Edit tour

Windows Analysis Report
Setup.exe

Overview

General Information

Sample name:	Setup.exe
Analysis ID:	1532549
MD5:	08aba4235f18775205a1705d89676705
SHA1:	d25fc234125ed0cb49608309a842043b7acc2e86
SHA256:	f8c59bf2647bc5ad0b69428864ac9b02cf4695a20130a6b171701285195c3c9f
Infos:

Detection

Score:	7
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (date check)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

Setup.exe (PID: 7508 cmdline: "C:\Users\user\Desktop\Setup.exe" MD5: 08ABA4235F18775205A1705D89676705)

cleanup

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: Setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\PatchInstaller.Log

Jump to behavior

Source: Setup.exe

Static PE information: certificate valid

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: E:\AzAgent\_work\13\s\Install\Fuse2\SupportFiles\Setup\Aventa_Release\Setup.pdb source: Setup.exe

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E12D30 GetModuleFileNameW,GetLongPathNameW,GetFileAttributesW,wsprintfW,wsprintfW,wsprintfW,GetFileAttributesW,wsprintfW,wsprintfW,FindFirstFileW,FindClose,SHGetFolderPathW,SHGetFolderPathW,GetLastError,FormatMessageW,wsprintfW,wsprintfW,SHGetFolderPathW,SHGetFolderPathW,GetLastError,FormatMessageW,	0_2_00E12D30
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E1A560 wsprintfW,FindFirstFileW,FindClose,wsprintfW,Sleep,GetFileAttributesW,SetFileAttributesW,SetFileAttributesW,SetFileAttributesW,CopyFileW,wsprintfW,GetLastError,FormatMessageW,	0_2_00E1A560
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E15DD0 wsprintfW,wsprintfW,wsprintfW,wsprintfW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,SetFileAttributesW,SetFileAttributesW,CopyFileW,wsprintfW,GetFileAttributesW,SetFileAttributesW,SetFileAttributesW,GetLastError,FormatMessageW,FindClose,	0_2_00E15DD0

Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Setup.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: Setup.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Setup.exe	String found in binary or memory: http://www.digicert.com/CPS0

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00E121A0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,

0_2_00E121A0

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E150F0	0_2_00E150F0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E2A259	0_2_00E2A259
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E264EF	0_2_00E264EF
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E3A699	0_2_00E3A699
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E2A671	0_2_00E2A671
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E3884F	0_2_00E3884F
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E2D9F8	0_2_00E2D9F8
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E2AAA6	0_2_00E2AAA6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E29CB0	0_2_00E29CB0
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E2DC27	0_2_00E2DC27
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E29D5D	0_2_00E29D5D
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E2AEDB	0_2_00E2AEDB
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E31F40	0_2_00E31F40

Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 00E15020 appears 103 times
Source: C:\Users\user\Desktop\Setup.exe	Code function: String function: 00E27620 appears 48 times

Source: Setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: clean7.winEXE@1/1@0/0

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00E12D30 GetModuleFileNameW,GetLongPathNameW,GetFileAttributesW,wsprintfW,wsprintfW,wsprintfW,GetFileAttributesW,wsprintfW,wsprintfW,FindFirstFileW,FindClose,SHGetFolderPathW,SHGetFolderPathW,GetLastError,FormatMessageW,wsprintfW,wsprintfW,SHGetFolderPathW,SHGetFolderPathW,GetLastError,FormatMessageW,

0_2_00E12D30

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00E121A0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,ExitWindowsEx,

0_2_00E121A0

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00E114B0 CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,Process32NextW,CloseHandle,

0_2_00E114B0

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00E1A9B0 VariantClear,SysAllocString,CoCreateInstance,MessageBoxW,VariantClear,

0_2_00E1A9B0

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00E23070 LoadResource,LockResource,SizeofResource,

0_2_00E23070

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\PatchInstaller.Log

Jump to behavior

Source: Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Setup.exe	String found in binary or memory: /install /passive /norestart
Source: Setup.exe	String found in binary or memory: appSettings/add[@key='DevOpsEventId']
Source: Setup.exe	String found in binary or memory: /install /quiet /norestart
Source: Setup.exe	String found in binary or memory: appSettings/add[@key='DevOpsUpdatedProductVersion']
Source: Setup.exe	String found in binary or memory: appSettings/add[@key='Market']
Source: Setup.exe	String found in binary or memory: appSettings/add[@key='AllowRemoteServices']
Source: Setup.exe	String found in binary or memory: SeShutdownPrivilegePatchInstaller.LogC:\PatchInstaller.logSetupCould not create log file.FilesPatchesm_szSrcDir: %sm_szPatchDir: %sMarkets\Markets.xmlInformation : Patch Folder ExistsXml Used as %s*.mspInformation : No patch ExistsInvoking Full Install..._isstub.exe COUNTRY /v"COUNTRY=%s"STANDALONEVA /v"STANDALONE=Yes" /v"REBOOT=Force"WEB /v"MEDIATYPE=%s" /v"/qr"01 /v"ALLOWREMOTESERVICES=%s" /v"UNCHECKREMOTESERVICES=%s" -LInstallShield exe Launch call succeeded.InstallShield exe Launch call failed.InstallShield Invoke ExitCode: %luUser cancelled operation.Not all GNWeb params have a value to invoke GNWeb. Check log.SOFTWARE\ReSound\Aventa3MarketBrand registry key not found or could not open: 'HKLM\%s'. dwRes=%luVersionMajorVersionMinorVersionVersionStringVerMajor=%s, VerMinor=%s, Version=%s, VersionString=%sCaching config values...ReSound.Fuse2.Config.dll.configConfig file: '%s'appSettings/add[@key='DevOpsEventId']valuevalue attribute missing for DevOps EventIDappSettings/add[@key='Market']value attribute missing for MarketappSettings/add[@key='DevOpsUpdatedProductVersion']value attribute missing for DevOps Product VersionappSettings/add[@key='AllowRemoteServices']value attribute missing for AllowRemoteServicesFailed to get xml document element...Failed to load config file...EventId: '%s' Market: '%s' ApiProductVersion: '%s' AllowRemoteServices: '%s'Invoking GNWeb...%luError: Exception while setting DevOpsErrorMessage

Source: C:\Users\user\Desktop\Setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Setup.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5078F32-C551-11D3-89B9-0000F81FE221}\InProcServer32

Jump to behavior

Source: Setup.exe

Static PE information: certificate valid

Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Setup.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Setup.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:

Binary string: E:\AzAgent\_work\13\s\Install\Fuse2\SupportFiles\Setup\Aventa_Release\Setup.pdb source: Setup.exe

Source: Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Setup.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E27169 push ecx; ret	0_2_00E2717C
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E27666 push ecx; ret	0_2_00E27679
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E3F8CF push dword ptr [esp+ecx-75h]; iretd	0_2_00E3F8D3

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00E1CA80 GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,

