space for related bundles.$Failed to initialize package from related bundle id: %ls$Failed to open uninstall key for potential related bundle: %ls
                                                                                                                                                                                                                        • API String ID: 47109696-1717420724
                                                                                                                                                                                                                        • Opcode ID: 9ca13ed5e2838f30e50fb8ea7542e00e83d306b4a0b6639de4e2218728801f54
                                                                                                                                                                                                                        • Instruction ID: 0440e2acf3dbcc529205f11216196adf87def0def4dfdce428f021ab685c0e2d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9ca13ed5e2838f30e50fb8ea7542e00e83d306b4a0b6639de4e2218728801f54
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7321A43294061AFBDB269B88CC05BBEBF79FF00710F144557F900A6250DB759E20E792
                                                                                                                                                                                                                        Function 005B3A97 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 75memoryCOMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetProcessHeap.KERNEL32(00000010,00000000,80004005,00000000,00000000,00000100,?,005B1472,00000000,80004005,00000000,80004005,00000000,000001C7,?,005B13B7), ref: 005B3AB2
                                                                                                                                                                                                                        • HeapReAlloc.KERNEL32(00000000,?,005B1472,00000000,80004005,00000000,80004005,00000000,000001C7,?,005B13B7,000001C7,00000100,?,80004005,00000000), ref: 005B3AB9
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: GetProcessHeap.KERNEL32(?,000001C7,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38E5
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: RtlAllocateHeap.NTDLL(00000000,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38EC
                                                                                                                                                                                                                          • Part of subcall function 005B3B51: GetProcessHeap.KERNEL32(00000000,000001C7,?,005B21DC,000001C7,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B3B59
                                                                                                                                                                                                                          • Part of subcall function 005B3B51: HeapSize.KERNEL32(00000000,?,005B21DC,000001C7,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B3B60
                                                                                                                                                                                                                        • _memcpy_s.LIBCMT ref: 005B3B04
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Heap$Process$AllocAllocateSize_memcpy_s
                                                                                                                                                                                                                        • String ID: memutil.cpp
                                                                                                                                                                                                                        • API String ID: 3406509257-2429405624
                                                                                                                                                                                                                        • Opcode ID: b16c1d3e360c3ad31ccd7f6c44d85b3fee4f3aebb86e629860e0e3e182f729d0
                                                                                                                                                                                                                        • Instruction ID: b0618c0eafe403c3d279e155ac732a6ec8ddc4f93282bf8ed390a16d607199c1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b16c1d3e360c3ad31ccd7f6c44d85b3fee4f3aebb86e629860e0e3e182f729d0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4811EE32601629BFDB222E28DC59DEE3E59FF84760F104325F915AB291CB71EF5093A0
                                                                                                                                                                                                                        Function 005C3955 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 69registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005F0E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,005F5699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 005F0E52
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,SOFTWARE\Policies\Microsoft\Windows\Installer,00020019,00000001,feclient.dll,?,?,?,005C3E61,feclient.dll,?,00000000,?,?,?,005B4A0C), ref: 005C39F1
                                                                                                                                                                                                                          • Part of subcall function 005F0F6E: RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 005F0FE4
                                                                                                                                                                                                                          • Part of subcall function 005F0F6E: RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 005F101F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: QueryValue$CloseOpen
                                                                                                                                                                                                                        • String ID: Logging$SOFTWARE\Policies\Microsoft\Windows\Installer$feclient.dll
                                                                                                                                                                                                                        • API String ID: 1586453840-3596319545
                                                                                                                                                                                                                        • Opcode ID: 160b740528359f058ce423de21f7a32a666bb55adb5417bcbbe86f5707af3ef8
                                                                                                                                                                                                                        • Instruction ID: 8fb6568c60a6956843bfb78788a38275a02991d8736e5f4749e586c67e460757
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 160b740528359f058ce423de21f7a32a666bb55adb5417bcbbe86f5707af3ef8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 12117F22B4020CAFDB218ED5DD46FBEBF68BB40B41F50806AE60196190E6B59F81E750
                                                                                                                                                                                                                        Function 005F0658 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62filestringCOMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • lstrlenA.KERNEL32(?,00000000,00000000,00000000,?,?,005EFF0B,?,?,00000000,00000000,0000FDE9), ref: 005F066A
                                                                                                                                                                                                                        • WriteFile.KERNEL32(FFFFFFFF,00000000,00000000,00000000,00000000,?,?,005EFF0B,?,?,00000000,00000000,0000FDE9), ref: 005F06A6
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,005EFF0B,?,?,00000000,00000000,0000FDE9), ref: 005F06B0
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorFileLastWritelstrlen
                                                                                                                                                                                                                        • String ID: logutil.cpp
                                                                                                                                                                                                                        • API String ID: 606256338-3545173039
                                                                                                                                                                                                                        • Opcode ID: 054eac42138f18eb175d2aeb71fd6a74f5375e852a0510ab8a537e14bea349ed
                                                                                                                                                                                                                        • Instruction ID: 5c0ef4ca80335dc77df2c91a50df76ac9e64f8a8dd30e6c0662cfdc7dc6913f6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 054eac42138f18eb175d2aeb71fd6a74f5375e852a0510ab8a537e14bea349ed
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CC110672A01229AB93109AA5CC48DFFBEADFBD0760B054215FE01D7181DA34AE10C6E0
                                                                                                                                                                                                                        Function 005B1209 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,005B5137,00000000,?), ref: 005B1247
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,005B5137,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 005B1251
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ArgvCommandErrorLastLine
                                                                                                                                                                                                                        • String ID: apputil.cpp$ignored
                                                                                                                                                                                                                        • API String ID: 3459693003-568828354
                                                                                                                                                                                                                        • Opcode ID: 9fc3c5746f25abfd4290b738d1ad6a9b61eb5a0bc440da703504885f419322e8
                                                                                                                                                                                                                        • Instruction ID: 2b78dbcae35d4deafc944aaabf3b3b33f17e9b78006f3cf32daa35b293a8ab2c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9fc3c5746f25abfd4290b738d1ad6a9b61eb5a0bc440da703504885f419322e8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BC116D75A00629EB9B51DB99C805DEFBFA8FF44750B014165FD04E7210EB34EE00DAA4
                                                                                                                                                                                                                        Function 005DCF56 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 58synchronizationCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • WaitForSingleObject.KERNEL32(?,000000FF,00000002,00000000,?,?,005DD1DC,00000000,00000000,00000000,?), ref: 005DCF66
                                                                                                                                                                                                                        • ReleaseMutex.KERNEL32(?,?,005DD1DC,00000000,00000000,00000000,?), ref: 005DCFED
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: GetProcessHeap.KERNEL32(?,000001C7,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38E5
                                                                                                                                                                                                                          • Part of subcall function 005B38D4: RtlAllocateHeap.NTDLL(00000000,?,005B2284,000001C7,00000001,80004005,8007139F,?,?,005F015F,8007139F,?,00000000,00000000,8007139F), ref: 005B38EC
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to allocate memory for message data, xrefs: 005DCFB5
                                                                                                                                                                                                                        • NetFxChainer.cpp, xrefs: 005DCFAB
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Heap$AllocateMutexObjectProcessReleaseSingleWait
                                                                                                                                                                                                                        • String ID: Failed to allocate memory for message data$NetFxChainer.cpp
                                                                                                                                                                                                                        • API String ID: 2993511968-1624333943
                                                                                                                                                                                                                        • Opcode ID: 5dd6e5dec1553b7d5e04f1b5c35f2e7a2bd095cad69709104703bc8f4196b6f6
                                                                                                                                                                                                                        • Instruction ID: 1eecf9ad6c9915527429a8ee2370b20c77f7d7826a1e8d81f5a49b76bef52b57
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5dd6e5dec1553b7d5e04f1b5c35f2e7a2bd095cad69709104703bc8f4196b6f6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1111C1B1300216EFDB14CF28D895EAABFA5FF49320F14416AF9059B391C771AC10CBA4
                                                                                                                                                                                                                        Function 005B1F78 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • FormatMessageW.KERNEL32(000011FF,005B5386,?,00000000,00000000,00000000,?,80070656,?,?,?,005CE50B,00000000,005B5386,00000000,80070656), ref: 005B1FAA
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,005CE50B,00000000,005B5386,00000000,80070656,?,?,005C3F6B,005B5386,?,80070656,00000001,crypt32.dll), ref: 005B1FB7
                                                                                                                                                                                                                        • LocalFree.KERNEL32(00000000,?,00000000,00000000,?,?,?,005CE50B,00000000,005B5386,00000000,80070656,?,?,005C3F6B,005B5386), ref: 005B1FFE
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorFormatFreeLastLocalMessage
                                                                                                                                                                                                                        • String ID: strutil.cpp
                                                                                                                                                                                                                        • API String ID: 1365068426-3612885251
                                                                                                                                                                                                                        • Opcode ID: 4eeadf9f9277e8ab6397f0a58624ce955994027e39e34e4fa9a0f5f79afc67cd
                                                                                                                                                                                                                        • Instruction ID: 6ccf9a1b2d5c91dd87dbf8685108b37b78ca84bb65d686837b1400e904f37fde
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 4eeadf9f9277e8ab6397f0a58624ce955994027e39e34e4fa9a0f5f79afc67cd
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: BD115EB6910229FBEB159F94CC09AEF7EA9FB08340F004169BD01E2150EB755E14DBE4
                                                                                                                                                                                                                        Function 005CFC51 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 50COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to allocate new BootstrapperEngineForApplication object., xrefs: 005CFC8E
                                                                                                                                                                                                                        • Failed to QI for IBootstrapperEngine from BootstrapperEngineForApplication object., xrefs: 005CFCB0
                                                                                                                                                                                                                        • EngineForApplication.cpp, xrefs: 005CFC84
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: EngineForApplication.cpp$Failed to QI for IBootstrapperEngine from BootstrapperEngineForApplication object.$Failed to allocate new BootstrapperEngineForApplication object.
                                                                                                                                                                                                                        • API String ID: 0-1509993410
                                                                                                                                                                                                                        • Opcode ID: bee05e8d60546a0e03787ce664420868efb40a083d2557d2dd4205e294aac178
                                                                                                                                                                                                                        • Instruction ID: 39f59c7a6c26c741c7504f0289daf835813d67a79afc77f25d8a42d94b9230b0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bee05e8d60546a0e03787ce664420868efb40a083d2557d2dd4205e294aac178
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4AF0D63238871B7F87162794DC0AEAF7F5AFF85B60711002AFD04AA2D1EE649D0192A5
                                                                                                                                                                                                                        Function 005F4C67 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateFileW.KERNEL32(005FB4F0,40000000,00000001,00000000,00000002,00000080,00000000,005C0328,00000000,?,005BF37F,?,00000080,005FB4F0,00000000), ref: 005F4C7F
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005BF37F,?,00000080,005FB4F0,00000000,?,005C0328,?,00000094,?,?,?,?,?,00000000), ref: 005F4C8C
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,00000000,?,005BF37F,?,005BF37F,?,00000080,005FB4F0,00000000,?,005C0328,?,00000094), ref: 005F4CE0
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                        • String ID: fileutil.cpp
                                                                                                                                                                                                                        • API String ID: 2528220319-2967768451
                                                                                                                                                                                                                        • Opcode ID: a7547718e8ccd60613317a27b21d8f0d05da15c4c9c46cd7f81c54adaebdaa1d
                                                                                                                                                                                                                        • Instruction ID: 873a9e405867989047791cbec31a4669af37afac888fbd8415f4d978c165af2c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a7547718e8ccd60613317a27b21d8f0d05da15c4c9c46cd7f81c54adaebdaa1d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DF01D436741228A7E7215E698C09FAB3E99EB447B0F014210FF24E71E0CB358C11ABA0
                                                                                                                                                                                                                        Function 005F4840 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateFileW.KERNEL32(00000000,00000080,00000001,00000000,00000003,00000080,00000000,000002C0,00000000,?,005D8A30,00000000,00000088,000002C0,BundleCachePath,00000000), ref: 005F4874
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005D8A30,00000000,00000088,000002C0,BundleCachePath,00000000,000002C0,BundleVersion,000000B8,000002C0,EngineVersion,000002C0,000000B0), ref: 005F4881
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CreateErrorFileLast
                                                                                                                                                                                                                        • String ID: fileutil.cpp
                                                                                                                                                                                                                        • API String ID: 1214770103-2967768451
                                                                                                                                                                                                                        • Opcode ID: 2426420df440e78e323edf6e27ff859908480d45bd3b78215366f74cd903869f
                                                                                                                                                                                                                        • Instruction ID: 3838c60635ecc86e51d782bb537fae66ebf76526050ae3e435743ecff95576b5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2426420df440e78e323edf6e27ff859908480d45bd3b78215366f74cd903869f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C4018676640224B7F72126A5EC0DFBB2E9CEB54BA0F114221FF05FB1D0CA694D45A7E4
                                                                                                                                                                                                                        Function 005D69A8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 48serviceCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ControlService.ADVAPI32(005D68BA,00000001,?,00000001,00000000,?,?,?,?,?,?,005D68BA,00000000), ref: 005D69D0
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?,005D68BA,00000000), ref: 005D69DA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ControlErrorLastService
                                                                                                                                                                                                                        • String ID: Failed to stop wusa service.$msuengine.cpp
                                                                                                                                                                                                                        • API String ID: 4114567744-2259829683
                                                                                                                                                                                                                        • Opcode ID: cd3dc4632856f4f4724cb6d7c6fd148d0634fece7032ffe4185bdc08a348e15b
                                                                                                                                                                                                                        • Instruction ID: d0233c8adc461fe0e0d0a615d71a26f23a40f2fe242fa0fb829dabad6860f8da
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: cd3dc4632856f4f4724cb6d7c6fd148d0634fece7032ffe4185bdc08a348e15b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C201DB72B40228ABE7209BB99C05EFB7BE9EB48750F01412AFD04FB180DA249D0582E5
                                                                                                                                                                                                                        Function 005CEA72 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38threadwindowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PostThreadMessageW.USER32(?,00009002,00000000,?), ref: 005CEA9A
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005CEAA4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to post elevate message., xrefs: 005CEAD2
                                                                                                                                                                                                                        • EngineForApplication.cpp, xrefs: 005CEAC8
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLastMessagePostThread
                                                                                                                                                                                                                        • String ID: EngineForApplication.cpp$Failed to post elevate message.
                                                                                                                                                                                                                        • API String ID: 2609174426-4098423239
                                                                                                                                                                                                                        • Opcode ID: a5a67768789d85c329e1247605ca30abcd45d62feec4897708627a1834690d9e
                                                                                                                                                                                                                        • Instruction ID: 5152357d3930efc4cbce10d668c17131f280f300a7f0454fb51c65e5bb594094
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a5a67768789d85c329e1247605ca30abcd45d62feec4897708627a1834690d9e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 20F06236740321AFE7246A989C0EEA77B85FB04760B114229BE19EA1D1DB298D01D6D5
                                                                                                                                                                                                                        Function 005BD7CF Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 36libraryloaderCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(?,BootstrapperApplicationDestroy), ref: 005BD7F6
                                                                                                                                                                                                                        • FreeLibrary.KERNEL32(?,?,005B47D1,00000000,?,?,005B5386,?,?), ref: 005BD805
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005B47D1,00000000,?,?,005B5386,?,?), ref: 005BD80F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • BootstrapperApplicationDestroy, xrefs: 005BD7EE
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressErrorFreeLastLibraryProc
                                                                                                                                                                                                                        • String ID: BootstrapperApplicationDestroy
                                                                                                                                                                                                                        • API String ID: 1144718084-3186005537
                                                                                                                                                                                                                        • Opcode ID: 203531aadaea4194b63bd1712ba3fc8ec426a6592029cc13c387b710b670b40b
                                                                                                                                                                                                                        • Instruction ID: 7898f8c31faf787a8e9fbb09a9124497b5f796948c6249172b9264bdafc9bf6a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 203531aadaea4194b63bd1712ba3fc8ec426a6592029cc13c387b710b670b40b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B7F0F9362007009FE7205F66DC08AA7BBF9FF90762B01C52EE566C6560EB79E814DB60
                                                                                                                                                                                                                        Function 005F3C58 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36comCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CLSIDFromProgID.OLE32(Microsoft.Update.AutoUpdate,^S[,?,00000000,005B535E,?,?,?), ref: 005F3C7F
                                                                                                                                                                                                                        • CoCreateInstance.OLE32(00000000,00000000,00000001,00616F3C,?), ref: 005F3C97
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CreateFromInstanceProg
                                                                                                                                                                                                                        • String ID: Microsoft.Update.AutoUpdate$^S[
                                                                                                                                                                                                                        • API String ID: 2151042543-2900674870
                                                                                                                                                                                                                        • Opcode ID: 0a9e97b50a294bb75f50e6dfe2eea32db1715a7d2dd076098a025cf5f6d3ca43
                                                                                                                                                                                                                        • Instruction ID: 3ac6d6acb63bba9feb5b2be06cf5e7b4323a57468e28d51b9617617327b116ce
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0a9e97b50a294bb75f50e6dfe2eea32db1715a7d2dd076098a025cf5f6d3ca43
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D1F03075641208BBEB10DBA8DD059FBBBB9EB48710F510466FA01E7150D670AE08D6A2
                                                                                                                                                                                                                        Function 005CF086 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33threadwindowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PostThreadMessageW.USER32(?,00009001,00000000,?), ref: 005CF09B
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005CF0A5
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to post plan message., xrefs: 005CF0D3
                                                                                                                                                                                                                        • EngineForApplication.cpp, xrefs: 005CF0C9
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLastMessagePostThread
                                                                                                                                                                                                                        • String ID: EngineForApplication.cpp$Failed to post plan message.
                                                                                                                                                                                                                        • API String ID: 2609174426-2952114608
                                                                                                                                                                                                                        • Opcode ID: 12719c86520d4e59842647b7ad24406b97900569134966c0fa6b3766b3a20e47
                                                                                                                                                                                                                        • Instruction ID: e530f318d50546cc2f98280578671e37262b7306e0d70b68cdbebe36b2b092d9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 12719c86520d4e59842647b7ad24406b97900569134966c0fa6b3766b3a20e47
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FFF0A7327803306BE72026A99C09E977FC9EF04BA0F024025FD08E60D1D6158D00D6E4
                                                                                                                                                                                                                        Function 005CF194 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33threadwindowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PostThreadMessageW.USER32(?,00009005,?,00000000), ref: 005CF1A9
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005CF1B3
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to post shutdown message., xrefs: 005CF1E1
                                                                                                                                                                                                                        • EngineForApplication.cpp, xrefs: 005CF1D7
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLastMessagePostThread
                                                                                                                                                                                                                        • String ID: EngineForApplication.cpp$Failed to post shutdown message.