0_2_00E1CA80

Source: C:\Users\user\Desktop\Setup.exe

File created: C:\Users\user\AppData\Local\Temp\PatchInstaller.Log

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00E264EF GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00E264EF

Source: C:\Users\user\Desktop\Setup.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\Desktop\Setup.exe

Evasive API call chain: GetLocalTime,DecisionNodes

graph_0-23562

Source: C:\Users\user\Desktop\Setup.exe

API coverage: 7.6 %

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E12D30 GetModuleFileNameW,GetLongPathNameW,GetFileAttributesW,wsprintfW,wsprintfW,wsprintfW,GetFileAttributesW,wsprintfW,wsprintfW,FindFirstFileW,FindClose,SHGetFolderPathW,SHGetFolderPathW,GetLastError,FormatMessageW,wsprintfW,wsprintfW,SHGetFolderPathW,SHGetFolderPathW,GetLastError,FormatMessageW,	0_2_00E12D30
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E1A560 wsprintfW,FindFirstFileW,FindClose,wsprintfW,Sleep,GetFileAttributesW,SetFileAttributesW,SetFileAttributesW,SetFileAttributesW,CopyFileW,wsprintfW,GetLastError,FormatMessageW,	0_2_00E1A560
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E15DD0 wsprintfW,wsprintfW,wsprintfW,wsprintfW,FindFirstFileW,GetFileAttributesW,SetFileAttributesW,SetFileAttributesW,SetFileAttributesW,CopyFileW,wsprintfW,GetFileAttributesW,SetFileAttributesW,SetFileAttributesW,GetLastError,FormatMessageW,FindClose,	0_2_00E15DD0

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00E273D6 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_00E273D6

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00E1D1A0 CreateMutexW,GetLastError,#113,#113,OutputDebugStringW,OutputDebugStringW,MsgWaitForMultipleObjects,MsgWaitForMultipleObjects,PeekMessageW,PeekMessageW,MsgWaitForMultipleObjects,CloseHandle,OutputDebugStringW,OutputDebugStringW,#113,

0_2_00E1D1A0

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00E331F9 mov eax, dword ptr fs:[00000030h]

0_2_00E331F9

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00E3A256 GetProcessHeap,

0_2_00E3A256

Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E273D6 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00E273D6
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E27568 SetUnhandledExceptionFilter,	0_2_00E27568
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E2767B SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00E2767B
Source: C:\Users\user\Desktop\Setup.exe	Code function: 0_2_00E2BEA1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00E2BEA1

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00E278E7 cpuid

0_2_00E278E7

Source: C:\Users\user\Desktop\Setup.exe	Code function: GetLocaleInfoW,	0_2_00E380C7
Source: C:\Users\user\Desktop\Setup.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	0_2_00E3E1B7
Source: C:\Users\user\Desktop\Setup.exe	Code function: EnumSystemLocalesW,	0_2_00E3E47A
Source: C:\Users\user\Desktop\Setup.exe	Code function: EnumSystemLocalesW,	0_2_00E3E42F
Source: C:\Users\user\Desktop\Setup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_00E3E5A2
Source: C:\Users\user\Desktop\Setup.exe	Code function: EnumSystemLocalesW,	0_2_00E3E515
Source: C:\Users\user\Desktop\Setup.exe	Code function: GetLocaleInfoW,	0_2_00E3E7F2
Source: C:\Users\user\Desktop\Setup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_00E3E91B
Source: C:\Users\user\Desktop\Setup.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_00E3EAEF
Source: C:\Users\user\Desktop\Setup.exe	Code function: GetLocaleInfoW,	0_2_00E3EA22
Source: C:\Users\user\Desktop\Setup.exe	Code function: EnumSystemLocalesW,	0_2_00E37CD4

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00E15020 wsprintfW,GetLocalTime,

0_2_00E15020

Source: C:\Users\user\Desktop\Setup.exe

Code function: 0_2_00E11070 GetCurrentThread,OpenThreadToken,GetCurrentProcess,OpenProcessToken,GetVersionExW,GetTokenInformation,GetTokenInformation,GetTokenInformation,DuplicateToken,CreateWellKnownSid,CheckTokenMembership,GetLastError,CloseHandle,CloseHandle,CloseHandle,

0_2_00E11070

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Access Token Manipulation	1 Access Token Manipulation	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	3 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	2 Obfuscated Files or Information	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	1 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	23 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Setup.exe	0%	Virustotal		Browse

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532549
Start date and time:	2024-10-13 16:58:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Setup.exe
Detection:	CLEAN
Classification:	clean7.winEXE@1/1@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 20 Number of non-executed functions: 126
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Process:	C:\Users\user\Desktop\Setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	261
Entropy (8bit):	4.872585858230478
Encrypted:	false
SSDEEP:	6:MKUlC6ME1wvovLMC4EXfewvOqC4KMKZblOCqUGwvoBMmJ1tCk8b:MP867mwvL14EXfZ2PDZNtwT1kk8b
MD5:	DDCED15736A29A1599C11AEC1F345114
SHA1:	21DF854FDD78301A6C3DD9CC71F4944EE3429AA7
SHA-256:	786FB978A9768D7ACCB591EFFF0D13AD4397ABB7DAF55C1CB1F944D2F51A779A
SHA-512:	5A694F16CF6DCE0678BCD443F06DA5485FA521A01F6FAE9CFB0689EC8D32FE4B5452DBC7DBE2051C8A7388D147853CAFD85B9A9BB1CF545ED2BC9F06782BB398
Malicious:	false
Reputation:	low
Preview:	10/13 10:59:1 m_szSrcDir: C:\Users\user\Desktop\..10/13 10:59:1 m_szPatchDir: C:\Users\user\Desktop\Patches..10/13 10:59:1 Information : No patch Exists..10/13 10:59:1 Xml Used as C:\Users\user\Desktop\Markets\Markets.xml..10/13 10:59:1 C:\ProgramData..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.4358614247609465
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Setup.exe
File size:	391'376 bytes
MD5:	08aba4235f18775205a1705d89676705
SHA1:	d25fc234125ed0cb49608309a842043b7acc2e86
SHA256:	f8c59bf2647bc5ad0b69428864ac9b02cf4695a20130a6b171701285195c3c9f
SHA512:	005f8c085a1104fe3eaaf63880ca97b74b32dbb64d89aa08924ae74cb3c2f246ffa9c3272f3a14f63a57c72df76bf8da6c9504c9f35f06660beebc5fea0f0dd8
SSDEEP:	6144:i8kiSrhTFpBoiB6VTquOmQ7YpAOMJjwvDW70PFn0wccccccccYwP+Tr:GiYTF5B6Veum6WnrTr
TLSH:	48843901B7D58031F6B22B32A97946B5487DBC719F35C2DFA3A4686DAD306D0DA70B23
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i....q...q...q.3.....q.3.....q.3.....q..Vr...q..Vt...q..Vu...q.bQt...q.Z.....q...p.".q..Vx...q..V....q.......q..Vs...q.Rich..q

File Icon


Icon Hash:	55497933cc61714d

Static PE Info

General

Entrypoint:	0x416c38
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x66BA3562 [Mon Aug 12 16:16:34 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	1dbae0c3c95050b4a391eeaafa9311b1

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	21/01/2022 00:00:00 30/01/2025 23:59:59
Subject Chain	CN=GN Hearing A/S, O=GN Hearing A/S, L=Ballerup, C=DK
Version:	3
Thumbprint MD5:	5CD08805D25FB6438745FAF795BDCD74
Thumbprint SHA-1:	94100BECB61B9CE55DA61EBF558365F79304D63B
Thumbprint SHA-256:	C9CF516456D66888F13B6B7E530BBC0E5F3D4FC4F1F2F989FEBB25D263C83E6F
Serial:	046D1D272BD29C149AA5FC5DE3445D21

Entrypoint Preview

Instruction
call 00007FBCCCDE0220h
jmp 00007FBCCCDDFA23h
jmp 00007FBCCCDE5211h
cmp ecx, dword ptr [0044D070h]
jne 00007FBCCCDDFB95h
ret
jmp 00007FBCCCDE05E1h
push ebp
mov ebp, esp
jmp 00007FBCCCDDFBB1h
push dword ptr [ebp+08h]
call 00007FBCCCDED563h
pop ecx
test eax, eax
jne 00007FBCCCDDFBA4h
cmp dword ptr [ebp+08h], FFFFFFFFh
jne 00007FBCCCDDFB99h
call 00007FBCCCDE07EAh
jmp 00007FBCCCDDFB97h
call 00007FBCCCDE07C6h
push dword ptr [ebp+08h]
call 00007FBCCCDEA92Fh
pop ecx
test eax, eax
je 00007FBCCCDDFB66h
pop ebp
ret
push ebp
mov ebp, esp
test byte ptr [ebp+08h], 00000001h
push esi
mov esi, ecx
mov dword ptr [esi], 0043955Ch
je 00007FBCCCDDFB9Ch
push 0000000Ch
push esi
call 00007FBCCCDDFB9Eh
pop ecx
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
push ebp
mov ebp, esp
push dword ptr [ebp+08h]
call 00007FBCCCDDFB1Eh
pop ecx
pop ebp
ret
push ebx
push esi
push edi
push 00000000h
push 00000FA0h
push 0044E238h
call 00007FBCCCDE4757h
add esp, 0Ch
push 0043710Ch
call dword ptr [0043611Ch]
mov esi, eax
test esi, esi
je 00007FBCCCDDFC22h
push 0043734Ch
push esi
call dword ptr [00436120h]
push 0043739Ch
push esi
mov ebx, eax
call dword ptr [00006120h]

Rich Headers

Programming Language:

[RES] VS2015 UPD3 build 24213
[LNK] VS2015 UPD3.1 build 24215

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4bcd0	0xb4	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x51000	0xd780	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x5d200	0x26d0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5f000	0x2f04	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x48dc0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x48e8c	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x48e30	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x36000	0x268	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3438d	0x34400	ce9b91c9a67d6809c20dc6da4403d236	False	0.5168632251794258	data	6.57276571453631	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x36000	0x16a28	0x16c00	17a2a2d3ae57ab6703e8be65818a1b85	False	0.40117402129120877	data	5.044403567227042	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x4d000	0x1ed4	0x1000	7ad70cb1b86d6b94f9a985aeb2828fa3	False	0.216796875	Matlab v4 mat-file (little endian) right (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED., text, rows 4294967295, columns 10	3.515306646918696	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.gfids	0x4f000	0x25c	0x400	ea9b19e5a77b700844a31d0535a500b6	False	0.3388671875	data	2.5771337581014975	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x50000	0x9	0x200	1f354d76203061bfdd5a53dae48d5435	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x51000	0xd780	0xd800	885861a6f551d1a22a28c97b41026bd7	False	0.29799623842592593	data	5.654578773646797	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5f000	0x2f04	0x3000	3401a59f241799dcc18270fc98e8353a	False	0.7254231770833334	data	6.587576910047788	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x51450	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 0	English	United States	0.21341463414634146
RT_ICON	0x51ab8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 0	English	United States	0.34139784946236557
RT_ICON	0x51da0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 0	English	United States	0.5202702702702703
RT_ICON	0x51ec8	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	English	United States	0.47334754797441364
RT_ICON	0x52d70	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	English	United States	0.6101083032490975
RT_ICON	0x53618	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	English	United States	0.596820809248555
RT_ICON	0x53b80	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.2932572614107884
RT_ICON	0x56128	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.4343339587242026
RT_ICON	0x571d0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.7198581560283688
RT_STRING	0x57990	0xc90	data	English	United States	0.2689676616915423
RT_STRING	0x58620	0xba0	data	English	United States	0.4307795698924731
RT_STRING	0x591c0	0x176	data	English	United States	0.6951871657754011
RT_STRING	0x59338	0xe26	data	English	United States	0.25317504141358366
RT_STRING	0x5a160	0xcc2	OpenPGP Public Key	English	United States	0.3312921004286589
RT_STRING	0x5ae28	0x1202	big endian ispell hash file (?), and 26880 string characters	English	United States	0.2872017353579176
RT_STRING	0x5c030	0x11f2	data	English	United States	0.2627340008707009
RT_STRING	0x5d228	0xf08	data	English	United States	0.28586278586278585
RT_GROUP_ICON	0x57638	0x84	data	English	United States	0.6363636363636364
RT_VERSION	0x576c0	0x2d0	data	English	United States	0.47638888888888886
RT_MANIFEST	0x5e130	0x64b	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1551), with CRLF line terminators	English	United States	0.3116076970825574