                                                                                                                                                                                                                        • API String ID: 2609174426-188808143
                                                                                                                                                                                                                        • Opcode ID: 74e28d9dc52dde452e6d0894e1d6911b39ebe6e7473252a1645178fd9f80ab6e
                                                                                                                                                                                                                        • Instruction ID: c079e8735a377afe18be961fd46285485832ced62a81b359318746cae92d8ac5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 74e28d9dc52dde452e6d0894e1d6911b39ebe6e7473252a1645178fd9f80ab6e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D2F037327813356BE7246AA9DC0DE977BC9EF44BA0F024025BD08E61D1DA559D00D7E5
                                                                                                                                                                                                                        Function 005D051A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SetEvent.KERNEL32(005FB468,00000000,?,005D145A,?,00000000,?,005BC121,?,005B52FD,?,005C73B2,?,?,005B52FD,?), ref: 005D0524
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005D145A,?,00000000,?,005BC121,?,005B52FD,?,005C73B2,?,?,005B52FD,?,005B533D,00000001), ref: 005D052E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to set begin operation event., xrefs: 005D055C
                                                                                                                                                                                                                        • cabextract.cpp, xrefs: 005D0552
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorEventLast
                                                                                                                                                                                                                        • String ID: Failed to set begin operation event.$cabextract.cpp
                                                                                                                                                                                                                        • API String ID: 3848097054-4159625223
                                                                                                                                                                                                                        • Opcode ID: f258d12543c6aa150b9384ebc86bdd7461f6ee7f6c557230f3c2085bbcfeaa5b
                                                                                                                                                                                                                        • Instruction ID: 5acbce2c50202f63308ca336c4354cac102f8155ffcd40c489d0e3767bd2275b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f258d12543c6aa150b9384ebc86bdd7461f6ee7f6c557230f3c2085bbcfeaa5b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D0F0A773A4073167A72066A9AC09BA77AD8EF447A0F020127FD05E7190EA159D0096E9
                                                                                                                                                                                                                        Function 005CE978 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33threadwindowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PostThreadMessageW.USER32(?,00009003,00000000,?), ref: 005CE98D
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005CE997
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to post apply message., xrefs: 005CE9C5
                                                                                                                                                                                                                        • EngineForApplication.cpp, xrefs: 005CE9BB
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLastMessagePostThread
                                                                                                                                                                                                                        • String ID: EngineForApplication.cpp$Failed to post apply message.
                                                                                                                                                                                                                        • API String ID: 2609174426-1304321051
                                                                                                                                                                                                                        • Opcode ID: f10db3b6c69584e3f232c21a7063671e5c48f7c1b43f31daee89e0cb74a8a913
                                                                                                                                                                                                                        • Instruction ID: 1b98dd8a419edac96ca5f407b88297695db1d1af42f0c5c0e4a6bb3d464cff7d
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f10db3b6c69584e3f232c21a7063671e5c48f7c1b43f31daee89e0cb74a8a913
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2DF06C327803356BE72576A99C09F977FC9EF44BA0F024025FD08E61D1D6259D10D6E5
                                                                                                                                                                                                                        Function 005CEA09 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33threadwindowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PostThreadMessageW.USER32(?,00009000,00000000,?), ref: 005CEA1E
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005CEA28
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to post detect message., xrefs: 005CEA56
                                                                                                                                                                                                                        • EngineForApplication.cpp, xrefs: 005CEA4C
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLastMessagePostThread
                                                                                                                                                                                                                        • String ID: EngineForApplication.cpp$Failed to post detect message.
                                                                                                                                                                                                                        • API String ID: 2609174426-598219917
                                                                                                                                                                                                                        • Opcode ID: aef5186cf3283b0737eec85e915ad319ca424f2a6eb738ed6f3434f855295479
                                                                                                                                                                                                                        • Instruction ID: a5c11b61d267aae0d513a9e57e55256eb9f9bffa2ae485f9c54d3e13e7600116
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: aef5186cf3283b0737eec85e915ad319ca424f2a6eb738ed6f3434f855295479
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2EF0A7327803316FE72066A99C09F977FC9EF44BA0F024125FD08E60D1DA159E00D6E4
                                                                                                                                                                                                                        Function 005E90AA Relevance: 6.1, APIs: 4, Instructions: 110COMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000000,?,005E234D,00000000,00000000,005E3382,?,005E3382,?,00000001,005E234D,?,00000001,005E3382,005E3382), ref: 005E90F7
                                                                                                                                                                                                                        • MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 005E9180
                                                                                                                                                                                                                        • GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 005E9192
                                                                                                                                                                                                                        • __freea.LIBCMT ref: 005E919B
                                                                                                                                                                                                                          • Part of subcall function 005E5154: HeapAlloc.KERNEL32(00000000,?,?,?,005E1E90,?,0000015D,?,?,?,?,005E32E9,000000FF,00000000,?,?), ref: 005E5186
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ByteCharMultiWide$AllocHeapStringType__freea
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 573072132-0
                                                                                                                                                                                                                        • Opcode ID: e129a2fbee91447b281308eaa9bf5cd6e59ceaa05fb84de1bcadb077ec1e51c1
                                                                                                                                                                                                                        • Instruction ID: 7f8cb940de02c2fb8fff592ad57923f8d76d0f1e3254ab2fd429c58f9f413f2c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e129a2fbee91447b281308eaa9bf5cd6e59ceaa05fb84de1bcadb077ec1e51c1
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5131AD72A0025BABDF2D8F66DC49DAE7FA9FB40310B044169FC44D6251E735DD54CBA0
                                                                                                                                                                                                                        Function 005B4E9C Relevance: 6.1, APIs: 4, Instructions: 110COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?,00000000,?,005B545F,?,?,?,?,?,?), ref: 005B4EF6
                                                                                                                                                                                                                        • DeleteCriticalSection.KERNEL32(?,?,?,00000000,?,005B545F,?,?,?,?,?,?), ref: 005B4F0A
                                                                                                                                                                                                                        • TlsFree.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,005B545F,?,?), ref: 005B4FF9
                                                                                                                                                                                                                        • DeleteCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,005B545F,?,?), ref: 005B5000
                                                                                                                                                                                                                          • Part of subcall function 005B1160: LocalFree.KERNEL32(?,?,005B4EB3,?,00000000,?,005B545F,?,?,?,?,?,?), ref: 005B116A
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalDeleteFreeSection$CloseHandleLocal
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3671900028-0
                                                                                                                                                                                                                        • Opcode ID: eda8720af54e5268e88ac1ba92edf0ea0d630b5e1cfcbafd33f2132801017f6c
                                                                                                                                                                                                                        • Instruction ID: 5711714865f4189a7fd8729ffe727d04b08a2e9a507cd38e68f8a9c07b769a3f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: eda8720af54e5268e88ac1ba92edf0ea0d630b5e1cfcbafd33f2132801017f6c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 80417971500B06ABDA30EBB4C84DFEB7BACBF44345F440929B65AD3152EB38F544CA65
                                                                                                                                                                                                                        Function 005F5F0F Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 101COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast
                                                                                                                                                                                                                        • String ID: Hha$dlutil.cpp
                                                                                                                                                                                                                        • API String ID: 1452528299-3937048855
                                                                                                                                                                                                                        • Opcode ID: 9d8dc9e6bd26a45c4fa301cdd79cca4e6822d85cd69ae74dd8ba12ae55dedbd0
                                                                                                                                                                                                                        • Instruction ID: 3192db5ca6b924ead42cce4e6737c6b5dce54397748fdf334e2a4d6d8615a7cf
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9d8dc9e6bd26a45c4fa301cdd79cca4e6822d85cd69ae74dd8ba12ae55dedbd0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B131D872900719BBEB219EA98C48FBB7AEDFF40750B124165FE05E7150EB39CD40A6B0
                                                                                                                                                                                                                        Function 005F3119 Relevance: 6.1, APIs: 4, Instructions: 73memoryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SysAllocString.OLEAUT32(?), ref: 005F312C
                                                                                                                                                                                                                        • VariantInit.OLEAUT32(?), ref: 005F3138
                                                                                                                                                                                                                        • VariantClear.OLEAUT32(?), ref: 005F31AC
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F31B7
                                                                                                                                                                                                                          • Part of subcall function 005F336E: SysAllocString.OLEAUT32(?), ref: 005F3383
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: String$AllocVariant$ClearFreeInit
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 347726874-0
                                                                                                                                                                                                                        • Opcode ID: 8778de5a11e813ae0e5c2ddb52fb9402b2bb62d2f3ad7c99d794ec22e2d6f961
                                                                                                                                                                                                                        • Instruction ID: 1b7ff393be45a037694ebf1ec4a1c5302d799557ac5f422672743ff1a9109c2c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 8778de5a11e813ae0e5c2ddb52fb9402b2bb62d2f3ad7c99d794ec22e2d6f961
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B8212831901219EBEB24DFA5C848EBFBBB9BF44711F150558EA01DB220DB359E05DBA0
                                                                                                                                                                                                                        Function 005B4B80 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 67COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005BF7F7: RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,005B4B9F,?,?,00000001), ref: 005BF847
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?,?,?,?,00000000,?,?,00000001,00000000,?,?,?), ref: 005B4C06
                                                                                                                                                                                                                          • Part of subcall function 005F082D: CreateProcessW.KERNEL32(00000001,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00000000,00000000), ref: 005F089A
                                                                                                                                                                                                                          • Part of subcall function 005F082D: GetLastError.KERNEL32(?,?,?,?,00000000,00000000,00000000), ref: 005F08A4
                                                                                                                                                                                                                          • Part of subcall function 005F082D: CloseHandle.KERNEL32(?,?,?,?,?,00000000,00000000,00000000), ref: 005F08ED
                                                                                                                                                                                                                          • Part of subcall function 005F082D: CloseHandle.KERNEL32(00000000,?,?,?,?,00000000,00000000,00000000), ref: 005F08FA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Unable to get resume command line from the registry, xrefs: 005B4BA5
                                                                                                                                                                                                                        • Failed to re-launch bundle process after RunOnce: %ls, xrefs: 005B4BF0
                                                                                                                                                                                                                        • Failed to get current process path., xrefs: 005B4BC4
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Close$Handle$CreateErrorLastProcess
                                                                                                                                                                                                                        • String ID: Failed to get current process path.$Failed to re-launch bundle process after RunOnce: %ls$Unable to get resume command line from the registry
                                                                                                                                                                                                                        • API String ID: 1572399834-642631345
                                                                                                                                                                                                                        • Opcode ID: b99c642dc112340298f1c3ea65e22cfb4b66211fe31574ebb91fba4643e9d61b
                                                                                                                                                                                                                        • Instruction ID: 3781abca74bca11d9e03ff2d25d0d872582f0bee4f758b2d9a237940a49536e1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b99c642dc112340298f1c3ea65e22cfb4b66211fe31574ebb91fba4643e9d61b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1F113A76D0151DFB8F22AB94DD05CEEFFB8FF94710B1041A6EA01A2252DB359A40EF90
                                                                                                                                                                                                                        Function 005E8731 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • LoadLibraryExW.KERNEL32(00000000,00000000,00000800,005E88D5,00000000,00000000,?,005E86D8,005E88D5,00000000,00000000,00000000,?,005E88D5,00000006,FlsSetValue), ref: 005E8763
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005E86D8,005E88D5,00000000,00000000,00000000,?,005E88D5,00000006,FlsSetValue,00612208,00612210,00000000,00000364,?,005E6130), ref: 005E876F
                                                                                                                                                                                                                        • LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,005E86D8,005E88D5,00000000,00000000,00000000,?,005E88D5,00000006,FlsSetValue,00612208,00612210,00000000), ref: 005E877D
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: LibraryLoad$ErrorLast
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3177248105-0
                                                                                                                                                                                                                        • Opcode ID: bfb4939b667a336e71b6a61e3503b7d1fff97eedc79e3960da2d96f9ea740984
                                                                                                                                                                                                                        • Instruction ID: fc803c218a29daa2d120e5067a647ab2b672b2e45fcd553e63d2941ab63ea136
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bfb4939b667a336e71b6a61e3503b7d1fff97eedc79e3960da2d96f9ea740984
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: AA0147366112629BD7244B6AEC48E773F98FF00BA17340660F99ED3140DF22DC00C6E0
                                                                                                                                                                                                                        Function 005E605E Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00000000,005E19F5,00000000,80004004,?,005E1CF9,00000000,80004004,00000000,00000000), ref: 005E6062
                                                                                                                                                                                                                        • SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 005E60CA
                                                                                                                                                                                                                        • SetLastError.KERNEL32(00000000,80004004,00000000,00000000), ref: 005E60D6
                                                                                                                                                                                                                        • _abort.LIBCMT ref: 005E60DC
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$_abort
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 88804580-0
                                                                                                                                                                                                                        • Opcode ID: 7d2d3208202c5f9ff8a4d3272b1ade1a1a41fc06170226d8d0fa62341ecfdc73
                                                                                                                                                                                                                        • Instruction ID: 0b7c0782055da8c4bd67bd975a37d57a9bb4a4a771c66a5bbff677f96806b8a2
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7d2d3208202c5f9ff8a4d3272b1ade1a1a41fc06170226d8d0fa62341ecfdc73
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 54F04936100AA166C22E33376C0EB2B1E5ABBE17F5F250514F8D9D21D1FF2088019121
                                                                                                                                                                                                                        Function 005B730C Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 46COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(?), ref: 005B7318
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 005B737F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to get value of variable: %ls, xrefs: 005B7352
                                                                                                                                                                                                                        • Failed to get value as numeric for variable: %ls, xrefs: 005B736E
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                        • String ID: Failed to get value as numeric for variable: %ls$Failed to get value of variable: %ls
                                                                                                                                                                                                                        • API String ID: 3168844106-4270472870
                                                                                                                                                                                                                        • Opcode ID: 56aca7f6a22996234194b5ee620845b9fbb32f781454ca43bb204100956a16c0
                                                                                                                                                                                                                        • Instruction ID: c1f0ad949310d8fde1ac0b4f39aa30752b1ee728043e92daa32f0cd80b999007
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 56aca7f6a22996234194b5ee620845b9fbb32f781454ca43bb204100956a16c0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B001483294416DFBCB115A54CC09EEE3FA9BB98721F148565FD04AA261C23AAA10ABD0
                                                                                                                                                                                                                        Function 005B7481 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 46COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(?), ref: 005B748D
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(?,?,?,00000000), ref: 005B74F4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to get value of variable: %ls, xrefs: 005B74C7
                                                                                                                                                                                                                        • Failed to get value as version for variable: %ls, xrefs: 005B74E3
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                        • String ID: Failed to get value as version for variable: %ls$Failed to get value of variable: %ls
                                                                                                                                                                                                                        • API String ID: 3168844106-1851729331
                                                                                                                                                                                                                        • Opcode ID: c97d54a9084779803cdd4d00e0465a2d1a477f451d3d7a7a3df7688a66313642
                                                                                                                                                                                                                        • Instruction ID: aec706d1b5a6f95c34bdc333022f3f83162cf60dd8a9579140ebd2ff9ce9d493
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c97d54a9084779803cdd4d00e0465a2d1a477f451d3d7a7a3df7688a66313642
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1C015E3294452DFBCF115B54CC05EEE3F68BB58762F108125FD08AA220C33AAE10E7E0
                                                                                                                                                                                                                        Function 005B7410 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 40COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(00000000,00000000,00000006,?,005B9752,00000000,?,00000000,00000000,00000000,?,005B9590,00000000,?,00000000,00000000), ref: 005B741C
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(00000000,00000000,00000000,00000000,?,005B9752,00000000,?,00000000,00000000,00000000,?,005B9590,00000000,?,00000000), ref: 005B7472
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to get value of variable: %ls, xrefs: 005B7442
                                                                                                                                                                                                                        • Failed to copy value of variable: %ls, xrefs: 005B7461
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                        • String ID: Failed to copy value of variable: %ls$Failed to get value of variable: %ls
                                                                                                                                                                                                                        • API String ID: 3168844106-2936390398
                                                                                                                                                                                                                        • Opcode ID: dfbfb4bd95f84d8acf5ea70f7087a17dd5c2e37d1c1b3c9f09cdd253a5a789ee
                                                                                                                                                                                                                        • Instruction ID: 898e93734bc459cd776a4582b9ef069a5c886002b4095c778a80cd3d6e33c526
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dfbfb4bd95f84d8acf5ea70f7087a17dd5c2e37d1c1b3c9f09cdd253a5a789ee
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B8F0313694412DBBCF126F54CC05EEE7F69FB54361F108164FD04A6221D775AA20E7D4
                                                                                                                                                                                                                        Function 005F88BE Relevance: 6.0, APIs: 1, Strings: 3, Instructions: 38COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,Qd_,005F5C11,feclient.dll,clbcatq.dll,005FB508,005FB4F0,HEAD,00000000,005FB4D8,Qd_,00000000,?,?,00000000), ref: 005F88E8
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast
                                                                                                                                                                                                                        • String ID: Qd_$feclient.dll$inetutil.cpp
                                                                                                                                                                                                                        • API String ID: 1452528299-1839795727
                                                                                                                                                                                                                        • Opcode ID: 10c1bfbec69a3693fd4e1460f29563dd90319ca052d9816e8db135c3964c3d32
                                                                                                                                                                                                                        • Instruction ID: 0e21c648a3be2dd02562437aa31f782a71d6654e7c68749e6bcbdfea5b819ee8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 10c1bfbec69a3693fd4e1460f29563dd90319ca052d9816e8db135c3964c3d32
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CDF04F7260162CABE7119B94DD09FFBBBACFB04751F018156BD01E7140EA749A4497E1
                                                                                                                                                                                                                        Function 005E1246 Relevance: 6.0, APIs: 4, Instructions: 14COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 005E1246
                                                                                                                                                                                                                        • ___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 005E124B
                                                                                                                                                                                                                        • ___vcrt_initialize_locks.LIBVCRUNTIME ref: 005E1250
                                                                                                                                                                                                                          • Part of subcall function 005E1548: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 005E1559
                                                                                                                                                                                                                        • ___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 005E1265
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1761009282-0
                                                                                                                                                                                                                        • Opcode ID: 294756368ebb91e0d837f8d85631f380e5f2af2aa371e18ba28d844398db2aca
                                                                                                                                                                                                                        • Instruction ID: c6544f8a69b9c8cdde9813b9d57f78fc7e51ddfdc38ede420ca0eb43bdba19e4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 294756368ebb91e0d837f8d85631f380e5f2af2aa371e18ba28d844398db2aca
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7DC0023C004EC3541E1C36F3265A2E90F857CE67857D024C6E9E6965435936045A242F
                                                                                                                                                                                                                        Function 005F4661 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005F0E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,005F5699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 005F0E52
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,80000002,SYSTEM\CurrentControlSet\Control\Session Manager,00000003,?,00000000,00000000,00000101), ref: 005F47C2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseOpen
                                                                                                                                                                                                                        • String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager
                                                                                                                                                                                                                        • API String ID: 47109696-3023217399