Imports

DLL	Import
msi.dll
KERNEL32.dll	OpenProcess, CreateMutexW, OutputDebugStringW, GetSystemDefaultLCID, GetExitCodeProcess, TerminateProcess, CreateFileW, CreateProcessW, VerSetConditionMask, VerifyVersionInfoW, HeapDestroy, HeapAlloc, HeapFree, HeapReAlloc, HeapSize, LocalFree, WideCharToMultiByte, FormatMessageW, GetProcessHeap, GetLocaleInfoW, GetFileAttributesW, GetTempPathW, CreateDirectoryW, GetModuleFileNameW, GetLongPathNameW, FindFirstFileW, FindClose, GetLocalTime, Process32NextW, CopyFileW, GetCommandLineW, GetPrivateProfileStringW, Sleep, DeleteFileW, LoadLibraryW, FreeLibrary, SizeofResource, LockResource, LoadResource, FindResourceW, FindResourceExW, InitializeCriticalSectionEx, RaiseException, DecodePointer, DeleteCriticalSection, IsDebuggerPresent, EnterCriticalSection, LeaveCriticalSection, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineA, GetOEMCP, IsValidCodePage, FindNextFileW, Process32FirstW, CreateToolhelp32Snapshot, GetModuleHandleW, GetProcAddress, GetVersionExW, GetCurrentProcess, GetCurrentThread, CloseHandle, GetLastError, SetStdHandle, WriteConsoleW, ReadConsoleW, SetEndOfFile, SetFileAttributesW, FindFirstFileExW, EnumSystemLocalesW, GetUserDefaultLCID, IsValidLocale, SetFilePointerEx, ReadFile, GetConsoleMode, GetConsoleCP, FlushFileBuffers, GetFileType, GetACP, GetModuleHandleExW, MultiByteToWideChar, GetStringTypeW, EncodePointer, SetLastError, InitializeCriticalSectionAndSpinCount, CreateEventW, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, LCMapStringW, GetCPInfo, SetEvent, ResetEvent, WaitForSingleObjectEx, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, InitializeSListHead, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, IsProcessorFeaturePresent, RtlUnwind, LoadLibraryExW, GetStdHandle, WriteFile, ExitProcess
USER32.dll	LoadStringW, PeekMessageW, ExitWindowsEx, MessageBoxW, MsgWaitForMultipleObjects, wsprintfW
ADVAPI32.dll	RegSetValueExW, RegCreateKeyExW, AdjustTokenPrivileges, LookupPrivilegeValueW, RegEnumValueW, RegQueryValueExW, RegOpenKeyExW, RegCloseKey, GetTokenInformation, OpenProcessToken, OpenThreadToken, CheckTokenMembership, CreateWellKnownSid, DuplicateToken
ole32.dll	CoUninitialize, CoCreateInstance, CoInitialize
SHELL32.dll	CommandLineToArgvW, SHGetFolderPathW
OLEAUT32.dll	VariantInit, VariantCopy, SysAllocString, VariantClear, SysFreeString
SHLWAPI.dll	PathRemoveFileSpecW, PathFileExistsW, PathQuoteSpacesW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	10:59:00
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\Setup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Setup.exe"
Imagebase:	0xe10000
File size:	391'376 bytes
MD5 hash:	08ABA4235F18775205A1705D89676705
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	5.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.6%
Total number of Nodes:	1045
Total number of Limit Nodes:	10

Executed Functions

Function 00E12D30 Relevance: 47.6, APIs: 18, Strings: 9, Instructions: 382
windowfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E127E0: GetTempPathW.KERNEL32(00000400,?), ref: 00E12835
Part of subcall function 00E127E0: CreateDirectoryW.KERNEL32(?,00000000), ref: 00E1284C
Part of subcall function 00E127E0: WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,?,00000000,00000000), ref: 00E12921

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 00E12DDE
GetLongPathNameW.KERNEL32(?,?,00000400), ref: 00E12DF1
GetFileAttributesW.KERNEL32(?), ref: 00E12E80
wsprintfW.USER32 ref: 00E12EDA
wsprintfW.USER32 ref: 00E12EFA
GetFileAttributesW.KERNEL32(?,?), ref: 00E12F0E
wsprintfW.USER32 ref: 00E12F91
wsprintfW.USER32 ref: 00E12FB5
FindFirstFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E13060
FindClose.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E130E3
SHGetFolderPathW.SHELL32(00000000,00000024,00000000,00000000,?), ref: 00E13105
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E13118
FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 00E13136

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

SHGetFolderPathW.SHELL32(00000000,00008023,00000000,00000000,?,?), ref: 00E1320F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E13218
FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 00E13236

Strings

Xml Used as %s, xrefs: 00E12FAF, 00E131DA
Information : No patch Exists, xrefs: 00E13154
Information : Patch Folder Exists, xrefs: 00E12F8B
Markets\Markets.xml, xrefs: 00E12F72, 00E131C0
m_szPatchDir: %s, xrefs: 00E12EF4
m_szSrcDir: %s, xrefs: 00E12ED4
Files, xrefs: 00E12E61
Patches, xrefs: 00E12EA6
*.msp, xrefs: 00E13039

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: FilePathwsprintf$AttributesErrorFindFolderFormatLastMessageName$ByteCharCloseCreateDirectoryFirstLocalLongModuleMultiTempTimeWide
String ID: *.msp$Files$Information : No patch Exists$Information : Patch Folder Exists$Markets\Markets.xml$Patches$Xml Used as %s$m_szPatchDir: %s$m_szSrcDir: %s
API String ID: 2050725286-1472794149
Opcode ID: 39cff1c00a4362f5a5f1639baa3f434c6916a5665d965da7d528b5bcc320be97
Instruction ID: 2fe2749d2c06a91de6626b8a4e0938436812bb03bc06b8559f4deeec3b724ab7
Opcode Fuzzy Hash: 39cff1c00a4362f5a5f1639baa3f434c6916a5665d965da7d528b5bcc320be97
Instruction Fuzzy Hash: EFD1DBB1A403187ADB20E7609C46FEE73BCAF45704F445858FB05F61C1EBB06A99CBA5

Function 00E15020 Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 68
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

Strings

48, xrefs: 00E15071
48, xrefs: 00E150BF
., xrefs: 00E150DA
<8, xrefs: 00E1505B
48, xrefs: 00E150B3
88, xrefs: 00E1509D
88, xrefs: 00E15087
., xrefs: 00E15032

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: LocalTime
String ID: 48$48$48$88$88$<8$.$.
API String ID: 481472006-2253082907
Opcode ID: 83d97c73438496455765114f5817cc5ce59bb7e396524e3d3e2395f86e500633
Instruction ID: 9ffa0e442f991a18fb6be691b3650515c0eb0181db2df4709cacac5e7e6647a6
Opcode Fuzzy Hash: 83d97c73438496455765114f5817cc5ce59bb7e396524e3d3e2395f86e500633
Instruction Fuzzy Hash: 121121B1F00154678F0C7BB0681B46FB6E79FD4340F4829B8B805BB385ED35DA5A8792

Function 00E1A9B0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 101
commemorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantClear.OLEAUT32(?), ref: 00E1A9EC
SysAllocString.OLEAUT32(?), ref: 00E1AA06
CoCreateInstance.OLE32(00E58D0C,00000000,00000017,00E58CE4,?), ref: 00E1AA54
VariantClear.OLEAUT32(?), ref: 00E1AACF

Part of subcall function 00E25100: __CxxThrowException@8.LIBVCRUNTIME ref: 00E25112

MessageBoxW.USER32(00000000,Could not load the markets xml file.,Setup,00000010), ref: 00E1AAC5

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

Strings

Setup, xrefs: 00E1AAB9
Could not load the markets xml file., xrefs: 00E1AAA9, 00E1AABE

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ClearVariant$AllocCreateException@8InstanceLocalMessageStringThrowTime
String ID: Could not load the markets xml file.$Setup
API String ID: 3254058793-705404800
Opcode ID: 2f55082108c86927bb9d5bdc909d325497d83c4e6fc298932f1c0d5579a1dea5
Instruction ID: a551ca54445727621889535cdd589b8944502e4bc2bd2b7f8fa833f83b655290
Opcode Fuzzy Hash: 2f55082108c86927bb9d5bdc909d325497d83c4e6fc298932f1c0d5579a1dea5
Instruction Fuzzy Hash: EA31F231A40709ABDB108F64CD04BEBB7B8FF46718F445A2AE915F7290D774A444C7A6

Function 00E331F9 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(00000003,?,00E331CF,00000003,00E5B790,0000000C,00E332E2,00000003,00000002,00000000,?,00E31E60,00000003), ref: 00E3321A
TerminateProcess.KERNEL32(00000000,?,00E331CF,00000003,00E5B790,0000000C,00E332E2,00000003,00000002,00000000,?,00E31E60,00000003), ref: 00E33221
ExitProcess.KERNEL32 ref: 00E33233

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: ec8d6b471a920f081991389633cdf5a73aaecbada70abd6095968468c229f576
Instruction ID: b5a9c34163889a1a0c39fa5a0ea4ffd34c5c3be0ac4a13c7ce9df3b8b29cd32f
Opcode Fuzzy Hash: ec8d6b471a920f081991389633cdf5a73aaecbada70abd6095968468c229f576
Instruction Fuzzy Hash: 0BE0B635001648AFCF616F65ED0DE5A3FA9EB4675AF015014F849AA232CB35DE46CA41

Function 00E18EA0 Relevance: 91.9, APIs: 16, Strings: 36, Instructions: 927COMMON

Download Yara Rule

Strings

SmartFit\, xrefs: 00E196C7
Setup, xrefs: 00E197B8
Update done, xrefs: 00E19C29
Related Product found. ProductCode: '%s', xrefs: 00E19006
MsiEnumRelatedProducts returned: '%lu', xrefs: 00E190EB
Prereqs met, xrefs: 00E19193
Error retrieving Transforms property: '%lu', xrefs: 00E198F8
Cannot upgrade a product that is not installed., xrefs: 00E19299
GN ReSound\FSW Notify\, xrefs: 00E1966C
Patch invoke did not return a success code..., xrefs: 00E19B64
Aventa3\, xrefs: 00E196B4
Transforms, xrefs: 00E198C3
Running in silent mode and .NET Framework installer requested a reboot. Caller should Reboot machine then restart Setup to continu, xrefs: 00E19229
Related Product's ProductCode is same as current ProductCode, xrefs: 00E190B8
No Related Products found., xrefs: 00E190C7
Pre X13 Installed, xrefs: 00E1926B
Update was not installed successfully., xrefs: 00E19C07, 00E19C16
Transforms: '%s' szProductCode: '%s' sLangId: '%s', xrefs: 00E199E4
Running in web update mode so no need to reboot since .NET Framework already installed, xrefs: 00E191D5
InstallLocation, xrefs: 00E1949A, 00E19506
Product Is Already Installed, xrefs: 00E191FA
Running Feature Update, xrefs: 00E19786
Update installed successfully., xrefs: 00E1979F, 00E197BD, 00E19BE0, 00E19BF3
Feature Update invoke did not return a success code..., xrefs: 00E197CF
Legacy Uninstall did not complete successfully; User may have cancelled. Uninstall or run installer again., xrefs: 00E192F4
Related Product's ProductCode is different from one in Markets.xml and will be used., xrefs: 00E19093
Running in silent mode and VCRedist installer requested a reboot. Caller should Reboot machine then restart Setup to continue., xrefs: 00E19215
InstallLocation: '%s' InstallLegacyLocation: '%s' InstallNewLocation: '%s' NotifyInstallLocation: '%s', xrefs: 00E19700
PackageCode, xrefs: 00E19419
UpgradeCode: '%s', xrefs: 00E18FAF
Related Product's ProductCode is same as one in Markets.xml, xrefs: 00E190B1
Uninstall did not complete successfully; User may have cancelled. Uninstall or run installer again., xrefs: 00E19A59
Running webupdate/patch, xrefs: 00E19B3A
Error retrieving InstallLocation property: '%lu', xrefs: 00E194D9, 00E1953B
m_szInstallLocation is empty. Getting CSIDL_PROGRAM_FILES..., xrefs: 00E19571
VC Redist wants to reboot. Verify it is not a fake request per KB. Just continue for now..., xrefs: 00E19246

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: CommandFileLineName$ArgvAttributesFreeLocalLongMessageModulePathwsprintf
String ID: Aventa3\$Cannot upgrade a product that is not installed.$Error retrieving InstallLocation property: '%lu'$Error retrieving Transforms property: '%lu'$Feature Update invoke did not return a success code...$GN ReSound\FSW Notify\$InstallLocation$InstallLocation: '%s' InstallLegacyLocation: '%s' InstallNewLocation: '%s' NotifyInstallLocation: '%s'$Legacy Uninstall did not complete successfully; User may have cancelled. Uninstall or run installer again.$MsiEnumRelatedProducts returned: '%lu'$No Related Products found.$PackageCode$Patch invoke did not return a success code...$Pre X13 Installed$Prereqs met$Product Is Already Installed$Related Product found. ProductCode: '%s'$Related Product's ProductCode is different from one in Markets.xml and will be used.$Related Product's ProductCode is same as current ProductCode$Related Product's ProductCode is same as one in Markets.xml$Running Feature Update$Running in silent mode and .NET Framework installer requested a reboot. Caller should Reboot machine then restart Setup to continu$Running in silent mode and VCRedist installer requested a reboot. Caller should Reboot machine then restart Setup to continue.$Running in web update mode so no need to reboot since .NET Framework already installed$Running webupdate/patch$Setup$SmartFit\$Transforms$Transforms: '%s' szProductCode: '%s' sLangId: '%s'$Uninstall did not complete successfully; User may have cancelled. Uninstall or run installer again.$Update done$Update installed successfully.$Update was not installed successfully.$UpgradeCode: '%s'$VC Redist wants to reboot. Verify it is not a fake request per KB. Just continue for now...$m_szInstallLocation is empty. Getting CSIDL_PROGRAM_FILES...
API String ID: 4019564706-1855592880
Opcode ID: f05a7e576301b6b0ee7addca3b1fb1648a251b07686fdc5dd3dbeb09e9e01ff3
Instruction ID: ba47166e077cccfc217b222c2f4bfed1e9c4f91876225bb79deb2aa9e800b4da
Opcode Fuzzy Hash: f05a7e576301b6b0ee7addca3b1fb1648a251b07686fdc5dd3dbeb09e9e01ff3
Instruction Fuzzy Hash: 1272E671A04714AADB20E760CC66BEEB3F9AF06704F042599E44A771C3DB715BC9CB92

Function 00E41CF6 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E419C4: CreateFileW.KERNEL32(00000000,00000000,?,00E41D9F,?,?,00000000,?,00E41D9F,00000000,0000000C), ref: 00E419E1