                                                                                                                                                                                                                        • Opcode ID: dae207a691994b8b8c8a194b1a85aded239ec08e37947cae2d122f01de7a7e44
                                                                                                                                                                                                                        • Instruction ID: 9693f161c82b393f96c2d6b9360b4dcb742deb72af3bdabfd791d48f74d964b2
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: dae207a691994b8b8c8a194b1a85aded239ec08e37947cae2d122f01de7a7e44
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0A416D75A0111DEBCB20EF94C9849BEBFB9FB45710F254069E600A7251DB389E42DF50
                                                                                                                                                                                                                        Function 005F0B49 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000), ref: 005F0CA0
                                                                                                                                                                                                                          • Part of subcall function 005F0E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,005F5699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 005F0E52
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseOpen
                                                                                                                                                                                                                        • String ID: regutil.cpp
                                                                                                                                                                                                                        • API String ID: 47109696-955085611
                                                                                                                                                                                                                        • Opcode ID: f098ae63f37e7c64fa95828c4f28b9f4f5f6d7a5542a30479cee46c57ead5f69
                                                                                                                                                                                                                        • Instruction ID: c035c897ac4c12f894451ec08f5cdd60ac5314903a1fff1cfb3bb1d80f4cd3ac
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f098ae63f37e7c64fa95828c4f28b9f4f5f6d7a5542a30479cee46c57ead5f69
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7441D632D0122DFBDF215AA5CD04BBEBEA5BB04351F199265EF05A71D2D7398D40D780
                                                                                                                                                                                                                        Function 005F0F6E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 126registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000002,00000001,00000000,00000000,00000000,00000000,00000000), ref: 005F0FE4
                                                                                                                                                                                                                        • RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 005F101F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: QueryValue
                                                                                                                                                                                                                        • String ID: regutil.cpp
                                                                                                                                                                                                                        • API String ID: 3660427363-955085611
                                                                                                                                                                                                                        • Opcode ID: 1fd3fd83127c25157ddd9e034150566d7b9688dfec50e8f7c33bcef2aa0e353a
                                                                                                                                                                                                                        • Instruction ID: 917679186c5e70ee65248d9c8ecaf6c87f7ef1dc98a8231121edc6401bd36077
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 1fd3fd83127c25157ddd9e034150566d7b9688dfec50e8f7c33bcef2aa0e353a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 38419E31D0162EEBDB209E94C8899BEBFB9FF44310F10456AEA14A7250DB359E41DB94
                                                                                                                                                                                                                        Function 005E65D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • WideCharToMultiByte.KERNEL32(005FB508,00000000,00000006,00000001,comres.dll,?,00000000,?,00000000,?,?,00000000,00000006,?,comres.dll,?), ref: 005E66A3
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 005E66BF
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ByteCharErrorLastMultiWide
                                                                                                                                                                                                                        • String ID: comres.dll
                                                                                                                                                                                                                        • API String ID: 203985260-246242247
                                                                                                                                                                                                                        • Opcode ID: a8be738cf40f964fa201e99dd0e23475668b9ec3a6882b4993a8ede92f075673
                                                                                                                                                                                                                        • Instruction ID: d3185583166ffe882aee87ea6596c5fd63676f302cbbb00dbdd92ab87974f21f
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a8be738cf40f964fa201e99dd0e23475668b9ec3a6882b4993a8ede92f075673
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B031E5316102D6ABDB29AF57C889AAB3F68BF727D0F150525F8949B291DB308D00C7A1
                                                                                                                                                                                                                        Function 005F8E07 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005F8CFB: lstrlenW.KERNEL32(00000100,?,?,005F9098,000002C0,00000100,00000100,00000100,?,?,?,005D7B40,?,?,000001BC,00000000), ref: 005F8D1B
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,005FB4F0,wininet.dll,?), ref: 005F8F07
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,00000000,?,00000000,?,?,?,00000000,wininet.dll,?,005FB4F0,wininet.dll,?), ref: 005F8F14
                                                                                                                                                                                                                          • Part of subcall function 005F0E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,005F5699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 005F0E52
                                                                                                                                                                                                                          • Part of subcall function 005F0D1C: RegEnumKeyExW.ADVAPI32(00000000,000002C0,00000410,00000002,00000000,00000000,00000000,00000000,00000410,00000002,00000100,00000000,00000000,?,?,005D8BD8), ref: 005F0D77
                                                                                                                                                                                                                          • Part of subcall function 005F0D1C: RegQueryInfoKeyW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000002,00000000,00000000,00000000,00000000,00000000,00000000,?,?,005D8BD8,00000000), ref: 005F0D99
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Close$EnumInfoOpenQuerylstrlen
                                                                                                                                                                                                                        • String ID: wininet.dll
                                                                                                                                                                                                                        • API String ID: 2680864210-3354682871
                                                                                                                                                                                                                        • Opcode ID: 9c025a5356b7113b878fc40d387cfc370e043d82348ae06fb25b2f2378334e6b
                                                                                                                                                                                                                        • Instruction ID: efdcd9930a6255b2ea694f5cc6c7b2467e231104d184ce0aa6d6a80d648319e0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9c025a5356b7113b878fc40d387cfc370e043d82348ae06fb25b2f2378334e6b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2931F876C0112EAFCF21AF94C9448FEBE79FF44350B554169EB01B6221DB394E50EB90
                                                                                                                                                                                                                        Function 005F9220 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005F8CFB: lstrlenW.KERNEL32(00000100,?,?,005F9098,000002C0,00000100,00000100,00000100,?,?,?,005D7B40,?,?,000001BC,00000000), ref: 005F8D1B
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,00000000,?,00000000,00000000,00000000), ref: 005F9305
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000001,00000000,?,00000000,00000000,00000000), ref: 005F931F
                                                                                                                                                                                                                          • Part of subcall function 005F0AD5: RegCreateKeyExW.ADVAPI32(00000001,00000000,00000000,00000000,00000000,00000001,00000000,?,00000000,00000001,?,?,005C0491,?,00000000,00020006), ref: 005F0AFA
                                                                                                                                                                                                                          • Part of subcall function 005F1392: RegSetValueExW.ADVAPI32(00020006,00020006,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,005BF1C2,00000000,?,00020006), ref: 005F13C5
                                                                                                                                                                                                                          • Part of subcall function 005F1392: RegDeleteValueW.ADVAPI32(00020006,00020006,00000000,?,?,005BF1C2,00000000,?,00020006,?,00020006,00020006,00000000,?,?,?), ref: 005F13F5
                                                                                                                                                                                                                          • Part of subcall function 005F1344: RegSetValueExW.ADVAPI32(?,?,00000000,00000004,?,00000004,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,?,005BF11A,00000005,Resume,?,?,?,00000002,00000000), ref: 005F1359
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Value$Close$CreateDeletelstrlen
                                                                                                                                                                                                                        • String ID: %ls\%ls
                                                                                                                                                                                                                        • API String ID: 3924016894-2125769799
                                                                                                                                                                                                                        • Opcode ID: f57d0c5433976e8761ff17439306c66641e1293b259110aa1e025f4b30e69687
                                                                                                                                                                                                                        • Instruction ID: 833383cc132e57458fbba69b4b082c384a6ff78ce3abcf9d1074cfc50be7d85b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f57d0c5433976e8761ff17439306c66641e1293b259110aa1e025f4b30e69687
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 44310776C0152EBB8F129FD4CC849FEBFBAFB44354B45416AAA00A2161D7398E50AB90
                                                                                                                                                                                                                        Function 005B39CF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: _memcpy_s
                                                                                                                                                                                                                        • String ID: crypt32.dll$wininet.dll
                                                                                                                                                                                                                        • API String ID: 2001391462-82500532
                                                                                                                                                                                                                        • Opcode ID: 20d9f25f4ff598d2956f110480d47adb0513f97da9c1314b068fe09bcabe11f2
                                                                                                                                                                                                                        • Instruction ID: bd256b7c7004372414dc95e6348f0e54bdf8ec299e699d3173474449638ae7a4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 20d9f25f4ff598d2956f110480d47adb0513f97da9c1314b068fe09bcabe11f2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6F115E71600219ABCF18DE59CDD99DBBF69FF98250B14812AFC095B311D630EA10CAE0
                                                                                                                                                                                                                        Function 005F1392 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RegSetValueExW.ADVAPI32(00020006,00020006,00000000,00000001,?,00000000,?,000000FF,00000000,00000000,?,?,005BF1C2,00000000,?,00020006), ref: 005F13C5
                                                                                                                                                                                                                        • RegDeleteValueW.ADVAPI32(00020006,00020006,00000000,?,?,005BF1C2,00000000,?,00020006,?,00020006,00020006,00000000,?,?,?), ref: 005F13F5
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Value$Delete
                                                                                                                                                                                                                        • String ID: regutil.cpp
                                                                                                                                                                                                                        • API String ID: 1738766685-955085611
                                                                                                                                                                                                                        • Opcode ID: caea464197059cebe0bafe59057692622ebb8ec7538ac70a604d695c074de1da
                                                                                                                                                                                                                        • Instruction ID: 15b2932fdfe4f1808f90c52a5d101547e2d7a886ddaa91aea5c0128850506e46
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: caea464197059cebe0bafe59057692622ebb8ec7538ac70a604d695c074de1da
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: FD11C636E4163AFBEF219E658C09BBA7AA5FF04750F014221FE04EA0A0D765CD1097D4
                                                                                                                                                                                                                        Function 005BDCA5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(00000000,00000000,00000000,000000FF,?,000000FF,IGNOREDEPENDENCIES,00000000,?,?,005D744B,00000000,IGNOREDEPENDENCIES,00000000,?,005FB508), ref: 005BDCF6
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • IGNOREDEPENDENCIES, xrefs: 005BDCAD
                                                                                                                                                                                                                        • Failed to copy the property value., xrefs: 005BDD2A
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CompareString
                                                                                                                                                                                                                        • String ID: Failed to copy the property value.$IGNOREDEPENDENCIES
                                                                                                                                                                                                                        • API String ID: 1825529933-1412343224
                                                                                                                                                                                                                        • Opcode ID: fc3c7599f840c3d5f2d8fd57819f55fabba7ce8d5e131418c3a69452c7dc4d37
                                                                                                                                                                                                                        • Instruction ID: 5e953b3536acca88245e94ff8278fae14813234e9a3d088a67c53e808eeca71e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: fc3c7599f840c3d5f2d8fd57819f55fabba7ce8d5e131418c3a69452c7dc4d37
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 0C118C32204215AFDB104F48CC85FAABBA5FB59330F264665EA189B291E670BC50D7A0
                                                                                                                                                                                                                        Function 005F54F8 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53sleepCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • Sleep.KERNEL32(20000004,00000000,00000000,00000000,00000000,00000000,?,?,005C8C90,?,00000001,20000004,00000000,00000000,?,00000000), ref: 005F5527
                                                                                                                                                                                                                        • SetNamedSecurityInfoW.ADVAPI32(00000000,?,000007D0,00000003,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?,005C8C90,?), ref: 005F5542
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InfoNamedSecuritySleep
                                                                                                                                                                                                                        • String ID: aclutil.cpp
                                                                                                                                                                                                                        • API String ID: 2352087905-2159165307
                                                                                                                                                                                                                        • Opcode ID: d26adf9686e60f4a741f1c7f867d2fb52fc40547b97ebf4330503cfb7a92815c
                                                                                                                                                                                                                        • Instruction ID: 718249f0ebc5d9a990cd1d7f51d5e1f143988461e2ce6b831e3697b3bd016420
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d26adf9686e60f4a741f1c7f867d2fb52fc40547b97ebf4330503cfb7a92815c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4F01707280052DBBDF129E94CC09EEE7E6AFF84760F020155BF04A6110E6358E60E7E0
                                                                                                                                                                                                                        Function 005C55BD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CoInitializeEx.OLE32(00000000,00000000), ref: 005C55D9
                                                                                                                                                                                                                        • CoUninitialize.OLE32(?,00000000,?,?,?,?,?,?,?), ref: 005C5633
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to initialize COM on cache thread., xrefs: 005C55E5
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InitializeUninitialize
                                                                                                                                                                                                                        • String ID: Failed to initialize COM on cache thread.
                                                                                                                                                                                                                        • API String ID: 3442037557-3629645316
                                                                                                                                                                                                                        • Opcode ID: 47e634165e00cdda9b4b66aae120c23b5696168e73e9acf2f15e3c359e6b31bf
                                                                                                                                                                                                                        • Instruction ID: b25d61a91674a793f0ea6edb7a6463ffceba7e223b6caaf05ad0b0fda7de55d8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 47e634165e00cdda9b4b66aae120c23b5696168e73e9acf2f15e3c359e6b31bf
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8D015E72600619BFD7058BE5DC84DE6FBADFF08354B508126FA09C7111DB31AD54DB90
                                                                                                                                                                                                                        Function 005B155F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • LCMapStringW.KERNEL32(0000007F,00000000,00000000,005C6EF3,00000000,005C6EF3,00000000,00000000,005C6EF3,00000000,00000000,00000000,?,005B2326,00000000,00000000), ref: 005B15A3
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,005B2326,00000000,00000000,005C6EF3,00000200,?,005F516B,00000000,005C6EF3,00000000,005C6EF3,00000000,00000000,00000000), ref: 005B15AD
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLastString
                                                                                                                                                                                                                        • String ID: strutil.cpp
                                                                                                                                                                                                                        • API String ID: 3728238275-3612885251
                                                                                                                                                                                                                        • Opcode ID: 3cdd9459e877ac974060f7ffa39c39a7de6091ca107894d320eaae1e67586cfb
                                                                                                                                                                                                                        • Instruction ID: df23715a12a24bb67649a676e8f0b8c8414629cb515f3570d2287b51fd7401c2
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3cdd9459e877ac974060f7ffa39c39a7de6091ca107894d320eaae1e67586cfb
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B401B533600A25A7AB219E968C45EA77EA9FF867A0F010115FE15EB150DA21EC10DBE1
                                                                                                                                                                                                                        Function 005F3803 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47memoryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SysAllocString.OLEAUT32(00000000), ref: 005F3849
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F387C
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: String$AllocFree
                                                                                                                                                                                                                        • String ID: xmlutil.cpp
                                                                                                                                                                                                                        • API String ID: 344208780-1270936966
                                                                                                                                                                                                                        • Opcode ID: 0b43279137acd7899f61438e3eefad10653e4a8dd09e9045d7ea146723d79a7f
                                                                                                                                                                                                                        • Instruction ID: c5b4866bbe5d3b9a1750d34d09a79ea018f6e4120a2d0b165c4f28bd1fa5b7a8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 0b43279137acd7899f61438e3eefad10653e4a8dd09e9045d7ea146723d79a7f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 41018F75641219ABFB211A54C809EBB3A98FF857A0F154439FE04A7240C67CCE4197A1
                                                                                                                                                                                                                        Function 005F388A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47memoryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SysAllocString.OLEAUT32(00000000), ref: 005F38D0
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F3903
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: String$AllocFree
                                                                                                                                                                                                                        • String ID: xmlutil.cpp
                                                                                                                                                                                                                        • API String ID: 344208780-1270936966
                                                                                                                                                                                                                        • Opcode ID: d9d0e252ab7eb2afc70ad7945df6741b356e4385559089b4ed92c3f62672bd67
                                                                                                                                                                                                                        • Instruction ID: ce50c39b7dd67376eb2a63dc03370b66fd38c685521308bebe4dee3bddf1bf3a
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d9d0e252ab7eb2afc70ad7945df6741b356e4385559089b4ed92c3f62672bd67
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3E018476A41219F7FB205A548809FBB3AD8FF457A0F150465FE05A7250C6BC8E0097A1
                                                                                                                                                                                                                        Function 005F3AC9 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005F0E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,005F5699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 005F0E52
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System,00020019,00000000,?,?,?,?,?,005F396A,?), ref: 005F3B3A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • EnableLUA, xrefs: 005F3B0C
                                                                                                                                                                                                                        • SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System, xrefs: 005F3AE4
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseOpen
                                                                                                                                                                                                                        • String ID: EnableLUA$SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
                                                                                                                                                                                                                        • API String ID: 47109696-3551287084
                                                                                                                                                                                                                        • Opcode ID: 2bd639afa8fb91d2bab43ac9f28ab90be742550763d8f3a31f08f86b642dc649
                                                                                                                                                                                                                        • Instruction ID: 0b39c0f187b657395aa7b851cef1b0f8a687f3324d7228d5986a6688d3728ea7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2bd639afa8fb91d2bab43ac9f28ab90be742550763d8f3a31f08f86b642dc649
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 35018F7295023CEBE710AAA4C81ABFEFFADEB04721F2501A5EA00A3151D7785F50E7D4
                                                                                                                                                                                                                        Function 005F6754 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(?), ref: 005F67B3
                                                                                                                                                                                                                          • Part of subcall function 005F85CB: SystemTimeToFileTime.KERNEL32(?,00000000,00000000,clbcatq.dll,00000000,clbcatq.dll,00000000,00000000,00000000), ref: 005F86D8
                                                                                                                                                                                                                          • Part of subcall function 005F85CB: GetLastError.KERNEL32 ref: 005F86E2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Time$ErrorFileFreeLastStringSystem
                                                                                                                                                                                                                        • String ID: atomutil.cpp$clbcatq.dll
                                                                                                                                                                                                                        • API String ID: 211557998-3749116663
                                                                                                                                                                                                                        • Opcode ID: ff115a8e52167c134c2f5209ad4bca5a7f1ecd626ad424f96f422547982ae5f3
                                                                                                                                                                                                                        • Instruction ID: 0d083cd8e94fb3d728f391477d7b38b61be606a727e0dd0ffefafa80a41ba7d0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ff115a8e52167c134c2f5209ad4bca5a7f1ecd626ad424f96f422547982ae5f3
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F601DFB190211EFB8B20AE858881CBAFFB8FB45764B20427AF604A7110D3345E00E790
                                                                                                                                                                                                                        Function 005B6418 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 45COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(?), ref: 005B642A
                                                                                                                                                                                                                          • Part of subcall function 005F09BB: GetModuleHandleW.KERNEL32(kernel32,IsWow64Process,?,?,?,005B5D8F,00000000), ref: 005F09CF
                                                                                                                                                                                                                          • Part of subcall function 005F09BB: GetProcAddress.KERNEL32(00000000), ref: 005F09D6
                                                                                                                                                                                                                          • Part of subcall function 005F09BB: GetLastError.KERNEL32(?,?,?,005B5D8F,00000000), ref: 005F09ED
                                                                                                                                                                                                                          • Part of subcall function 005B5BF0: RegCloseKey.ADVAPI32(00000000,?,00000000,CommonFilesDir,?,80000002,SOFTWARE\Microsoft\Windows\CurrentVersion,00020119,00000000), ref: 005B5C77
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to set variant value., xrefs: 005B6467
                                                                                                                                                                                                                        • Failed to get 64-bit folder., xrefs: 005B644D
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressCloseCurrentErrorHandleLastModuleProcProcess
                                                                                                                                                                                                                        • String ID: Failed to get 64-bit folder.$Failed to set variant value.
                                                                                                                                                                                                                        • API String ID: 3109562764-2681622189
                                                                                                                                                                                                                        • Opcode ID: 789dd638a5b4df45d9fd3b97aacafa3479680e41b2e0ae8a07c1a4be43520288
                                                                                                                                                                                                                        • Instruction ID: 2794028672b1c569e8c1edbff92789e5a6e039f54306a8e7b682bcdccbff21c7
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 789dd638a5b4df45d9fd3b97aacafa3479680e41b2e0ae8a07c1a4be43520288
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E3016232D0162DBBDF11A794DC4AAFE7F78FB00721F104156F940A6192E679AE40D7D0
                                                                                                                                                                                                                        Function 005B33D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,?,?,?,005B10DD,?,00000000), ref: 005B33F8
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,005B10DD,?,00000000), ref: 005B340F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorFileLastModuleName
                                                                                                                                                                                                                        • String ID: pathutil.cpp
                                                                                                                                                                                                                        • API String ID: 2776309574-741606033
                                                                                                                                                                                                                        • Opcode ID: 3fe080afcdb8d97ad5c705025ad961db1ba4655ab7b1ed761eb527cc08cc2633
                                                                                                                                                                                                                        • Instruction ID: 5971e93b2743c34e55472c4ef7bc175e51076d433c09b50b0cedfd7ce65784a4
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3fe080afcdb8d97ad5c705025ad961db1ba4655ab7b1ed761eb527cc08cc2633
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 34F0C273B00230ABAB22666A9C4CED7BE9DFB857A0B024131FD05FB110CA65ED04D2F0
                                                                                                                                                                                                                        Function 005C0598 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 005F0E3F: RegOpenKeyExW.KERNELBASE(00000000,00000000,00000000,00000000,00000001,00000000,?,005F5699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,00000000,00000000,00000000), ref: 005F0E52
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000001,00000000,?,?,00020006,00000000,00000001,00000000,?,?,005DBB7C,00000101,?), ref: 005C05EF
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to update resume mode., xrefs: 005C05D9
                                                                                                                                                                                                                        • Failed to open registration key., xrefs: 005C05BF
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseOpen
                                                                                                                                                                                                                        • String ID: Failed to open registration key.$Failed to update resume mode.
                                                                                                                                                                                                                        • API String ID: 47109696-3366686031
                                                                                                                                                                                                                        • Opcode ID: e4bf095ff3e8e9474dba0d3fde47242afce83575f9c5b9723d0c762d49115c11
                                                                                                                                                                                                                        • Instruction ID: d47f233e6b89f944c650591cf7d782957fd6f0dc960ce2b085121e05bc5078d5
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e4bf095ff3e8e9474dba0d3fde47242afce83575f9c5b9723d0c762d49115c11
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 36F0A432A81229FBD7229A94DC06FEEBF6DBB007A0F141059F600A61D0DB75AF10A6D0
                                                                                                                                                                                                                        Function 005F48CB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetFileSizeEx.KERNEL32(00000000,00000000,00000000,74DF34C0,?,?,?,005BB919,?,?,?,00000000,00000000), ref: 005F48E3
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,005BB919,?,?,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 005F48ED
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorFileLastSize
                                                                                                                                                                                                                        • String ID: fileutil.cpp
                                                                                                                                                                                                                        • API String ID: 464720113-2967768451
                                                                                                                                                                                                                        • Opcode ID: 6a05904ad20d1b5ea2466a3df591ac741cbf870304843df33d093de1bd6c9b3a
                                                                                                                                                                                                                        • Instruction ID: c12a9e3888ce2f3b79f9562174cdd9e36239af4cb00cd91c3631fd949e498000
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6a05904ad20d1b5ea2466a3df591ac741cbf870304843df33d093de1bd6c9b3a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EEF0AFB6A0022AABA7109F99C8099ABFBECFF54750B01421AFC04E3200D775AD10CBE0
                                                                                                                                                                                                                        Function 005F30BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35memoryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SysAllocString.OLEAUT32(?), ref: 005F30D4
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F3104
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: String$AllocFree
                                                                                                                                                                                                                        • String ID: xmlutil.cpp
                                                                                                                                                                                                                        • API String ID: 344208780-1270936966
                                                                                                                                                                                                                        • Opcode ID: d82496ae9cbb1326b1350a0c74b1582f703b1dcfdfbb94ca6894d0804daacb9e
                                                                                                                                                                                                                        • Instruction ID: 81a3847d6045b6b39a284b8a28637faba32ff9936b90726c2d7040a6c28fdaeb
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d82496ae9cbb1326b1350a0c74b1582f703b1dcfdfbb94ca6894d0804daacb9e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 04F0B47524025CE7EB215E04DC09FBB7FA9FB80B60F150069FE04A7210C7798E10DAA0
                                                                                                                                                                                                                        Function 005F336E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35memoryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SysAllocString.OLEAUT32(?), ref: 005F3383
                                                                                                                                                                                                                        • SysFreeString.OLEAUT32(00000000), ref: 005F33B3
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: String$AllocFree
                                                                                                                                                                                                                        • String ID: xmlutil.cpp
                                                                                                                                                                                                                        • API String ID: 344208780-1270936966
                                                                                                                                                                                                                        • Opcode ID: e723296ec4c5683f8e2ffea76f35e88fe15b7f08639feb4cd59bb8702d3bdfbe
                                                                                                                                                                                                                        • Instruction ID: bb730c6ac59788847261e177ca6a7700acbc2baf0817f5b74a5a8b73081358d2
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e723296ec4c5683f8e2ffea76f35e88fe15b7f08639feb4cd59bb8702d3bdfbe
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A6F0B43524011CE7EB219F09DC08EBB3FA9FB84760B150819FE0497290CB78DE00DAE0
                                                                                                                                                                                                                        Function 005F1344 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RegSetValueExW.ADVAPI32(?,?,00000000,00000004,?,00000004,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,?,005BF11A,00000005,Resume,?,?,?,00000002,00000000), ref: 005F1359
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 005F1347
                                                                                                                                                                                                                        • regutil.cpp, xrefs: 005F1381
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Value
                                                                                                                                                                                                                        • String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce$regutil.cpp
                                                                                                                                                                                                                        • API String ID: 3702945584-2416625845
                                                                                                                                                                                                                        • Opcode ID: 47aa343790b0e0ec7bb8bed1ad3ef337a685edad962d36734741ef316ec3599b
                                                                                                                                                                                                                        • Instruction ID: 3a879e7ed936ec5d474311aa769cba86302e6d2bb63be4f1c4eff64a9af47156
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 47aa343790b0e0ec7bb8bed1ad3ef337a685edad962d36734741ef316ec3599b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E8E0EDB6B456397BE7215AA68C09FD77EDDEB04BA0F424121BF08EA190D6618D1086E4
                                                                                                                                                                                                                        Function 005F0CD1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19libraryloaderCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 005F0CF2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000001.00000002.1930683324.00000000005B1000.00000020.00000001.01000000.00000005.sdmp, Offset: 005B0000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930637870.00000000005B0000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930767326.00000000005FB000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930820393.000000000061A000.00000004.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000001.00000002.1930861365.000000000061E000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_1_2_5b0000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressProc
                                                                                                                                                                                                                        • String ID: AdvApi32.dll$RegDeleteKeyExW
                                                                                                                                                                                                                        • API String ID: 190572456-850864035
                                                                                                                                                                                                                        • Opcode ID: ee181dc1c4b50b83b88ce96f4cb1fd9473bbcb43dff78cd541b4b68935aca0a0
                                                                                                                                                                                                                        • Instruction ID: b3f808b96934a49da59506578850b45a4bb00732d822026155c904dff57930aa
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ee181dc1c4b50b83b88ce96f4cb1fd9473bbcb43dff78cd541b4b68935aca0a0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 40E086B4705614ABD7049F34FC1A9D53E92F738B04309B11AF401D2271CFB05840CBD0

                                                                                                                                                                                                                        Executed Functions

                                                                                                                                                                                                                        Function 00861070 Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 77fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 008633D7: GetModuleFileNameW.KERNEL32(?,?,00000104,?,00000104,?,00000000,00000000,?,0088AD27,00000001,00000000,?,WixBundleSourceProcessPath,00000001,?), ref: 008633F8
                                                                                                                                                                                                                        • CreateFileW.KERNELBASE(?,80000000,00000005,00000000,00000003,00000080,00000000,?,00000000), ref: 008610F6
                                                                                                                                                                                                                          • Part of subcall function 00861174: HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,?,?,0086111A,cabinet.dll,00000009,?,?,00000000), ref: 00861185
                                                                                                                                                                                                                          • Part of subcall function 00861174: GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,0086111A,cabinet.dll,00000009,?,?,00000000), ref: 00861190
                                                                                                                                                                                                                          • Part of subcall function 00861174: GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0086119E
                                                                                                                                                                                                                          • Part of subcall function 00861174: GetLastError.KERNEL32(?,?,?,?,0086111A,cabinet.dll,00000009,?,?,00000000), ref: 008611B9
                                                                                                                                                                                                                          • Part of subcall function 00861174: GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 008611C1
                                                                                                                                                                                                                          • Part of subcall function 00861174: GetLastError.KERNEL32(?,?,?,?,0086111A,cabinet.dll,00000009,?,?,00000000), ref: 008611D6
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(?,?,?,?,008AB4C0,?,cabinet.dll,00000009,?,?,00000000), ref: 00861131
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AddressErrorFileHandleLastModuleProc$CloseCreateHeapInformationName
                                                                                                                                                                                                                        • String ID: cabinet.dll$clbcatq.dll$comres.dll$crypt32.dll$feclient.dll$msasn1.dll$msi.dll$version.dll$wininet.dll
                                                                                                                                                                                                                        • API String ID: 3687706282-3151496603
                                                                                                                                                                                                                        • Opcode ID: 424875fdc75eea35e3c89fec5fbe6577e443cb551dedc279adca5c2a4306162e
                                                                                                                                                                                                                        • Instruction ID: 538f94c86c68016ca1c6ff4057986dca96287d56985253d5c20a11fab2a128c3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 424875fdc75eea35e3c89fec5fbe6577e443cb551dedc279adca5c2a4306162e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2221767190120CABDB109FE9DC49BDEBBB8FF0A714F154115EA10F7292D7709908CBA5
                                                                                                                                                                                                                        Function 008A4315 Relevance: 3.0, APIs: 2, Instructions: 44fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • FindFirstFileW.KERNELBASE(?,?,00000000,00000000,?), ref: 008A4350
                                                                                                                                                                                                                        • FindClose.KERNEL32(00000000), ref: 008A435C
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Find$CloseFileFirst
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 2295610775-0
                                                                                                                                                                                                                        • Opcode ID: c4ccefbd2b99ac8991049e062c585d5e3380becc45d20c39ade889ed6db6e61e
                                                                                                                                                                                                                        • Instruction ID: a830678263b387154c938454a5141d891bd1e0e11b3298a3a92b5cc48ede5247
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c4ccefbd2b99ac8991049e062c585d5e3380becc45d20c39ade889ed6db6e61e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4801D672600208ABEF10EF699D89EAAB7ACFBC6315F000165E908C3641D7305D498B50
                                                                                                                                                                                                                        Function 0086B389 Relevance: 91.6, APIs: 24, Strings: 28, Instructions: 565fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 392 86b389-86b3fd call 88f670 * 2 397 86b435-86b450 SetFilePointerEx 392->397 398 86b3ff-86b42a GetLastError call 8637d3 392->398 400 86b484-86b49e ReadFile 397->400 401 86b452-86b482 GetLastError call 8637d3 397->401 408 86b42f-86b430 398->408 404 86b4d5-86b4dc 400->404 405 86b4a0-86b4d0 GetLastError call 8637d3 400->405 401->408 406 86b4e2-86b4eb 404->406 407 86bad3-86bae7 call 8637d3 404->407 405->408 406->407 412 86b4f1-86b501 SetFilePointerEx 406->412 423 86baec 407->423 413 86baed-86baf3 call 8a012f 408->413 416 86b503-86b52e GetLastError call 8637d3 412->416 417 86b538-86b550 ReadFile 412->417 424 86baf4-86bb06 call 88de36 413->424 416->417 421 86b587-86b58e 417->421 422 86b552-86b57d GetLastError call 8637d3 417->422 427 86b594-86b59e 421->427 428 86bab8-86bad1 call 8637d3 421->428 422->421 423->413 427->428 432 86b5a4-86b5c7 SetFilePointerEx 427->432 428->423 433 86b5fe-86b616 ReadFile 432->433 434 86b5c9-86b5f4 GetLastError call 8637d3 432->434 438 86b64d-86b665 ReadFile 433->438 439 86b618-86b643 GetLastError call 8637d3 433->439 434->433 442 86b667-86b692 GetLastError call 8637d3 438->442 443 86b69c-86b6b7 SetFilePointerEx 438->443 439->438 442->443 446 86b6f1-86b710 ReadFile 443->446 447 86b6b9-86b6e7 GetLastError call 8637d3 443->447 449 86b716-86b718 446->449 450 86ba79-86baad GetLastError call 8637d3 446->450 447->446 454 86b719-86b720 449->454 458 86baae-86bab6 call 8a012f 450->458 456 86b726-86b732 454->456 457 86ba54-86ba71 call 8637d3 454->457 459 86b734-86b73b 456->459 460 86b73d-86b746 456->460 467 86ba76-86ba77 457->467 458->424 459->460 464 86b780-86b787 459->464 465 86ba17-86ba2e call 8637d3 460->465 466 86b74c-86b772 ReadFile 460->466 471 86b7b0-86b7c7 call 8638d4 464->471 472 86b789-86b7ab call 8637d3 464->472 477 86ba33-86ba39 call 8a012f 465->477 466->450 470 86b778-86b77e 466->470 467->458 470->454 479 86b7eb-86b800 SetFilePointerEx 471->479 480 86b7c9-86b7e6 call 8637d3 471->480 472->467 488 86ba3f-86ba40 477->488 483 86b802-86b830 GetLastError call 8637d3 479->483 484 86b840-86b865 ReadFile 479->484 480->413 499 86b835-86b83b call 8a012f 483->499 489 86b867-86b89a GetLastError call 8637d3 484->489 490 86b89c-86b8a8 484->490 494 86ba41-86ba43 488->494 489->499 491 86b8aa-86b8c6 call 8637d3 490->491 492 86b8cb-86b8cf 490->492 491->477 497 86b8d1-86b905 call 8637d3 call 8a012f 492->497 498 86b90a-86b91d call 8a48cb 492->498 494->424 500 86ba49-86ba4f call 863999 494->500 497->494 512 86b91f-86b924 498->512 513 86b929-86b933 498->513 499->488 500->424 512->499 515 86b935-86b93b 513->515 516 86b93d-86b945 513->516 517 86b956-86b9b6 call 8638d4 515->517 518 86b947-86b94f 516->518 519 86b951-86b954 516->519 522 86b9da-86b9fb call 88f0f0 call 86b106 517->522 523 86b9b8-86b9d4 call 8637d3 517->523 518->517 519->517 522->494 530 86b9fd-86ba0d call 8637d3 522->530 523->522 530->465
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 0086B3FF
                                                                                                                                                                                                                        • SetFilePointerEx.KERNELBASE(000000FF,00000000,00000000,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0086B44C
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 0086B452
                                                                                                                                                                                                                        • ReadFile.KERNELBASE(00000000,0086435C,00000040,?,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0086B49A
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,00000000,76EEC3F0,00000000), ref: 0086B4A0
                                                                                                                                                                                                                        • SetFilePointerEx.KERNELBASE(00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0086B4FD
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0086B503
                                                                                                                                                                                                                        • ReadFile.KERNELBASE(00000000,?,00000018,00000040,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0086B54C
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0086B552
                                                                                                                                                                                                                        • SetFilePointerEx.KERNELBASE(00000000,-00000098,00000000,00000000,00000000,?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0086B5C3
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00000000,00000000,?,?,?,00000000,76EEC3F0,00000000), ref: 0086B5C9
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$File$Pointer$Read
                                                                                                                                                                                                                        • String ID: ($.wix$4$Failed to allocate buffer for section info.$Failed to allocate memory for container sizes.$Failed to find Burn section.$Failed to find valid DOS image header in buffer.$Failed to find valid NT image header in buffer.$Failed to get total size of bundle.$Failed to open handle to engine process path.$Failed to read DOS header.$Failed to read NT header.$Failed to read complete image section header, index: %u$Failed to read complete section info.$Failed to read image section header, index: %u$Failed to read section info, data to short: %u$Failed to read section info, unsupported version: %08x$Failed to read section info.$Failed to read signature offset.$Failed to read signature size.$Failed to seek past optional headers.$Failed to seek to NT header.$Failed to seek to section info.$Failed to seek to start of file.$PE$PE Header from file didn't match PE Header in memory.$burn$section.cpp
                                                                                                                                                                                                                        • API String ID: 2600052162-695169583
                                                                                                                                                                                                                        • Opcode ID: b18ca400a600a3c75aa71cada5cb92acdd019e6362a91d631331c27326711756
                                                                                                                                                                                                                        • Instruction ID: 77627b76e6c6ec08d7cb92543a9c5f2f1c244ffeaf8905955f636cb66bd71a9b
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b18ca400a600a3c75aa71cada5cb92acdd019e6362a91d631331c27326711756
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8A12D871A41325ABFB209B68CC85FA77AA8FF05704F024165FD09F7681EB748D80CBA1
                                                                                                                                                                                                                        Function 008752E3 Relevance: 45.7, APIs: 17, Strings: 9, Instructions: 222filepipesleepCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 677 8752e3-875326 lstrlenW GetCurrentProcessId 678 875329-875330 677->678 679 875336-87534e SetNamedPipeHandleState 678->679 680 8755b2-8755ba 678->680 681 875354 679->681 682 87557b-8755a5 GetLastError call 8637d3 679->682 683 875358-875363 ConnectNamedPipe 681->683 691 8755aa-8755b1 call 8a012f 682->691 685 875365-87536c GetLastError 683->685 686 87539c-8753a2 683->686 688 875457-875459 685->688 689 875372-875377 685->689 686->683 690 8753a4-8753a6 686->690 692 8753ac-8753c1 SetNamedPipeHandleState 688->692 693 875444-875452 689->693 694 87537d-875385 689->694 690->692 695 875463-875478 call 8637d3 690->695 691->680 700 8753c7-8753dc WriteFile 692->700 701 87554a-875579 GetLastError call 8637d3 692->701 693->690 698 87545e 694->698 699 87538b-875396 Sleep 694->699 695->691 698->695 699->686 705 8753e2-8753f7 WriteFile 700->705 706 875519-875548 GetLastError call 8637d3 700->706 701->691 709 8754e5-875514 GetLastError call 8637d3 705->709 710 8753fd-875412 WriteFile 705->710 706->691 709->691 713 8754b1-8754e0 GetLastError call 8637d3 710->713 714 875418-87542d ReadFile 710->714 713->691 717 87542f-875439 714->717 718 87547d-8754ac GetLastError call 8637d3 714->718 717->678 721 87543f 717->721 718->691 721->680
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,?,00000000,?,008AB4F0,?,00000000,?,0086442A,?,008AB4F0), ref: 00875304
                                                                                                                                                                                                                        • GetCurrentProcessId.KERNEL32(?,0086442A,?,008AB4F0), ref: 0087530F
                                                                                                                                                                                                                        • SetNamedPipeHandleState.KERNELBASE(?,000000FF,00000000,00000000,?,0086442A,?,008AB4F0), ref: 00875346
                                                                                                                                                                                                                        • ConnectNamedPipe.KERNELBASE(?,00000000,?,0086442A,?,008AB4F0), ref: 0087535B