GetLastError.KERNEL32 ref: 00E41E0A
__dosmaperr.LIBCMT ref: 00E41E11
GetFileType.KERNEL32(00000000), ref: 00E41E1D
GetLastError.KERNEL32 ref: 00E41E27
__dosmaperr.LIBCMT ref: 00E41E30
CloseHandle.KERNEL32(00000000), ref: 00E41E50
CloseHandle.KERNEL32(?), ref: 00E41F9A
GetLastError.KERNEL32 ref: 00E41FCC
__dosmaperr.LIBCMT ref: 00E41FD3

Strings

H, xrefs: 00E41F58

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: ab3c6cb6f602f1b5b5fee2438a8a7ddae1862f866cc448013eec814662bf28a0
Instruction ID: 1feee87379f2f366b7d5fa40d78c6ed626c31340b8794f0331994da6cbe3465c
Opcode Fuzzy Hash: ab3c6cb6f602f1b5b5fee2438a8a7ddae1862f866cc448013eec814662bf28a0
Instruction Fuzzy Hash: 9EA13432A102448FDF19DF78E8917AD7BE0AB06325F241189F812BB392DB319D56CB51

Function 00E33D9A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00E31E61: RtlAllocateHeap.NTDLL(00000000,00000003,00000000,?,00000003,00E350B2,?,00E2C5E9,?), ref: 00E31E93

_free.LIBCMT ref: 00E33EA5
_free.LIBCMT ref: 00E33EBC
_free.LIBCMT ref: 00E33EDB
_free.LIBCMT ref: 00E33EF6
_free.LIBCMT ref: 00E33F0D

Strings

i5, xrefs: 00E33F35

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: _free$AllocateHeap
String ID: i5
API String ID: 3033488037-3787849833
Opcode ID: eca89e0330f292cbe460263462d89a81abfe083ecfed8c28f9ca269150a12766
Instruction ID: 82923c4f9735d14a2496f4bbb60e341e02a936ce7ec053e57f1bae9ca0585f4f
Opcode Fuzzy Hash: eca89e0330f292cbe460263462d89a81abfe083ecfed8c28f9ca269150a12766
Instruction Fuzzy Hash: 9551B471A00304AFDB20DF7AD846A6ABBF5EF58724F14165DE849FB291E731EA01CB40

Function 00E31A29 Relevance: 9.2, APIs: 6, Instructions: 200
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__cftoe.LIBCMT ref: 00E31A55
__cftoe.LIBCMT ref: 00E31A87

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: 178a0ec183fec47ebdb8e6de792bc29263eaae5d6ef44acd0b85ad6eba94f9e2
Instruction ID: 01fca590f31eeb42ba666ff7e96eb9c9642ab106564087eea96d612dea7fb9a7
Opcode Fuzzy Hash: 178a0ec183fec47ebdb8e6de792bc29263eaae5d6ef44acd0b85ad6eba94f9e2
Instruction Fuzzy Hash: B8510D32904205EBDF249B68CC49EAEBFF9EF48365F14629DF815B6192EB31C940C664

Function 00E22070 Relevance: 9.1, APIs: 6, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E2209D
std::_Lockit::_Lockit.LIBCPMT ref: 00E220C0
std::_Lockit::~_Lockit.LIBCPMT ref: 00E220E0
__CxxThrowException@8.LIBVCRUNTIME ref: 00E22159
std::_Facet_Register.LIBCPMT ref: 00E2216F
std::_Lockit::~_Lockit.LIBCPMT ref: 00E2217A

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
String ID:
API String ID: 2536120697-0
Opcode ID: 4f1e7f984db82bca4aad61287e91fe4db3a467542646bb4d43eb124bde4a9d0f
Instruction ID: 3291d8e00d29219ca4aef31945671a3aad6b428297c51f735317a540561d40fb
Opcode Fuzzy Hash: 4f1e7f984db82bca4aad61287e91fe4db3a467542646bb4d43eb124bde4a9d0f
Instruction Fuzzy Hash: 1B310172A00224AFCB25DF90FC81EAEB7B4EF44324F14121DEA01B7291D731AD45CB90

Function 00E127E0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000400,?), ref: 00E12835
CreateDirectoryW.KERNEL32(?,00000000), ref: 00E1284C
WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,?,00000000,00000000), ref: 00E12921

Part of subcall function 00E24060: __CxxThrowException@8.LIBVCRUNTIME ref: 00E24106

Part of subcall function 00E24F30: WideCharToMultiByte.KERNEL32(00E129FB,00000000,?,000000FF,?,?,00000000,00000000,?,?,00E129FB,?,00000003,00000000,00000002,?), ref: 00E24F51

Strings

C:\PatchInstaller.log, xrefs: 00E1299F
PatchInstaller.Log, xrefs: 00E128BA

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ByteCharMultiWide$CreateDirectoryException@8PathTempThrow
String ID: C:\PatchInstaller.log$PatchInstaller.Log
API String ID: 1543206543-1754359095
Opcode ID: 50da35d2a0de781e70b6c5e1a831524aff34831146560887b7c3f7fe09f30f82
Instruction ID: c9640774f43fde2312d6be3882678f738dcf43f884978631032e490beeebf604
Opcode Fuzzy Hash: 50da35d2a0de781e70b6c5e1a831524aff34831146560887b7c3f7fe09f30f82
Instruction Fuzzy Hash: B2510971A002199FDB24DB24DC42FEA73A8FF44714F149568EA06B71C1EB70AE86CBD5

Function 00E22AA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

new.LIBCMT ref: 00E22AE4
__Getctype.LIBCPMT ref: 00E22B30
__Getcvt.LIBCPMT ref: 00E22B43

Strings

2!, xrefs: 00E22B1F, 00E22B29

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: GetctypeGetcvt
String ID: 2!
API String ID: 492523193-1904098939
Opcode ID: d7d0530845638ba8d258b50def115b1317bd9bee5d96bfc0665321fbf1405815
Instruction ID: ff8025ff17a6d24c9d401eca0d9ea9088fa4a64fbedece75331c5c126944d843
Opcode Fuzzy Hash: d7d0530845638ba8d258b50def115b1317bd9bee5d96bfc0665321fbf1405815
Instruction Fuzzy Hash: 5321ADB1D00669ABDB10CF14D941BA9B7B4FF58314F10A26EE949BB251EB70A6D4CB80

Function 00E22D00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E22D2D
__CxxThrowException@8.LIBVCRUNTIME ref: 00E22DB4

Part of subcall function 00E292EA: RaiseException.KERNEL32(?,?,00E259CF,?,?,?,?,?,?,?,?,00E259CF,?,00E5B360,?), ref: 00E29349

std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00E22DBB

Strings

xc, xrefs: 00E22D7D

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: std::_$ExceptionException@8Locinfo::_Locinfo_ctorLockitLockit::_RaiseThrow
String ID: xc
API String ID: 1915927752-1377889829
Opcode ID: 907a019e8bc08fed8380363e9ab8a03a618b546a475fce23ddb2f56618a8ab84
Instruction ID: 8d24657d3140cdce0766530b06f00216c8dd8f6da581d56a37cf45aeceacc098
Opcode Fuzzy Hash: 907a019e8bc08fed8380363e9ab8a03a618b546a475fce23ddb2f56618a8ab84
Instruction Fuzzy Hash: FF21A1B18047989FC720CF68D945BCBBBF8AF19304F00565EE845B3641E3B5A6088BA1