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,0086442A,?,008AB4F0), ref: 00875365
                                                                                                                                                                                                                        • Sleep.KERNELBASE(00000064,?,0086442A,?,008AB4F0), ref: 00875396
                                                                                                                                                                                                                        • SetNamedPipeHandleState.KERNELBASE(?,00000000,00000000,00000000,?,0086442A,?,008AB4F0), ref: 008753B9
                                                                                                                                                                                                                        • WriteFile.KERNEL32(?,crypt32.dll,00000004,00000000,00000000,?,0086442A,?,008AB4F0), ref: 008753D4
                                                                                                                                                                                                                        • WriteFile.KERNEL32(?,0086442A,008AB4F0,00000000,00000000,?,0086442A,?,008AB4F0), ref: 008753EF
                                                                                                                                                                                                                        • WriteFile.KERNEL32(?,?,00000004,00000000,00000000,?,0086442A,?,008AB4F0), ref: 0087540A
                                                                                                                                                                                                                        • ReadFile.KERNELBASE(?,00000000,00000004,00000000,00000000,?,0086442A,?,008AB4F0), ref: 00875425
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,0086442A,?,008AB4F0), ref: 0087547D
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,0086442A,?,008AB4F0), ref: 008754B1
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,0086442A,?,008AB4F0), ref: 008754E5
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,0086442A,?,008AB4F0), ref: 0087557B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$File$NamedPipeWrite$HandleState$ConnectCurrentProcessReadSleeplstrlen
                                                                                                                                                                                                                        • String ID: Failed to read ACK from pipe.$Failed to reset pipe to blocking.$Failed to set pipe to non-blocking.$Failed to wait for child to connect to pipe.$Failed to write our process id to pipe.$Failed to write secret length to pipe.$Failed to write secret to pipe.$crypt32.dll$pipe.cpp
                                                                                                                                                                                                                        • API String ID: 2944378912-2047837012
                                                                                                                                                                                                                        • Opcode ID: f187189b82a467385db3f887014b883b25158040ee44f4e5a70f89cca21ba261
                                                                                                                                                                                                                        • Instruction ID: 103240b34d28d4784af814c0d86a9acde7487b7696493cd36af44be465867c32
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f187189b82a467385db3f887014b883b25158040ee44f4e5a70f89cca21ba261
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5D6197B2E40729AAF710DAB98C45BEBB6E8FF04740F118125FD15E7295EBB4CD0086E5
                                                                                                                                                                                                                        Function 0086508D Relevance: 44.1, APIs: 5, Strings: 20, Instructions: 322COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 723 86508d-86513b call 88f670 * 2 GetModuleHandleW call 8a03f0 call 8a05a2 call 861209 734 865151-865162 call 8641d2 723->734 735 86513d 723->735 741 865164-865169 734->741 742 86516b-865187 call 865525 CoInitializeEx 734->742 736 865142-86514c call 8a012f 735->736 743 8653cc-8653d3 736->743 741->736 751 865190-86519c call 89fbad 742->751 752 865189-86518e 742->752 745 8653d5-8653db call 8a54ef 743->745 746 8653e0-8653e2 743->746 745->746 749 865407-865425 call 86d723 call 87a6d0 call 87a91e 746->749 750 8653e4-8653eb 746->750 772 865427-86542f 749->772 773 865453-865466 call 864e9c 749->773 750->749 754 8653ed-865402 call 8a041b 750->754 759 8651b0-8651bf call 8a0cd1 751->759 760 86519e 751->760 752->736 754->749 770 8651c1-8651c6 759->770 771 8651c8-8651d7 call 8a29b3 759->771 763 8651a3-8651ab call 8a012f 760->763 763->743 770->763 780 8651e0-8651ef call 8a343b 771->780 781 8651d9-8651de 771->781 772->773 775 865431-865434 772->775 784 86546d-865474 773->784 785 865468 call 8a3911 773->785 775->773 778 865436-865451 call 87416a call 86550f 775->778 778->773 792 8651f1-8651f6 780->792 793 8651f8-865217 GetVersionExW 780->793 781->763 786 865476 call 8a2dd0 784->786 787 86547b-865482 784->787 785->784 786->787 794 865484 call 8a1317 787->794 795 865489-865490 787->795 792->763 797 865251-865296 call 8633d7 call 86550f 793->797 798 865219-86524c GetLastError call 8637d3 793->798 794->795 800 865497-865499 795->800 801 865492 call 89fcbc 795->801 821 865298-8652a3 call 8a54ef 797->821 822 8652a9-8652b9 call 877337 797->822 798->763 806 8654a1-8654a8 800->806 807 86549b CoUninitialize 800->807 801->800 810 8654e3-8654ec call 8a000b 806->810 811 8654aa-8654ac 806->811 807->806 819 8654f3-86550c call 8a06f5 call 88de36 810->819 820 8654ee call 8644e9 810->820 814 8654b2-8654b8 811->814 815 8654ae-8654b0 811->815 818 8654ba-8654c9 call 873c30 call 86550f 814->818 815->818 835 8654ce-8654d3 818->835 820->819 821->822 833 8652c5-8652ce 822->833 834 8652bb 822->834 838 865396-8653ac call 864c33 833->838 839 8652d4-8652d7 833->839 834->833 835->810 837 8654d5-8654e2 call 86550f 835->837 837->810 850 8653ae 838->850 851 8653b8-8653ca 838->851 843 86536e-865381 call 8649df 839->843 844 8652dd-8652e0 839->844 855 865386-86538a 843->855 847 865346-865362 call 8647e9 844->847 848 8652e2-8652e5 844->848 847->851 862 865364 847->862 853 8652e7-8652ea 848->853 854 86531e-86533a call 864982 848->854 850->851 851->743 858 8652ec-8652f1 853->858 859 8652fb-86530e call 864b80 853->859 854->851 864 86533c 854->864 855->851 860 86538c 855->860 858->859 859->851 866 865314 859->866 860->838 862->843 864->847 866->854
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?), ref: 0086510F
                                                                                                                                                                                                                          • Part of subcall function 008A03F0: InitializeCriticalSection.KERNEL32(008CB60C,?,0086511B,00000000,?,?,?,?,?,?), ref: 008A0407
                                                                                                                                                                                                                          • Part of subcall function 00861209: CommandLineToArgvW.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000,ignored ,00000000,?,00000000,?,?,?,00865137,00000000,?), ref: 00861247
                                                                                                                                                                                                                          • Part of subcall function 00861209: GetLastError.KERNEL32(?,?,?,00865137,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 00861251
                                                                                                                                                                                                                        • CoInitializeEx.COMBASE(00000000,00000000,?,?,00000000,?,?,00000003,00000000,00000000,?,?,?,?,?,?), ref: 0086517D
                                                                                                                                                                                                                          • Part of subcall function 008A0CD1: GetProcAddress.KERNEL32(RegDeleteKeyExW,AdvApi32.dll), ref: 008A0CF2
                                                                                                                                                                                                                        • GetVersionExW.KERNEL32(?,?,?,?,?,?,?), ref: 0086520F
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,?,?,?,?), ref: 00865219
                                                                                                                                                                                                                        • CoUninitialize.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0086549B
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorInitializeLast$AddressArgvCommandCriticalHandleLineModuleProcSectionUninitializeVersion
                                                                                                                                                                                                                        • String ID: 3.10.4.4718$Failed to get OS info.$Failed to initialize COM.$Failed to initialize Cryputil.$Failed to initialize Regutil.$Failed to initialize Wiutil.$Failed to initialize XML util.$Failed to initialize core.$Failed to initialize engine state.$Failed to parse command line.$Failed to run RunOnce mode.$Failed to run embedded mode.$Failed to run per-machine mode.$Failed to run per-user mode.$Failed to run untrusted mode.$Invalid run mode.$Setup$_Failed$engine.cpp$txt
                                                                                                                                                                                                                        • API String ID: 3262001429-867073019
                                                                                                                                                                                                                        • Opcode ID: 414d3a72f57f49e72a8c878f6e55c8c7aceb663f90081772339748c7eea2d46f
                                                                                                                                                                                                                        • Instruction ID: a197a5a3b2517791743fcefc8ad9b2769703da0ed8d5d0257ba3fa09867f5b37
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 414d3a72f57f49e72a8c878f6e55c8c7aceb663f90081772339748c7eea2d46f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 83B1C771D41A299BEB32AF68CC46BEE76A4FF05701F0601D5F908E6341DB749E808F92
                                                                                                                                                                                                                        Function 00877337 Relevance: 35.3, APIs: 1, Strings: 19, Instructions: 277COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 1135 877337-87737c call 88f670 call 867503 1140 87737e-877383 1135->1140 1141 877388-877399 call 86c2a1 1135->1141 1142 877602-877609 call 8a012f 1140->1142 1146 8773a5-8773b6 call 86c108 1141->1146 1147 87739b-8773a0 1141->1147 1150 87760a-87760f 1142->1150 1154 8773c2-8773d7 call 86c362 1146->1154 1155 8773b8-8773bd 1146->1155 1147->1142 1152 877617-87761b 1150->1152 1153 877611-877612 call 8a54ef 1150->1153 1157 877625-87762a 1152->1157 1158 87761d-877620 call 8a54ef 1152->1158 1153->1152 1167 8773e3-8773f3 call 88bdc9 1154->1167 1168 8773d9-8773de 1154->1168 1155->1142 1160 877632-87763f call 86c055 1157->1160 1161 87762c-87762d call 8a54ef 1157->1161 1158->1157 1169 877641-877644 call 8a54ef 1160->1169 1170 877649-87764d 1160->1170 1161->1160 1176 8773f5-8773fa 1167->1176 1177 8773ff-877472 call 875a35 1167->1177 1168->1142 1169->1170 1174 877657-87765b 1170->1174 1175 87764f-877652 call 8a54ef 1170->1175 1179 877665-87766d 1174->1179 1180 87765d-877660 call 863999 1174->1180 1175->1174 1176->1142 1184 877474-877479 1177->1184 1185 87747e-8774c2 call 86550f GetCurrentProcess call 8a076c call 868152 1177->1185 1180->1179 1184->1142 1192 8774c4-8774d7 call 8a012f 1185->1192 1193 8774dc-8774e1 1185->1193 1192->1150 1194 8774e3-8774f5 call 8680f6 1193->1194 1195 87753d-877542 1193->1195 1206 8774f7-8774fc 1194->1206 1207 877501-877511 call 863446 1194->1207 1198 877544-877556 call 8680f6 1195->1198 1199 877562-87756b 1195->1199 1198->1199 1210 877558-87755d 1198->1210 1202 877577-87758b call 87a307 1199->1202 1203 87756d-877570 1199->1203 1215 877594 1202->1215 1216 87758d-877592 1202->1216 1203->1202 1208 877572-877575 1203->1208 1206->1142 1219 877513-877518 1207->1219 1220 87751d-877531 call 8680f6 1207->1220 1208->1202 1211 87759a-87759d 1208->1211 1210->1142 1217 8775a4-8775ba call 86d497 1211->1217 1218 87759f-8775a2 1211->1218 1215->1211 1216->1142 1225 8775c3-8775d2 call 86cabe 1217->1225 1226 8775bc-8775c1 1217->1226 1218->1150 1218->1217 1219->1142 1220->1195 1228 877533-877538 1220->1228 1229 8775d7-8775db 1225->1229 1226->1142 1228->1142 1230 8775e4-8775fb call 86c7df 1229->1230 1231 8775dd-8775e2 1229->1231 1230->1150 1234 8775fd 1230->1234 1231->1142 1234->1142
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to overwrite the %ls built-in variable., xrefs: 008774C9
                                                                                                                                                                                                                        • Failed to extract bootstrapper application payloads., xrefs: 008775DD
                                                                                                                                                                                                                        • Failed to set original source variable., xrefs: 00877558
                                                                                                                                                                                                                        • Failed to get source process folder from path., xrefs: 00877513
                                                                                                                                                                                                                        • Failed to initialize internal cache functionality., xrefs: 0087758D
                                                                                                                                                                                                                        • WixBundleSourceProcessPath, xrefs: 008774E6
                                                                                                                                                                                                                        • Failed to load manifest., xrefs: 008773F5
                                                                                                                                                                                                                        • Failed to load catalog files., xrefs: 008775FD
                                                                                                                                                                                                                        • Failed to parse command line., xrefs: 00877474
                                                                                                                                                                                                                        • WixBundleElevated, xrefs: 008774B3, 008774C4
                                                                                                                                                                                                                        • Failed to open manifest stream., xrefs: 008773B8
                                                                                                                                                                                                                        • WixBundleSourceProcessFolder, xrefs: 00877522
                                                                                                                                                                                                                        • Failed to get unique temporary folder for bootstrapper application., xrefs: 008775BC
                                                                                                                                                                                                                        • WixBundleOriginalSource, xrefs: 00877547
                                                                                                                                                                                                                        • Failed to open attached UX container., xrefs: 0087739B
                                                                                                                                                                                                                        • Failed to set source process path variable., xrefs: 008774F7
                                                                                                                                                                                                                        • Failed to get manifest stream from container., xrefs: 008773D9
                                                                                                                                                                                                                        • Failed to initialize variables., xrefs: 0087737E
                                                                                                                                                                                                                        • Failed to set source process folder variable., xrefs: 00877533
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalInitializeSection
                                                                                                                                                                                                                        • String ID: Failed to extract bootstrapper application payloads.$Failed to get manifest stream from container.$Failed to get source process folder from path.$Failed to get unique temporary folder for bootstrapper application.$Failed to initialize internal cache functionality.$Failed to initialize variables.$Failed to load catalog files.$Failed to load manifest.$Failed to open attached UX container.$Failed to open manifest stream.$Failed to overwrite the %ls built-in variable.$Failed to parse command line.$Failed to set original source variable.$Failed to set source process folder variable.$Failed to set source process path variable.$WixBundleElevated$WixBundleOriginalSource$WixBundleSourceProcessFolder$WixBundleSourceProcessPath
                                                                                                                                                                                                                        • API String ID: 32694325-252221001
                                                                                                                                                                                                                        • Opcode ID: b9240851bf86c212cef2053991e86b3ac6ed8212539f40cdb4460f7540013ac8
                                                                                                                                                                                                                        • Instruction ID: 3192bdb57a60367c1f25f06d745603411a7139df66422ba0e4e9f656c4164b48
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b9240851bf86c212cef2053991e86b3ac6ed8212539f40cdb4460f7540013ac8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: EF91B872E44A1ABBDB129AA8CC42EEEB76CFF14700F014226F519E7245D734EA44CBD5
                                                                                                                                                                                                                        Function 008784C4 Relevance: 35.2, APIs: 9, Strings: 11, Instructions: 205fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 1235 8784c4-878512 CreateFileW 1236 878514-878553 GetLastError call 8637d3 call 8a012f 1235->1236 1237 878558-878568 call 8a47d3 1235->1237 1248 8786fc-87870e call 88de36 1236->1248 1242 878580-87858b call 8a3db5 1237->1242 1243 87856a-87857b call 8a012f 1237->1243 1250 878590-878594 1242->1250 1251 8786f5-8786f6 CloseHandle 1243->1251 1252 878596-8785aa call 8a012f 1250->1252 1253 8785af-8785b4 1250->1253 1251->1248 1252->1251 1253->1251 1256 8785ba-8785c9 SetFilePointerEx 1253->1256 1259 878603-878613 call 8a4cee 1256->1259 1260 8785cb-8785fe GetLastError call 8637d3 1256->1260 1266 878615-87861a 1259->1266 1267 87861f-878630 SetFilePointerEx 1259->1267 1265 8786ed-8786f4 call 8a012f 1260->1265 1265->1251 1266->1265 1268 878632-878665 GetLastError call 8637d3 1267->1268 1269 87866a-87867a call 8a4cee 1267->1269 1268->1265 1269->1266 1276 87867c-87868c call 8a4cee 1269->1276 1276->1266 1279 87868e-87869f SetFilePointerEx 1276->1279 1280 8786d6-8786e6 call 8a4cee 1279->1280 1281 8786a1-8786d4 GetLastError call 8637d3 1279->1281 1280->1251 1286 8786e8 1280->1286 1281->1265 1286->1265
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateFileW.KERNELBASE(00000000,40000000,00000005,00000000,00000002,08000080,00000000,?,00000000,00000000,00864CB6,?,?,00000000,00864CB6,00000000), ref: 00878507
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 00878514
                                                                                                                                                                                                                        • CloseHandle.KERNELBASE(00000000,?,00000000,008AB4F0,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 008786F6
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to seek to checksum in exe header., xrefs: 008785F9
                                                                                                                                                                                                                        • Failed to update signature offset., xrefs: 00878615
                                                                                                                                                                                                                        • Failed to seek to beginning of engine file: %ls, xrefs: 0087856D
                                                                                                                                                                                                                        • msi.dll, xrefs: 00878608
                                                                                                                                                                                                                        • Failed to seek to signature table in exe header., xrefs: 00878660
                                                                                                                                                                                                                        • Failed to create engine file at path: %ls, xrefs: 00878545
                                                                                                                                                                                                                        • cabinet.dll, xrefs: 0087866F
                                                                                                                                                                                                                        • Failed to seek to original data in exe burn section header., xrefs: 008786CF
                                                                                                                                                                                                                        • cache.cpp, xrefs: 00878538, 008785EF, 00878656, 008786C5
                                                                                                                                                                                                                        • Failed to zero out original data offset., xrefs: 008786E8
                                                                                                                                                                                                                        • Failed to copy engine from: %ls to: %ls, xrefs: 0087859C
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseCreateErrorFileHandleLast
                                                                                                                                                                                                                        • String ID: Failed to copy engine from: %ls to: %ls$Failed to create engine file at path: %ls$Failed to seek to beginning of engine file: %ls$Failed to seek to checksum in exe header.$Failed to seek to original data in exe burn section header.$Failed to seek to signature table in exe header.$Failed to update signature offset.$Failed to zero out original data offset.$cabinet.dll$cache.cpp$msi.dll
                                                                                                                                                                                                                        • API String ID: 2528220319-1976062716
                                                                                                                                                                                                                        • Opcode ID: 65620ce0d9ac42b5342298dbdd7d102eeffedfce6955a3302db01fcbc67dad9e
                                                                                                                                                                                                                        • Instruction ID: 12b718fea459cf56f97741353f80f3df74252f97d75b2a7ca40ba1ee0026cd63
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 65620ce0d9ac42b5342298dbdd7d102eeffedfce6955a3302db01fcbc67dad9e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3951D672A80725BBFB116B688C4EFBB3698FB45710F014125FE04E7295EF64CD1096E6
                                                                                                                                                                                                                        Function 00867503 Relevance: 33.4, APIs: 1, Strings: 21, Instructions: 378COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 1287 867503-867dc0 InitializeCriticalSection 1288 867dc3-867de0 call 865530 1287->1288 1291 867de2-867de9 1288->1291 1292 867ded-867dfb call 8a012f 1288->1292 1291->1288 1293 867deb 1291->1293 1295 867dfe-867e10 call 88de36 1292->1295 1293->1295
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • InitializeCriticalSection.KERNEL32(00877378,008652B5,00000000,0086533D), ref: 00867523
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalInitializeSection
                                                                                                                                                                                                                        • String ID: #$$$'$0$Date$Failed to add built-in variable: %ls.$InstallerName$InstallerVersion$LogonUser$WixBundleAction$WixBundleActiveParent$WixBundleElevated$WixBundleExecutePackageAction$WixBundleExecutePackageCacheFolder$WixBundleForcedRestartPackage$WixBundleInstalled$WixBundleProviderKey$WixBundleSourceProcessFolder$WixBundleSourceProcessPath$WixBundleTag$WixBundleVersion
                                                                                                                                                                                                                        • API String ID: 32694325-826827252
                                                                                                                                                                                                                        • Opcode ID: d882817e16ebbe3bc472caf4ee09ffdc94627fb8223f434885f46c351ac25824
                                                                                                                                                                                                                        • Instruction ID: 8139c86788355f86373c5517ac09a7799a8182ae6f581cfc7d642080be48a899
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d882817e16ebbe3bc472caf4ee09ffdc94627fb8223f434885f46c351ac25824
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B9321CB0D252798BDB65CF5989487DDBAF8FB49B04F5081DEE20CA6611D7B10B88CF84
                                                                                                                                                                                                                        Function 008780AE Relevance: 31.7, APIs: 7, Strings: 11, Instructions: 151COMMON
                                                                                                                                                                                                                        Download Yara Rule

                                                                                                                                                                                                                        Control-flow Graph

                                                                                                                                                                                                                        • Executed
                                                                                                                                                                                                                        • Not Executed
                                                                                                                                                                                                                        control_flow_graph 1431 8780ae-8780f7 call 88f670 1434 878270-87827d call 8621a5 1431->1434 1435 8780fd-87810b GetCurrentProcess call 8a076c 1431->1435 1440 87827f 1434->1440 1441 87828c-87829e call 88de36 1434->1441 1438 878110-87811d 1435->1438 1442 878123-878132 GetWindowsDirectoryW 1438->1442 1443 8781ab-8781b9 GetTempPathW 1438->1443 1444 878284-87828b call 8a012f 1440->1444 1445 878134-878167 GetLastError call 8637d3 1442->1445 1446 87816c-87817d call 86338f 1442->1446 1448 8781f3-878205 UuidCreate 1443->1448 1449 8781bb-8781ee GetLastError call 8637d3 1443->1449 1444->1441 1445->1444 1465 87817f-878184 1446->1465 1466 878189-87819f call 8636b4 1446->1466 1452 878207-87820c 1448->1452 1453 87820e-878223 StringFromGUID2 1448->1453 1449->1444 1452->1444 1459 878225-87823f call 8637d3 1453->1459 1460 878241-878262 call 861f20 1453->1460 1459->1444 1470 878264-878269 1460->1470 1471 87826b 1460->1471 1465->1444 1466->1448 1473 8781a1-8781a6 1466->1473 1470->1444 1471->1434 1473->1444
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000000,00000000,?,?), ref: 00878104
                                                                                                                                                                                                                          • Part of subcall function 008A076C: OpenProcessToken.ADVAPI32(?,00000008,?,?,?,?,?,?,?,00878110,00000000), ref: 008A078A
                                                                                                                                                                                                                          • Part of subcall function 008A076C: GetLastError.KERNEL32(?,?,?,?,00878110,00000000), ref: 008A0794
                                                                                                                                                                                                                          • Part of subcall function 008A076C: CloseHandle.KERNELBASE(?,?,?,?,?,00878110,00000000), ref: 008A081D
                                                                                                                                                                                                                        • GetWindowsDirectoryW.KERNEL32(?,00000104,00000000), ref: 0087812A
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 00878134
                                                                                                                                                                                                                        • GetTempPathW.KERNEL32(00000104,?,00000000), ref: 008781B1
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 008781BB
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to get temp path for working folder., xrefs: 008781E9
                                                                                                                                                                                                                        • Temp\, xrefs: 00878189
                                                                                                                                                                                                                        • Failed to append bundle id on to temp path for working folder., xrefs: 00878264
                                                                                                                                                                                                                        • Failed to create working folder guid., xrefs: 00878207
                                                                                                                                                                                                                        • Failed to ensure windows path for working folder ended in backslash., xrefs: 0087817F
                                                                                                                                                                                                                        • Failed to copy working folder path., xrefs: 0087827F
                                                                                                                                                                                                                        • Failed to convert working folder guid into string., xrefs: 0087823A
                                                                                                                                                                                                                        • Failed to get windows path for working folder., xrefs: 00878162
                                                                                                                                                                                                                        • cache.cpp, xrefs: 00878158, 008781DF, 00878230
                                                                                                                                                                                                                        • Failed to concat Temp directory on windows path for working folder., xrefs: 008781A1
                                                                                                                                                                                                                        • %ls%ls\, xrefs: 0087824C
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$Process$CloseCurrentDirectoryHandleOpenPathTempTokenWindows
                                                                                                                                                                                                                        • String ID: %ls%ls\$Failed to append bundle id on to temp path for working folder.$Failed to concat Temp directory on windows path for working folder.$Failed to convert working folder guid into string.$Failed to copy working folder path.$Failed to create working folder guid.$Failed to ensure windows path for working folder ended in backslash.$Failed to get temp path for working folder.$Failed to get windows path for working folder.$Temp\$cache.cpp
                                                                                                                                                                                                                        • API String ID: 348923985-819636856
                                                                                                                                                                                                                        • Opcode ID: 117ace02e1f05d27e7d0957efa957da44b26a392e444b23d80a794d5e3b73f0a
                                                                                                                                                                                                                        • Instruction ID: 3c761121cf17264fe8feef23c4c2523092f309514bd072e99ad8f1f48b6bf4c3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 117ace02e1f05d27e7d0957efa957da44b26a392e444b23d80a794d5e3b73f0a
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: CE41D972B80728BBEB6096B49C4EFAB77A8FB04711F014155F909E7241EE79DD0446A2
                                                                                                                                                                                                                        Function 008641D2 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 158stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • InitializeCriticalSection.KERNEL32(00000000,?,00000000,00000000,?,?,0086515E,?,?,00000000,?,?), ref: 008641FE
                                                                                                                                                                                                                        • InitializeCriticalSection.KERNEL32(000000D0,?,?,0086515E,?,?,00000000,?,?), ref: 00864207
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(burn.filehandle.attached,000004B8,000004A0,?,?,0086515E,?,?,00000000,?,?), ref: 0086424D
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(burn.filehandle.attached,burn.filehandle.attached,00000000,?,?,0086515E,?,?,00000000,?,?), ref: 00864257
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,0086515E,?,?,00000000,?,?), ref: 0086426B
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(burn.filehandle.attached,?,?,0086515E,?,?,00000000,?,?), ref: 0086427B
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(burn.filehandle.self,?,?,0086515E,?,?,00000000,?,?), ref: 008642CB
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(burn.filehandle.self,burn.filehandle.self,00000000,?,?,0086515E,?,?,00000000,?,?), ref: 008642D5
                                                                                                                                                                                                                        • CompareStringW.KERNEL32(0000007F,00000001,?,00000000,?,?,0086515E,?,?,00000000,?,?), ref: 008642E9
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(burn.filehandle.self,?,?,0086515E,?,?,00000000,?,?), ref: 008642F9
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: lstrlen$CompareCriticalInitializeSectionString
                                                                                                                                                                                                                        • String ID: Failed to initialize engine section.$Failed to parse file handle: '%ls'$Missing required parameter for switch: %ls$burn.filehandle.attached$burn.filehandle.self$engine.cpp
                                                                                                                                                                                                                        • API String ID: 3039292287-3209860532
                                                                                                                                                                                                                        • Opcode ID: e0f2261f9a496a834b81dc5603adabf9cf7a8274fabd74d2f8d232607c11cbb6
                                                                                                                                                                                                                        • Instruction ID: d7f3af02577baa689f42c5fb3b8aaa9211bbde7257074a91f64c9cf90440eb42
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e0f2261f9a496a834b81dc5603adabf9cf7a8274fabd74d2f8d232607c11cbb6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 6351F471A00619BFD7209F69CC86FAEBB6CFB05760F010126F628D7391DB74A950CBA4
                                                                                                                                                                                                                        Function 0087E563 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 135registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • TlsSetValue.KERNEL32(?,?), ref: 0087E5AE
                                                                                                                                                                                                                        • RegisterClassW.USER32(?), ref: 0087E5DA
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 0087E5E5
                                                                                                                                                                                                                        • CreateWindowExW.USER32(00000080,008B9CC4,00000000,90000000,80000000,00000008,00000000,00000000,00000000,00000000,?,?), ref: 0087E64C
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 0087E656
                                                                                                                                                                                                                        • UnregisterClassW.USER32(WixBurnMessageWindow,?), ref: 0087E6F4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ClassErrorLast$CreateRegisterUnregisterValueWindow
                                                                                                                                                                                                                        • String ID: Failed to create window.$Failed to register window.$Unexpected return value from message pump.$WixBurnMessageWindow$uithread.cpp
                                                                                                                                                                                                                        • API String ID: 213125376-288575659
                                                                                                                                                                                                                        • Opcode ID: 2437cd01a09a9904f48faec4ec5d00bdf5cfa182b3b9331d541e13b9c98589bb
                                                                                                                                                                                                                        • Instruction ID: 8d2a41da88a4c7e6343765420d302ebf8e91727bcbc2008ad2734a516ded6bb6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 2437cd01a09a9904f48faec4ec5d00bdf5cfa182b3b9331d541e13b9c98589bb
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D9418472A00614ABEF109BA4DC44BDBBFF8FF19350F118166F909E6690D731D950CBA1
                                                                                                                                                                                                                        Function 0086C129 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 128fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateFileW.KERNEL32(0088AB22,80000000,00000001,00000000,00000003,08000080,00000000,?,00000000,?,?,0088AB22), ref: 0086C170
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,0088AB22), ref: 0086C181
                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00000000,?,?,0088AB22), ref: 0086C1D0
                                                                                                                                                                                                                        • GetCurrentProcess.KERNEL32(000000FF,00000000,?,0088AB22), ref: 0086C1D6
                                                                                                                                                                                                                        • DuplicateHandle.KERNELBASE(00000000,?,0088AB22), ref: 0086C1D9
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,0088AB22), ref: 0086C1E3
                                                                                                                                                                                                                        • SetFilePointerEx.KERNELBASE(00000000,00000000,00000000,00000000,00000000,?,0088AB22), ref: 0086C235
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,0088AB22), ref: 0086C23F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$CurrentFileProcess$CreateDuplicateHandlePointer
                                                                                                                                                                                                                        • String ID: Failed to duplicate handle to container: %ls$Failed to move file pointer to container offset.$Failed to open container.$Failed to open file: %ls$container.cpp
                                                                                                                                                                                                                        • API String ID: 2619879409-2168299741
                                                                                                                                                                                                                        • Opcode ID: 3f08311951e0121e67884a45fb995d2884e643158d5c8125d12408e9f6e50cd6
                                                                                                                                                                                                                        • Instruction ID: 030b043e5bb436fb260c6b9ac51913e0cbc44413df654cdbd01a92d70f92958c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3f08311951e0121e67884a45fb995d2884e643158d5c8125d12408e9f6e50cd6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 18418472240301ABEB209F6A9C45F673BE9FB86750F124129FD18DB792DB75C811CBA1
                                                                                                                                                                                                                        Function 00881484 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 103COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateEventW.KERNEL32(00000000,00000001,00000000,00000000,0000001C,?,00000000,00000000,00000000,00000000,?,0086C285,00000000,0088AB22,?,0088AB22), ref: 008814BB
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,0086C285,00000000,0088AB22,?,0088AB22), ref: 008814C4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CreateErrorEventLast
                                                                                                                                                                                                                        • String ID: Failed to copy file name.$Failed to create begin operation event.$Failed to create extraction thread.$Failed to create operation complete event.$Failed to wait for operation complete.$cabextract.cpp
                                                                                                                                                                                                                        • API String ID: 545576003-1680384675
                                                                                                                                                                                                                        • Opcode ID: 7d7ac394b7436088893f67fb049f6a357ae3a7c2908168a3a329c104645a3222
                                                                                                                                                                                                                        • Instruction ID: 5a4ff9341ad85c9943594b13b5571eeacc87062e085e466840095ed81f9f3f2c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7d7ac394b7436088893f67fb049f6a357ae3a7c2908168a3a329c104645a3222
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5921F7B2A40B267AF72066795C45FA769DCFF44790B010222FC15E7781EF58DC0186E6
                                                                                                                                                                                                                        Function 00881224 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88threadCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000000FF,00000000,74DF2F60,?,00000000,?,?,?,00000000), ref: 00881249
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,00000000,?,?,?,?,0088B555,?,?,80000000,?,?,?,?,?), ref: 0088125C
                                                                                                                                                                                                                        • GetExitCodeThread.KERNELBASE(?,?,?,?,00000000,?,?,?,?,0088B555,?,?,80000000,?,?,?), ref: 0088129E
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,00000000,?,?,?,?,0088B555,?,?,80000000,?,?,?,?,?), ref: 008812AC
                                                                                                                                                                                                                        • ResetEvent.KERNEL32(?,?,?,00000000,?,?,?,?,0088B555,?,?,80000000,?,?,?,?), ref: 008812E7
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,?,00000000,?,?,?,?,0088B555,?,?,80000000,?,?,?,?,?), ref: 008812F1
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$CodeEventExitMultipleObjectsResetThreadWait
                                                                                                                                                                                                                        • String ID: Failed to get extraction thread exit code.$Failed to reset operation complete event.$Failed to wait for operation complete event.$cabextract.cpp
                                                                                                                                                                                                                        • API String ID: 2979751695-3400260300
                                                                                                                                                                                                                        • Opcode ID: f04bafebdb5dd9ee0f2d4c904c8ef4336103b31d251347eb6716ba503b7baf3c
                                                                                                                                                                                                                        • Instruction ID: 0c05611d9df358c003ac15fa996f7d4f3fe8bdc7ef67cf870a5743fe2971a272
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f04bafebdb5dd9ee0f2d4c904c8ef4336103b31d251347eb6716ba503b7baf3c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A121D271740304AFFB18AB799D59ABE7AF8FB05710F00412EF856D67A0EB38CA019B15
                                                                                                                                                                                                                        Function 0086D5C0 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 61libraryloaderCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • LoadLibraryW.KERNELBASE(?,00000000,?,008646F8,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00865386,?,?), ref: 0086D5CD
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,008646F8,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00865386,?,?), ref: 0086D5DA
                                                                                                                                                                                                                        • GetProcAddress.KERNEL32(00000000,BootstrapperApplicationCreate), ref: 0086D612
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,008646F8,00000000,00000000,wininet.dll,?,00000000,00000000,?,?,00865386,?,?), ref: 0086D61E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLast$AddressLibraryLoadProc
                                                                                                                                                                                                                        • String ID: BootstrapperApplicationCreate$Failed to create UX.$Failed to get BootstrapperApplicationCreate entry-point$Failed to load UX DLL.$userexperience.cpp$wininet.dll
                                                                                                                                                                                                                        • API String ID: 1866314245-1140179540
                                                                                                                                                                                                                        • Opcode ID: 5306373c147f06d2ef9e7e6d2a222531519c854ad43e7e53e07750cc9d7b3f4e
                                                                                                                                                                                                                        • Instruction ID: bba86dee56dd26d7d82779e2be062637142b47b5a79e15a8dc3c85bcd64f8c1e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 5306373c147f06d2ef9e7e6d2a222531519c854ad43e7e53e07750cc9d7b3f4e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 4611A732B407216FF72156A99C05E5736D4FF06750F024139FE1AE7A91EF24CC008AD5
                                                                                                                                                                                                                        Function 0088B2F6 Relevance: 16.3, APIs: 2, Strings: 7, Instructions: 553COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID:
                                                                                                                                                                                                                        • String ID: ($Failed to set syncpoint event.$UX aborted cache.$apply.cpp$begin cache package$end cache package$layout bundle
                                                                                                                                                                                                                        • API String ID: 0-826262529
                                                                                                                                                                                                                        • Opcode ID: c70ea55f159b2b4204fa6af8b0cafb3a8f10fd67c92b0beb3953fbe579d01a9e
                                                                                                                                                                                                                        • Instruction ID: f7c48ca41a7a60cdebbb16fe9a12c7f363ec17767ddce71955e276f37eace1ee
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c70ea55f159b2b4204fa6af8b0cafb3a8f10fd67c92b0beb3953fbe579d01a9e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D9223771A0061AFFDB15DF94CC80FAABBB6FF88710F108259F914AB251D331A961DB91
                                                                                                                                                                                                                        Function 00864690 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 128windowthreadCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PeekMessageW.USER32(00000000,00000000,00000400,00000400,00000000), ref: 008646B5
                                                                                                                                                                                                                        • GetCurrentThreadId.KERNEL32 ref: 008646BB
                                                                                                                                                                                                                          • Part of subcall function 0087FC51: new.LIBCMT ref: 0087FC58
                                                                                                                                                                                                                        • GetMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00864749
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to create engine for UX., xrefs: 008646D5
                                                                                                                                                                                                                        • engine.cpp, xrefs: 00864795
                                                                                                                                                                                                                        • Failed to start bootstrapper application., xrefs: 00864717
                                                                                                                                                                                                                        • wininet.dll, xrefs: 008646E8
                                                                                                                                                                                                                        • Failed to load UX., xrefs: 008646FE
                                                                                                                                                                                                                        • Unexpected return value from message pump., xrefs: 0086479F
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Message$CurrentPeekThread
                                                                                                                                                                                                                        • String ID: Failed to create engine for UX.$Failed to load UX.$Failed to start bootstrapper application.$Unexpected return value from message pump.$engine.cpp$wininet.dll
                                                                                                                                                                                                                        • API String ID: 673430819-2573580774
                                                                                                                                                                                                                        • Opcode ID: d78cada3c816812728339859dd1cb9782de4c3ce5e1f3bbf74f97630007462ad
                                                                                                                                                                                                                        • Instruction ID: a63d2fc1d7cda8b1140e8324e26cb6078b059b70cad6e4752124be37581bbe69
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d78cada3c816812728339859dd1cb9782de4c3ce5e1f3bbf74f97630007462ad
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 8441C27160021DBFEB159BA4CC85EBEB7ACFF06314F120125F915EB641EB24ED0187A2
                                                                                                                                                                                                                        Function 0086F69D Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 117registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 0086F7CD
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,?,?,00000001,?,?,?,00000001,00000000,?,00000000,?,?,?,00000000,?), ref: 0086F7DA
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Resume, xrefs: 0086F741
                                                                                                                                                                                                                        • %ls.RebootRequired, xrefs: 0086F6BA
                                                                                                                                                                                                                        • Failed to read Resume value., xrefs: 0086F763
                                                                                                                                                                                                                        • Failed to open registration key., xrefs: 0086F736
                                                                                                                                                                                                                        • Failed to format pending restart registry key to read., xrefs: 0086F6D1
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Close