Function 00E36BB9 Relevance: 4.7, APIs: 3, Instructions: 186
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cacb7e8f0423ea5ae2e4733106da73f253c9d76bb893f2985330336cb813a939
Instruction ID: 1d7313d036b9761f7aa2f95a8f6aeb5fa30cd7c0dd02dbde392b42fc7f6f4069
Opcode Fuzzy Hash: cacb7e8f0423ea5ae2e4733106da73f253c9d76bb893f2985330336cb813a939
Instruction Fuzzy Hash: 1951BF71A00219BBCF10EFB9D849BEEBFF4EF05314F60A459E401BB291D6719901DB61

Function 00E367D4 Relevance: 3.1, APIs: 2, Instructions: 77
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNEL32(00000000,?,?,?,00000000,00000000,?,?,?,00E36D10,?,?,00000000,?,?,?), ref: 00E3686F
GetLastError.KERNEL32(?,00E36D10,?,?,00000000,?,?,?,?,?,?,?,00E5B958,00000014,00E307A6,00000000), ref: 00E36898

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: bf902d036c1e65ec3e1f2d15512b05c0fd5ae3ced6f84edd80cf3b1c4bfe4b35
Instruction ID: a6854ace0c646a2b0b4e9396fe693df6d578ce0b643db8cb5ada4b33cf3fbb77
Opcode Fuzzy Hash: bf902d036c1e65ec3e1f2d15512b05c0fd5ae3ced6f84edd80cf3b1c4bfe4b35
Instruction Fuzzy Hash: D121B475A002199FCB18CF69D884BE9B7F4FB48306F1058A9E54AE7251D730AE85CB50

Function 00E1D130 Relevance: 2.5, APIs: 2, Instructions: 28
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 00E1D151

Part of subcall function 00E12670: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00E1276B

CoUninitialize.COMBASE(?,80004005,?,00E58560,00E44A18,00E58D1C,00000000,?,?,F9744ECF,?,?,?), ref: 00E1D175

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: InitializeIos_base_dtorUninitializestd::ios_base::_
String ID:
API String ID: 3253047658-0
Opcode ID: 95f6e82223303c67992acd4125787bbb05fa20bf638f413315a132f1b57f08dc
Instruction ID: da6145eae7e8880c9f56fd928bde486f1725fc15f3b4267f3c975e6d14bacb08
Opcode Fuzzy Hash: 95f6e82223303c67992acd4125787bbb05fa20bf638f413315a132f1b57f08dc
Instruction Fuzzy Hash: 41F0A7301182159FC324FB64EC46AAF77D4EB41360F004A2DF886A36E1EE305955D7A3

Function 00E39B09 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 00E39B47

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: a972da73a61b92068346f98ede6959e1b92fe29ee4e2d24284ff83baafe69546
Instruction ID: d5a06e80161ddcb96962e7eb9adc2a60ebf7ed0cbd7f535ed50cd2f308648bd0
Opcode Fuzzy Hash: a972da73a61b92068346f98ede6959e1b92fe29ee4e2d24284ff83baafe69546
Instruction Fuzzy Hash: 261148B190420AAFCF09DF58E94599B7BF8EF48314F0040A9F808AB312D771DA11CB65

Function 00E33515 Relevance: 1.5, APIs: 1, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E31CD5: HeapAlloc.KERNEL32(00000008,?,00000000,?,00E350E4,00000001,00000364,?,00E2C08A,00000000,00000000,00000000,00000000,00000000,?,00E25685), ref: 00E31D16

_free.LIBCMT ref: 00E33535

Part of subcall function 00E32695: HeapFree.KERNEL32(00000000,00000000,?,00E3D2F5,?,00000000,?,00000000,?,00E3D599,?,00000007,?,?,00E3D93D,?), ref: 00E326AB
Part of subcall function 00E32695: GetLastError.KERNEL32(?,?,00E3D2F5,?,00000000,?,00000000,?,00E3D599,?,00000007,?,?,00E3D93D,?,?), ref: 00E326BD

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Heap$AllocErrorFreeLast_free
String ID:
API String ID: 3091179305-0
Opcode ID: 5c740d9e96b96107a8f0300dca8996efb025bedb21a2740f59a75cda9e0ac999
Instruction ID: a338306686f94ec2e2c7fa537ab3076563cad1084ee711caf54649de05e877a6
Opcode Fuzzy Hash: 5c740d9e96b96107a8f0300dca8996efb025bedb21a2740f59a75cda9e0ac999
Instruction Fuzzy Hash: 09F03C71A00609AFC310DF69D446F5ABBF4EB48710F104166E918EB341EB71AA10CBD1

Function 00E41C85 Relevance: 1.5, APIs: 1, Instructions: 36COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00E41CC6

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: d7183492150423381beb15ce98cff8bf33a3ab4449eb335220340f756bfa2b83
Instruction ID: 051ceadff3cd6b079919963f8e7f319b7b4da0d4c752586d0f5d67075aac5f39
Opcode Fuzzy Hash: d7183492150423381beb15ce98cff8bf33a3ab4449eb335220340f756bfa2b83
Instruction Fuzzy Hash: 53F0BE33910009BBCF115E95EC02DDF7BADEF89374F100155FE14A21A0DA32CA20A7A0

Function 00E31E61 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000003,00000000,?,00000003,00E350B2,?,00E2C5E9,?), ref: 00E31E93

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 14387ea3b22e81c2cd28e5cba73cab6c8e6e4b217539fc02b37792236c915597
Instruction ID: 45f57e92501fe2f7fb0c791d3ac98f90e9c896b16442206ce23f17c8b207a136
Opcode Fuzzy Hash: 14387ea3b22e81c2cd28e5cba73cab6c8e6e4b217539fc02b37792236c915597
Instruction Fuzzy Hash: 39E0653550032096E7312A679C0DBAB7E999FC27A4F152195EC08B61D0DB26DC40D5E5

Function 00E419C4 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00E41D9F,?,?,00000000,?,00E41D9F,00000000,0000000C), ref: 00E419E1

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: a399da22b04d3b3fe3f0bc04c9f90f44374bcef9847decb117245298fb323d68
Instruction ID: a8d3ef89d56ee851f0a076338d90d4eb9972991b36963088c45c245f76d59ad5
Opcode Fuzzy Hash: a399da22b04d3b3fe3f0bc04c9f90f44374bcef9847decb117245298fb323d68
Instruction Fuzzy Hash: 34D06C3200020DBFDF128F85DD06EDA3BAAFB48714F014000BA1866020C736E822AB91