                                                                                                                                                                                                                        • String ID: %ls.RebootRequired$Failed to format pending restart registry key to read.$Failed to open registration key.$Failed to read Resume value.$Resume
                                                                                                                                                                                                                        • API String ID: 3535843008-3890505273
                                                                                                                                                                                                                        • Opcode ID: c43ee96f7d070cdc1b032ac08a28c2223fe66eac6fb84e15b271cbdf565117f4
                                                                                                                                                                                                                        • Instruction ID: 12eef8cd97dd723eaeb7e706150fb3cc98c615c071096ad05367080e32e7b8ae
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: c43ee96f7d070cdc1b032ac08a28c2223fe66eac6fb84e15b271cbdf565117f4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 71419236900159EFCB119F98E881AEDBBB6FB01314F264176EA10EB312C371DE50DB81
                                                                                                                                                                                                                        Function 0087D206 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 120COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CloseHandle.KERNEL32(00000000,?,?,00000001,008AB4F0,?,00000001,000000FF,?,?,75C0B390,00000000,00000001,00000000,?,008772F3), ref: 0087D32F
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to elevate., xrefs: 0087D311
                                                                                                                                                                                                                        • Failed to connect to elevated child process., xrefs: 0087D318
                                                                                                                                                                                                                        • Failed to create pipe name and client token., xrefs: 0087D270
                                                                                                                                                                                                                        • Failed to create pipe and cache pipe., xrefs: 0087D28C
                                                                                                                                                                                                                        • UX aborted elevation requirement., xrefs: 0087D244
                                                                                                                                                                                                                        • elevation.cpp, xrefs: 0087D23A
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseHandle
                                                                                                                                                                                                                        • String ID: Failed to connect to elevated child process.$Failed to create pipe and cache pipe.$Failed to create pipe name and client token.$Failed to elevate.$UX aborted elevation requirement.$elevation.cpp
                                                                                                                                                                                                                        • API String ID: 2962429428-3003415917
                                                                                                                                                                                                                        • Opcode ID: 7652d5df9d3df44caf9fd5b67d4d45ebbd79f497f461129b0af9ff76623e66ee
                                                                                                                                                                                                                        • Instruction ID: c1a7682f18e647e38f7dd4ed0477169d90ae3d499e1add414721f82a2814ef1e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7652d5df9d3df44caf9fd5b67d4d45ebbd79f497f461129b0af9ff76623e66ee
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 74313B32A45B26BAE71596648C46FAB736CFF00730F105115F90DE6386EB61ED0042A6
                                                                                                                                                                                                                        Function 008A041B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 118fileCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(008CB60C,00000000,?,?,?,00865407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 008A042B
                                                                                                                                                                                                                        • CreateFileW.KERNEL32(40000000,00000001,00000000,00000002,00000080,00000000,?,00000000,?,?,?,008CB604,?,00865407,00000000,Setup), ref: 008A04CC
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,00865407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 008A04DC
                                                                                                                                                                                                                        • SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002,?,00865407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 008A0515
                                                                                                                                                                                                                          • Part of subcall function 00862DE0: GetLocalTime.KERNEL32(?,?,?,?,?,?), ref: 00862F1F
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(008CB60C,?,?,008CB604,?,00865407,00000000,Setup,_Failed,txt,00000000,00000000,00000000,?,?,?), ref: 008A056E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalFileSection$CreateEnterErrorLastLeaveLocalPointerTime
                                                                                                                                                                                                                        • String ID: logutil.cpp
                                                                                                                                                                                                                        • API String ID: 4111229724-3545173039
                                                                                                                                                                                                                        • Opcode ID: e5d258d3d79753014948eb323f540684a6caeefa6094105063550b39c36a669e
                                                                                                                                                                                                                        • Instruction ID: 981c7608b60701a67420ec4c122049d853c741511433ed519d89b3b7e2438fd9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: e5d258d3d79753014948eb323f540684a6caeefa6094105063550b39c36a669e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B631D371E01A19AFFB21AF64EC82E6A3A78FB12755F040129FA00F6561DB34CD509F95
                                                                                                                                                                                                                        Function 00867203 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 92COMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • EnterCriticalSection.KERNEL32(00000000,00000000,00000000,?,?,?,0086583F,000002C0,000002C0,00000000,00000100,00000001,00000000,000002C0,00000002), ref: 00867215
                                                                                                                                                                                                                        • LeaveCriticalSection.KERNEL32(00000000,00000000,00000002,00000000,?,?,?,0086583F,000002C0,000002C0,00000000,00000100,00000001,00000000,000002C0,00000002), ref: 008672F4
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to get variable: %ls, xrefs: 00867256
                                                                                                                                                                                                                        • Failed to format value '%ls' of variable: %ls, xrefs: 008672BE
                                                                                                                                                                                                                        • Failed to get unformatted string., xrefs: 00867285
                                                                                                                                                                                                                        • *****, xrefs: 008672B0, 008672BD
                                                                                                                                                                                                                        • Failed to get value as string for variable: %ls, xrefs: 008672E3
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CriticalSection$EnterLeave
                                                                                                                                                                                                                        • String ID: *****$Failed to format value '%ls' of variable: %ls$Failed to get unformatted string.$Failed to get value as string for variable: %ls$Failed to get variable: %ls
                                                                                                                                                                                                                        • API String ID: 3168844106-2873099529
                                                                                                                                                                                                                        • Opcode ID: 6d7c1af4ebdced71936e9208a3f5b6565628cfcc776e51987e7f49ff22ec00f0
                                                                                                                                                                                                                        • Instruction ID: cb3e5885e50590484561cc1e83422a8cd49029d964112a95381ef0c935d131e8
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 6d7c1af4ebdced71936e9208a3f5b6565628cfcc776e51987e7f49ff22ec00f0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 62310332D44A1ABBDF215B94CC21B9E7B64FF15328F124125F805E6B10D739AEA0DBC1
                                                                                                                                                                                                                        Function 008A343B Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 33COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CoInitialize.OLE32(00000000), ref: 008A344A
                                                                                                                                                                                                                        • InterlockedIncrement.KERNEL32(008CB6D8), ref: 008A3467
                                                                                                                                                                                                                        • CLSIDFromProgID.COMBASE(Msxml2.DOMDocument,008CB6C8,?,?,?,?,?,?), ref: 008A3482
                                                                                                                                                                                                                        • CLSIDFromProgID.OLE32(MSXML.DOMDocument,008CB6C8,?,?,?,?,?,?), ref: 008A348E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FromProg$IncrementInitializeInterlocked
                                                                                                                                                                                                                        • String ID: MSXML.DOMDocument$Msxml2.DOMDocument
                                                                                                                                                                                                                        • API String ID: 2109125048-2356320334
                                                                                                                                                                                                                        • Opcode ID: 27512db8e86d99caaf948e8f45d66e451a6c1fea7f14acbbdfd83a053cdc12c8
                                                                                                                                                                                                                        • Instruction ID: 2d54cfade8036c20d6621f1e1698ada117e69b5ff9997978e23cd8fab234c752
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 27512db8e86d99caaf948e8f45d66e451a6c1fea7f14acbbdfd83a053cdc12c8
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B6F03020746A7666FB224BA5EC0EF172EB4FBABB65F100429F940E1A94D374C94186A4
                                                                                                                                                                                                                        Function 008A10C5 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 149registrystringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RegQueryValueExW.KERNELBASE(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 008A10ED
                                                                                                                                                                                                                        • RegQueryValueExW.KERNELBASE(?,00000000,00000000,?,?,?,?,?,?,00876EF3,00000100,000000B0,00000088,00000410,000002C0), ref: 008A1126
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(?,?,?,00000000,?,-00000001,00000004,00000000), ref: 008A121A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: QueryValue$lstrlen
                                                                                                                                                                                                                        • String ID: BundleUpgradeCode$regutil.cpp
                                                                                                                                                                                                                        • API String ID: 3790715954-1648651458
                                                                                                                                                                                                                        • Opcode ID: 18b9565782a93ed7eb3ac731e4957b60021f52ba1fd54ef6701c2d9d5306c24b
                                                                                                                                                                                                                        • Instruction ID: 56d79dfc6213a840801bbe7921c2892f190abe87de7267b2061cb640c4d386e1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 18b9565782a93ed7eb3ac731e4957b60021f52ba1fd54ef6701c2d9d5306c24b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DB418035A0021AAFEF25DF99C889BAEB7B9FF46710F114169ED15EB610D630DD018B90
                                                                                                                                                                                                                        Function 008A4212 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 95registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 008A4315: FindFirstFileW.KERNELBASE(?,?,00000000,00000000,?), ref: 008A4350
                                                                                                                                                                                                                          • Part of subcall function 008A4315: FindClose.KERNEL32(00000000), ref: 008A435C
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(?,00000000,?,00000000,?,00000000,?,00000000,?,wininet.dll), ref: 008A4305
                                                                                                                                                                                                                          • Part of subcall function 008A0E3F: RegOpenKeyExW.KERNELBASE(?,00000000,00000000,00000000,00000001,00000000,?,008A5699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,?,00000000,00000000), ref: 008A0E52
                                                                                                                                                                                                                          • Part of subcall function 008A10C5: RegQueryValueExW.KERNELBASE(00000000,000002C0,00000000,000002C0,00000000,00000000,000002C0,BundleUpgradeCode,00000410,000002C0,00000000,00000000,00000000,00000100,00000000), ref: 008A10ED
                                                                                                                                                                                                                          • Part of subcall function 008A10C5: RegQueryValueExW.KERNELBASE(?,00000000,00000000,?,?,?,?,?,?,00876EF3,00000100,000000B0,00000088,00000410,000002C0), ref: 008A1126
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseFindQueryValue$FileFirstOpen
                                                                                                                                                                                                                        • String ID: PendingFileRenameOperations$SYSTEM\CurrentControlSet\Control\Session Manager$\$crypt32.dll
                                                                                                                                                                                                                        • API String ID: 3397690329-3978359083
                                                                                                                                                                                                                        • Opcode ID: 9c0bd6fca1fadc3ee95b0cff88a22af33f450db9c4da33261355481d6b444b94
                                                                                                                                                                                                                        • Instruction ID: b7605685c5eed4df6afe6e5daab8efdb28746f3358d6c9c046604b5db346e0ba
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9c0bd6fca1fadc3ee95b0cff88a22af33f450db9c4da33261355481d6b444b94
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3531F435900209EBFF20AFC5CC42BAEBB79FF82350F14916AF908E6551E3B08A40CB51
                                                                                                                                                                                                                        Function 00864013 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 79COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CreateDirectoryW.KERNELBASE(00000003,00000001,00000000,00000000,?,008A416C,00000001,00000000,?,008A4203,00000003,00000001,00000001,00000000,00000000,00000000), ref: 00864021
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,008A416C,00000001,00000000,?,008A4203,00000003,00000001,00000001,00000000,00000000,00000000,?,0087A55D,?,00000000), ref: 0086402F
                                                                                                                                                                                                                        • CreateDirectoryW.KERNEL32(00000003,00000001,00000001,?,008A416C,00000001,00000000,?,008A4203,00000003,00000001,00000001,00000000,00000000,00000000), ref: 00864097
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,008A416C,00000001,00000000,?,008A4203,00000003,00000001,00000001,00000000,00000000,00000000,?,0087A55D,?,00000000), ref: 008640A1
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CreateDirectoryErrorLast
                                                                                                                                                                                                                        • String ID: dirutil.cpp
                                                                                                                                                                                                                        • API String ID: 1375471231-2193988115
                                                                                                                                                                                                                        • Opcode ID: 49c429d23c0a698e5f7672c5f38719dc5ae79adc4535031218a7acd6424cf578
                                                                                                                                                                                                                        • Instruction ID: fb6d55711032f08fb350ecae07c13d61c8e441842aea1c8538a3c7f1b7388d53
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 49c429d23c0a698e5f7672c5f38719dc5ae79adc4535031218a7acd6424cf578
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3A115936600B36E6EB711AA54C54B3FB694FF45BA0F135125FF06EB050EB258C0192E3
                                                                                                                                                                                                                        Function 0087444C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 008638D4: GetProcessHeap.KERNEL32(?,?,?,00862284,?,00000001,75C0B390,8000FFFF,?,?,008A015F,?,?,00000000,00000000,8000FFFF), ref: 008638E5
                                                                                                                                                                                                                          • Part of subcall function 008638D4: RtlAllocateHeap.NTDLL(00000000,?,00862284,?,00000001,75C0B390,8000FFFF,?,?,008A015F,?,?,00000000,00000000,8000FFFF), ref: 008638EC
                                                                                                                                                                                                                        • _memcpy_s.LIBCMT ref: 0087449E
                                                                                                                                                                                                                        • _memcpy_s.LIBCMT ref: 008744B1
                                                                                                                                                                                                                        • _memcpy_s.LIBCMT ref: 008744CC
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to allocate memory for message., xrefs: 00874487
                                                                                                                                                                                                                        • pipe.cpp, xrefs: 0087447D
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: _memcpy_s$Heap$AllocateProcess
                                                                                                                                                                                                                        • String ID: Failed to allocate memory for message.$pipe.cpp
                                                                                                                                                                                                                        • API String ID: 886498622-1914209504
                                                                                                                                                                                                                        • Opcode ID: a4284ec434eb9376441e7e39293ad1f88f2029d89283ecb620922cbff7b5a8d4
                                                                                                                                                                                                                        • Instruction ID: 0716dc940d8e7db6931dc20f0bfc5cc591d5cdbf9dc2080d74c2b1ad798856c1
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: a4284ec434eb9376441e7e39293ad1f88f2029d89283ecb620922cbff7b5a8d4
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5F1160B2501309ABDB01EE54CC86DDBB3ACFF15700F00442AFA15D7241EB70EA108BE5
                                                                                                                                                                                                                        Function 0088114F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SetFilePointerEx.KERNELBASE(?,?,?,00000000,00000000,?,?,?,00000000,?,0088077D,?,?,?), ref: 00881177
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,0088077D,?,?,?), ref: 00881181
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to move to virtual file pointer., xrefs: 008811AF
                                                                                                                                                                                                                        • cabextract.cpp, xrefs: 008811A5
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorFileLastPointer
                                                                                                                                                                                                                        • String ID: Failed to move to virtual file pointer.$cabextract.cpp
                                                                                                                                                                                                                        • API String ID: 2976181284-3005670968
                                                                                                                                                                                                                        • Opcode ID: 361da6314eb505a143f15fb2cbabd10e4a99c14fcea1aa981e19c0d1b456b7e7
                                                                                                                                                                                                                        • Instruction ID: 596ced81d5d4e6cc5cd97680ea588be078157c0d1e476bec815a24da056c32eb
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 361da6314eb505a143f15fb2cbabd10e4a99c14fcea1aa981e19c0d1b456b7e7
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B501D636600635BBEB116A6A9C0CEC7BF99FF417B0B018126FD18D6A50EB359C21CBD5
                                                                                                                                                                                                                        Function 0087F086 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33threadwindowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PostThreadMessageW.USER32(?,00009001,00000000,?), ref: 0087F09B
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 0087F0A5
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • EngineForApplication.cpp, xrefs: 0087F0C9
                                                                                                                                                                                                                        • Failed to post plan message., xrefs: 0087F0D3
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLastMessagePostThread
                                                                                                                                                                                                                        • String ID: EngineForApplication.cpp$Failed to post plan message.
                                                                                                                                                                                                                        • API String ID: 2609174426-2952114608
                                                                                                                                                                                                                        • Opcode ID: bf8d10dc4aad996a26f21cd8e0baf220b36016dd3a53c6ff5602ca25c3491716
                                                                                                                                                                                                                        • Instruction ID: c61d9213f03abf2f5d8aa9b6a696a785699db14320e9319c80f74c6bf05cbd8c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: bf8d10dc4aad996a26f21cd8e0baf220b36016dd3a53c6ff5602ca25c3491716
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 10F037327447306AE721666A5C05E877FC4FF05BA0F014025FD1CE6692D6558C1085E5
                                                                                                                                                                                                                        Function 0087F194 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33threadwindowCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • PostThreadMessageW.USER32(?,00009005,?,00000000), ref: 0087F1A9
                                                                                                                                                                                                                        • GetLastError.KERNEL32 ref: 0087F1B3
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • EngineForApplication.cpp, xrefs: 0087F1D7
                                                                                                                                                                                                                        • Failed to post shutdown message., xrefs: 0087F1E1
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorLastMessagePostThread
                                                                                                                                                                                                                        • String ID: EngineForApplication.cpp$Failed to post shutdown message.
                                                                                                                                                                                                                        • API String ID: 2609174426-188808143
                                                                                                                                                                                                                        • Opcode ID: f697b199a11422b674951f83636227810bede77d6d3cfb37057f34fb4995fd76
                                                                                                                                                                                                                        • Instruction ID: b0691fa859a64742a42f0b5acc06ac4ec81f5feb272782c608acbec71ddfc9ff
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f697b199a11422b674951f83636227810bede77d6d3cfb37057f34fb4995fd76
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: D2F037327413346AF7216AAA9C09E877AC4FF05B61F024025FE18E6691EA558D108AE5
                                                                                                                                                                                                                        Function 0088051A Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 33COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SetEvent.KERNEL32(?,00000000,?,0088145A,00000000,00000000,?,0086C121,00000000,?,?,0088AB88,?,00000000,?,?), ref: 00880524
                                                                                                                                                                                                                        • GetLastError.KERNEL32(?,0088145A,00000000,00000000,?,0086C121,00000000,?,?,0088AB88,?,00000000,?,?,?,00000000), ref: 0088052E
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to set begin operation event., xrefs: 0088055C
                                                                                                                                                                                                                        • cabextract.cpp, xrefs: 00880552
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorEventLast
                                                                                                                                                                                                                        • String ID: Failed to set begin operation event.$cabextract.cpp
                                                                                                                                                                                                                        • API String ID: 3848097054-4159625223
                                                                                                                                                                                                                        • Opcode ID: 58caf4149b7d7f313bbfc00a36989fa8e80951555ca4344054289008afe02a98
                                                                                                                                                                                                                        • Instruction ID: 4934326f68c933d495da0f90853e65c73130599f8f7049859cdf742bf8337a87
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 58caf4149b7d7f313bbfc00a36989fa8e80951555ca4344054289008afe02a98
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C9F0A733A0073066A71076A96C05AD776D8FF09760B010136FD05F7651EA149D004AEA
                                                                                                                                                                                                                        Function 008755BD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • CoInitializeEx.OLE32(00000000,00000000), ref: 008755D9
                                                                                                                                                                                                                        • CoUninitialize.OLE32(?,00000000,?,?,?,?,?,?,?), ref: 00875633
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        • Failed to initialize COM on cache thread., xrefs: 008755E5
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: InitializeUninitialize
                                                                                                                                                                                                                        • String ID: Failed to initialize COM on cache thread.
                                                                                                                                                                                                                        • API String ID: 3442037557-3629645316
                                                                                                                                                                                                                        • Opcode ID: f7d75ce935558228c5d6c3f30fc118931c606adb1c5976d6c6c2c0ae7c560a8d
                                                                                                                                                                                                                        • Instruction ID: 9ae425e71996a57b0cd1f4a1f95412eacaf91043b6e48ae22576ed492e771bd0
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: f7d75ce935558228c5d6c3f30fc118931c606adb1c5976d6c6c2c0ae7c560a8d
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1C016D72600619BFDB059FA9DC84DD6FBACFF08354B408126FA09C7221DB71ED548B90
                                                                                                                                                                                                                        Function 0086501B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46stringCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(burn.clean.room,?,?,?,?,00861104,?,?,00000000), ref: 0086503A
                                                                                                                                                                                                                        • CompareStringW.KERNELBASE(0000007F,00000001,?,0000000F,burn.clean.room,0000000F,?,?,?,?,00861104,?,?,00000000), ref: 0086506A
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CompareStringlstrlen
                                                                                                                                                                                                                        • String ID: burn.clean.room
                                                                                                                                                                                                                        • API String ID: 1433953587-3055529264
                                                                                                                                                                                                                        • Opcode ID: 09fea26dd2f1d5d6ca3985292d399530388a102884d41affccefe529ad12743c
                                                                                                                                                                                                                        • Instruction ID: ae5f500c7a158c38baf44f6181392ac46291042db295efe87c14cbc869cc8462
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 09fea26dd2f1d5d6ca3985292d399530388a102884d41affccefe529ad12743c
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5D018673500A39AE97244B599C84D73BBBCFB15B64B114126F545C7610D371DC40C7E2
                                                                                                                                                                                                                        Function 0086F5E0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 008A0E3F: RegOpenKeyExW.KERNELBASE(?,00000000,00000000,00000000,00000001,00000000,?,008A5699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,?,00000000,00000000), ref: 008A0E52
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,?,?,00000001,00000000,00000000,?,?,?,00877B4D,?,?,?), ref: 0086F644
                                                                                                                                                                                                                          • Part of subcall function 008A0EEC: RegQueryValueExW.ADVAPI32(00000004,?,00000000,00000000,?,00000078,00000000,?,?,?,008A56EF,00000000,?,008A63FF,00000078,00000000), ref: 008A0F10
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseOpenQueryValue
                                                                                                                                                                                                                        • String ID: Installed
                                                                                                                                                                                                                        • API String ID: 3677997916-3662710971
                                                                                                                                                                                                                        • Opcode ID: b78e8e31233008dc601cc3824527fb6cca034a4dc79641fb29e24bbda9a04c25
                                                                                                                                                                                                                        • Instruction ID: ffc131ddbec430effe9226a31085b21a0bb0b02c20e0c31294f83de9c202bd15
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: b78e8e31233008dc601cc3824527fb6cca034a4dc79641fb29e24bbda9a04c25
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 5A018F32810118FBDB11DB98D846BDEBBA8FF04311F1241A4F900E7161D3759E50DB90
                                                                                                                                                                                                                        Function 008A9006 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(00000000,000000B0,00000088,00000410,000002C0), ref: 008A905C
                                                                                                                                                                                                                          • Part of subcall function 008A0E3F: RegOpenKeyExW.KERNELBASE(?,00000000,00000000,00000000,00000001,00000000,?,008A5699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,?,00000000,00000000), ref: 008A0E52
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseOpen
                                                                                                                                                                                                                        • String ID: %ls%ls\%ls\%ls
                                                                                                                                                                                                                        • API String ID: 47109696-1267659288
                                                                                                                                                                                                                        • Opcode ID: 66085fe73253b19939e7d57fa46edaf30359afe144933d6673573e6536860f5f
                                                                                                                                                                                                                        • Instruction ID: 94c338d50d1d9cae3e625988ad32e38614438085ba333811b583536af6e7e719
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 66085fe73253b19939e7d57fa46edaf30359afe144933d6673573e6536860f5f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: DD014F3280021CFBEF129B94DC0AFEDBB79FB05355F004094F900A6161D7765B60EB91
                                                                                                                                                                                                                        Function 0089F349 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 0089F35B
                                                                                                                                                                                                                          • Part of subcall function 008A9814: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008A9829
                                                                                                                                                                                                                          • Part of subcall function 008A9814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008A9891
                                                                                                                                                                                                                          • Part of subcall function 008A9814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008A98A2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
                                                                                                                                                                                                                        • String ID: PA:n
                                                                                                                                                                                                                        • API String ID: 697777088-347252079
                                                                                                                                                                                                                        • Opcode ID: 24ff5300a85f44bcffbecb8df8f5c7bec16cc0aa2355691200900a1996692ef6
                                                                                                                                                                                                                        • Instruction ID: ac82f8d8610ad35ab5f4691c7c6d5b6b01d64cad8d9db565bf53e347900be19e
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 24ff5300a85f44bcffbecb8df8f5c7bec16cc0aa2355691200900a1996692ef6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 1DB092922A8805AC320822586802D360228E2C2F28738C03EB650C0141A8A889081032
                                                                                                                                                                                                                        Function 0089F36A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 0089F35B
                                                                                                                                                                                                                          • Part of subcall function 008A9814: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008A9829
                                                                                                                                                                                                                          • Part of subcall function 008A9814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008A9891
                                                                                                                                                                                                                          • Part of subcall function 008A9814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008A98A2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
                                                                                                                                                                                                                        • String ID: PA:n
                                                                                                                                                                                                                        • API String ID: 697777088-347252079
                                                                                                                                                                                                                        • Opcode ID: d5d55353068ecb5f41e4a3504723dcce1bd10b63851595218aabe8e9e39fc63f
                                                                                                                                                                                                                        • Instruction ID: 6da2038e6bdd7cb42ba54136eb51640811c3ed48584c6a1895177e4593c9d1cd
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d5d55353068ecb5f41e4a3504723dcce1bd10b63851595218aabe8e9e39fc63f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: C0B092912A8805AD324862581903E360168E2C2F28738803EB254C1241E8A888091032
                                                                                                                                                                                                                        Function 0089F37A Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 0089F35B
                                                                                                                                                                                                                          • Part of subcall function 008A9814: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008A9829
                                                                                                                                                                                                                          • Part of subcall function 008A9814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008A9891
                                                                                                                                                                                                                          • Part of subcall function 008A9814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008A98A2
                                                                                                                                                                                                                        Strings
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
                                                                                                                                                                                                                        • String ID: PA:n
                                                                                                                                                                                                                        • API String ID: 697777088-347252079
                                                                                                                                                                                                                        • Opcode ID: 3648bbbe3de00be1bb57a4831d82ec76178776f9418b5310c446b9f40057cac6
                                                                                                                                                                                                                        • Instruction ID: d70a4ce5afe9460f8664d0ec2e5f51b4cdc58186b82dd11dc3fbb4b3481536fc
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 3648bbbe3de00be1bb57a4831d82ec76178776f9418b5310c446b9f40057cac6
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: F7B092912A8905AC324862581806E360168E2C2F28738C13EF254C1241E8B888481032
                                                                                                                                                                                                                        Function 008A3499 Relevance: 1.6, APIs: 1, Instructions: 101COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • VariantInit.OLEAUT32(?), ref: 008A34CE
                                                                                                                                                                                                                          • Part of subcall function 008A2F23: GetModuleHandleA.KERNEL32(kernel32.dll,00000000,00000000,008A34DF,00000000,?,00000000), ref: 008A2F3D
                                                                                                                                                                                                                          • Part of subcall function 008A2F23: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,0088BDED,?,008652FD,?,00000000,?), ref: 008A2F49
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: ErrorHandleInitLastModuleVariant
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 52713655-0
                                                                                                                                                                                                                        • Opcode ID: 9c530a11554848a376e303dc0ef52114039b88265775003de6909792cbf54f1f
                                                                                                                                                                                                                        • Instruction ID: df38895df136c5c50967630d7e47fc1e0b2b88104a691d29c4afc2998adffa4c
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9c530a11554848a376e303dc0ef52114039b88265775003de6909792cbf54f1f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 2C31FB76E006199BDB11DFA8C884ADEB7F8FF09750F01456AFD15EB311E6719D048BA0
                                                                                                                                                                                                                        Function 008A907D Relevance: 1.6, APIs: 1, Instructions: 81registryCOMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                          • Part of subcall function 008A8CFB: lstrlenW.KERNEL32(00000100,?,?,008A9098,000002C0,00000100,00000100,00000100,?,?,?,00887B40,?,?,000001BC,00000000), ref: 008A8D1B
                                                                                                                                                                                                                        • RegCloseKey.ADVAPI32(000002C0,000002C0,00000100,00000100,00000100,?,?,?,00887B40,?,?,000001BC,00000000,00000000,00000000,00000100), ref: 008A9136
                                                                                                                                                                                                                          • Part of subcall function 008A0E3F: RegOpenKeyExW.KERNELBASE(?,00000000,00000000,00000000,00000001,00000000,?,008A5699,80000002,00000000,00020019,00000000,SOFTWARE\Policies\,?,00000000,00000000), ref: 008A0E52
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: CloseOpenlstrlen
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 514153755-0
                                                                                                                                                                                                                        • Opcode ID: 9ad5a4a4fcb7559960424717e5203a25a9190ae992aca0e11493386d3e4f5625
                                                                                                                                                                                                                        • Instruction ID: 78263c13294b004f6e5c1d317beb252d072e146aa764e1107e22a14ebac4caed
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 9ad5a4a4fcb7559960424717e5203a25a9190ae992aca0e11493386d3e4f5625
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: E821B472C0062AEBDF21AE68C84589EBAB5FB45750B110665FD41E3521E2328E50ABD1
                                                                                                                                                                                                                        Function 008634C5 Relevance: 1.5, APIs: 1, Instructions: 23COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • SHGetFolderPathW.SHELL32(00000000,?,00000000,00000000,00000000,00000000,00000104,00000000,?,008789CA,0000001C,?,00000000,?,?), ref: 008634E5
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: FolderPath
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 1514166925-0
                                                                                                                                                                                                                        • Opcode ID: 02aa0849bcd738bc55613b4d8dd6b4bf6be64d6898a7cb16933c5f72dc35dcc2
                                                                                                                                                                                                                        • Instruction ID: 363171865ec1d73b017aa17c2ada8fb8bbf4c93bc9899dfc3377c0ee6fd2fb17
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 02aa0849bcd738bc55613b4d8dd6b4bf6be64d6898a7cb16933c5f72dc35dcc2
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A6E012722016257BAA022E765C0ADEBBB9CFF157607058055BE40D6101EA61E91096B5
                                                                                                                                                                                                                        Function 008640E2 Relevance: 1.5, APIs: 1, Instructions: 20COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • GetFileAttributesW.KERNELBASE(?,00000000,?,0087A229,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,?), ref: 008640EB
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AttributesFile
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3188754299-0
                                                                                                                                                                                                                        • Opcode ID: aa7e741465a959bcd7ded97f54433172cdbeeb2354e6abb31ba02fcf9a87275b
                                                                                                                                                                                                                        • Instruction ID: bd7ada7b31361ccdd6c9f365a7ce10a8f982a421c8c30e5801e7adc3649417e6
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: aa7e741465a959bcd7ded97f54433172cdbeeb2354e6abb31ba02fcf9a87275b
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 7AD02B312011281747188E698C0456E7B15FF13BB0B025214EC14CB1A1C7308C92C3C0
                                                                                                                                                                                                                        Function 008A94D5 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 008A94E7
                                                                                                                                                                                                                          • Part of subcall function 008A9814: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008A9829
                                                                                                                                                                                                                          • Part of subcall function 008A9814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008A9891
                                                                                                                                                                                                                          • Part of subcall function 008A9814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008A98A2
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 697777088-0
                                                                                                                                                                                                                        • Opcode ID: d2fbf9a9b74ed69fc5d88837076b29048b65f3861a654a9c19b12140c46dc74e
                                                                                                                                                                                                                        • Instruction ID: 39ca7824d58629ff3cd7600a42540553e7ab7be5097f54d967f629dbc187c4b9
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: d2fbf9a9b74ed69fc5d88837076b29048b65f3861a654a9c19b12140c46dc74e
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 3DB012C52BD909BC3248225C1C43E37012CF5C2F14730C17EF250D1880B8748C0D0133
                                                                                                                                                                                                                        Function 008A94F6 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 008A94E7
                                                                                                                                                                                                                          • Part of subcall function 008A9814: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008A9829
                                                                                                                                                                                                                          • Part of subcall function 008A9814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008A9891
                                                                                                                                                                                                                          • Part of subcall function 008A9814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008A98A2
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 697777088-0
                                                                                                                                                                                                                        • Opcode ID: 54076fc8c0b0cc52428793574fc04ed99e5f016cbc371ab995e56aac3ce0f28f
                                                                                                                                                                                                                        • Instruction ID: 17fd5be484e58bc497e74b177146c416b72c34320ccab1e4b09518c6d803cd05
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 54076fc8c0b0cc52428793574fc04ed99e5f016cbc371ab995e56aac3ce0f28f
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: 24B092852AD806AC324862581803E36012CF186F14330C26EF650C2580A8648C0D0133
                                                                                                                                                                                                                        Function 008A9506 Relevance: 1.5, APIs: 1, Instructions: 10COMMON
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • ___delayLoadHelper2@8.DELAYIMP ref: 008A94E7
                                                                                                                                                                                                                          • Part of subcall function 008A9814: DloadAcquireSectionWriteAccess.DELAYIMP ref: 008A9829
                                                                                                                                                                                                                          • Part of subcall function 008A9814: DloadReleaseSectionWriteAccess.DELAYIMP ref: 008A9891
                                                                                                                                                                                                                          • Part of subcall function 008A9814: RaiseException.KERNEL32(C06D0057,00000000,00000001,?), ref: 008A98A2
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: AccessDloadSectionWrite$AcquireExceptionHelper2@8LoadRaiseRelease___delay
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 697777088-0
                                                                                                                                                                                                                        • Opcode ID: 7a572fa3273bf3209137574ca20b53d14f681f7bd13860671bf01b1f9f181949
                                                                                                                                                                                                                        • Instruction ID: fffcf30759f63dcf74e16c53956061229e214a761109536c5e6cd6ac1c0f0631
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: 7a572fa3273bf3209137574ca20b53d14f681f7bd13860671bf01b1f9f181949
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: B7B012852BDA05AC3288629C2E03F37012CF5C6F14730817EF250C2580F8788C0E0133
                                                                                                                                                                                                                        Function 008614B2 Relevance: 1.3, APIs: 1, Instructions: 54stringCOMMONLIBRARYCODE
                                                                                                                                                                                                                        Download Yara Rule
                                                                                                                                                                                                                        APIs
                                                                                                                                                                                                                        • lstrlenW.KERNEL32(00000000,00000000,00000000,?,?,008621B8,?,00000000,00000000,00000000,?,00878A22,00000000,00000000,00000000,00000000), ref: 008614E4
                                                                                                                                                                                                                          • Part of subcall function 00863B51: GetProcessHeap.KERNEL32(00000000,?,?,008621DC,?,75C0B390,8000FFFF,?,?,008A015F,?,?,00000000,00000000,8000FFFF), ref: 00863B59
                                                                                                                                                                                                                          • Part of subcall function 00863B51: HeapSize.KERNEL32(00000000,?,008621DC,?,75C0B390,8000FFFF,?,?,008A015F,?,?,00000000,00000000,8000FFFF), ref: 00863B60
                                                                                                                                                                                                                        Memory Dump Source
                                                                                                                                                                                                                        • Source File: 00000002.00000002.1924918056.0000000000861000.00000020.00000001.01000000.00000007.sdmp, Offset: 00860000, based on PE: true
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1924849258.0000000000860000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925069276.00000000008AB000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925155010.00000000008CA000.00000004.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        • Associated: 00000002.00000002.1925203420.00000000008CE000.00000002.00000001.01000000.00000007.sdmpDownload File
                                                                                                                                                                                                                        Joe Sandbox IDA Plugin
                                                                                                                                                                                                                        • Snapshot File: hcaresult_2_2_860000_vc_redist.jbxd
                                                                                                                                                                                                                        Similarity
                                                                                                                                                                                                                        • API ID: Heap$ProcessSizelstrlen
                                                                                                                                                                                                                        • String ID:
                                                                                                                                                                                                                        • API String ID: 3492610842-0
                                                                                                                                                                                                                        • Opcode ID: ef449cab5d45ea0d1a2025714a60be0342bd1264f5f7843cc2d3ba500fa43cf0
                                                                                                                                                                                                                        • Instruction ID: 5e821cb16522d01011ef9d9dbec085664cd67cc87b804f19ebdfbd37ae7f18c3
                                                                                                                                                                                                                        • Opcode Fuzzy Hash: ef449cab5d45ea0d1a2025714a60be0342bd1264f5f7843cc2d3ba500fa43cf0
                                                                                                                                                                                                                        • Instruction Fuzzy Hash: A5014537200228AFCF215E65CC4DE9ABB96FF41760F2A4224FA26DB062DB319C0086D4