Non-executed Functions

Function 00E150F0 Relevance: 70.6, APIs: 26, Strings: 14, Instructions: 562COMMON

Download Yara Rule

APIs

Part of subcall function 00E24BB0: VariantInit.OLEAUT32(?), ref: 00E24BF7
Part of subcall function 00E24BB0: VariantClear.OLEAUT32(?), ref: 00E24C55

VariantCopy.OLEAUT32(?,00000000), ref: 00E1516F
VariantCopy.OLEAUT32(?,00000000), ref: 00E151B9
VariantCopy.OLEAUT32(?,00000000), ref: 00E15203
VariantCopy.OLEAUT32(?,00000000), ref: 00E1524D
VariantCopy.OLEAUT32(?,00000000), ref: 00E15297
VariantCopy.OLEAUT32(?,00000000), ref: 00E1532B
VariantCopy.OLEAUT32(?,00000000), ref: 00E15375
VariantCopy.OLEAUT32(?,00000000), ref: 00E153BF
VariantCopy.OLEAUT32(?,00000000), ref: 00E15409
VariantCopy.OLEAUT32(?,00000000), ref: 00E15453
VariantCopy.OLEAUT32(?,00000000), ref: 00E1549D
VariantCopy.OLEAUT32(?,00000000), ref: 00E152E1

Part of subcall function 00E25100: __CxxThrowException@8.LIBVCRUNTIME ref: 00E25112

_wcsrchr.LIBVCRUNTIME ref: 00E155A4
wsprintfW.USER32 ref: 00E1584F

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

VariantClear.OLEAUT32(?), ref: 00E15873
VariantClear.OLEAUT32(?), ref: 00E1587C
VariantClear.OLEAUT32(?), ref: 00E15885
VariantClear.OLEAUT32(?), ref: 00E1588E
VariantClear.OLEAUT32(?), ref: 00E15897
VariantClear.OLEAUT32(?), ref: 00E158A0
VariantClear.OLEAUT32(?), ref: 00E158A9
VariantClear.OLEAUT32(?), ref: 00E158B2
VariantClear.OLEAUT32(?), ref: 00E158BB
VariantClear.OLEAUT32(?), ref: 00E158C4
VariantClear.OLEAUT32(?), ref: 00E158CD
VariantClear.OLEAUT32(?), ref: 00E158D6

Strings

ProductName, xrefs: 00E151D7
DevOpsKey, xrefs: 00E153DD
Brand, xrefs: 00E15221
ProductCode, xrefs: 00E1513A
.exe, xrefs: 00E15521
DevOpsURI, xrefs: 00E15427
ProductVersion, xrefs: 00E1526B
Product Information:ProductCode: %sExeName: %sProductName: %sBrand: %sProductVer: %sNextPatch Ver: %sMarketPatchKey:, xrefs: 00E15849
OriginalProductCode, xrefs: 00E15471
NextPatchProductVersion, xrefs: 00E152B5
ExeName, xrefs: 00E1518D
Tag, xrefs: 00E15393
MarketPatchKey, xrefs: 00E152FF
PreviousProductCode, xrefs: 00E15349

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Variant$Clear$Copy$Exception@8InitLocalThrowTime_wcsrchrwsprintf
String ID: .exe$Brand$DevOpsKey$DevOpsURI$ExeName$MarketPatchKey$NextPatchProductVersion$OriginalProductCode$PreviousProductCode$Product Information:ProductCode: %sExeName: %sProductName: %sBrand: %sProductVer: %sNextPatch Ver: %sMarketPatchKey:$ProductCode$ProductName$ProductVersion$Tag
API String ID: 1114562085-1508803850
Opcode ID: f468423e5ba3c003d18d30009f09d75d652d76b96f9401db40d4ed377e08cfa9
Instruction ID: 176732581c0cb9a814ead6748bedde3c0ebffd36a1425847e0afa8311c1fa009
Opcode Fuzzy Hash: f468423e5ba3c003d18d30009f09d75d652d76b96f9401db40d4ed377e08cfa9
Instruction Fuzzy Hash: 64225FB1D01618AADB26DB64CC65BDAB7BCEF44304F0095D9E50EF3190EA71ABC98F50

Function 00E15DD0 Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 209filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

wsprintfW.USER32 ref: 00E15F0A
wsprintfW.USER32 ref: 00E15F30
FindFirstFileW.KERNEL32(?,?,?,?,?), ref: 00E15F67
GetFileAttributesW.KERNEL32(?,?,?,?), ref: 00E15F94
SetFileAttributesW.KERNEL32(?,00000000,?,?,?), ref: 00E15FB2
SetFileAttributesW.KERNEL32(?,00000000,?,?,?), ref: 00E15FC4
CopyFileW.KERNEL32(?,?,00000000,?,?,?), ref: 00E15FD6
wsprintfW.USER32 ref: 00E15FF3
GetFileAttributesW.KERNEL32(?,?), ref: 00E16011
SetFileAttributesW.KERNEL32(?,00000000), ref: 00E16029
SetFileAttributesW.KERNEL32(?,00000000), ref: 00E1603B
GetLastError.KERNEL32(?,?,?), ref: 00E1603F
FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,?,?,?), ref: 00E1605D
FindClose.KERNEL32(?), ref: 00E1607D

Strings

Ratatosk db path: '%s', xrefs: 00E15F04
Ratatosk db source path: '%s', xrefs: 00E15F2A
RatatoskConfiguration.sdf, xrefs: 00E15E95
CopyRatatoskDb..., xrefs: 00E15DEA
LegacyRatatoskConfiguration.sdf, xrefs: 00E15EAD
Ratatosk db copied to '%s', xrefs: 00E15FED

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: File$Attributes$wsprintf$Find$CloseCopyErrorFirstFormatLastLocalMessageTime
String ID: CopyRatatoskDb...$LegacyRatatoskConfiguration.sdf$Ratatosk db copied to '%s'$Ratatosk db path: '%s'$Ratatosk db source path: '%s'$RatatoskConfiguration.sdf
API String ID: 2855944122-1024932132
Opcode ID: 8ba040cb4e22f3a7b922da12531aeea0a91e47c820674a6094ab7178a00ed12f
Instruction ID: 46ac48e30cd12a064de487b2c966e9665460d41a3d1c2a535fd08af0e5e9b062
Opcode Fuzzy Hash: 8ba040cb4e22f3a7b922da12531aeea0a91e47c820674a6094ab7178a00ed12f
Instruction Fuzzy Hash: 7F71ABB5A00318AADB21DB60DC46FDA77BCAF09301F4095D1B545F21C1DB74AB8DCBA5

Function 00E1A560 Relevance: 31.8, APIs: 12, Strings: 6, Instructions: 298filesleepwindowCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00E1A5CB

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

FindFirstFileW.KERNEL32(?,?), ref: 00E1A762
FindClose.KERNEL32(00000000), ref: 00E1A792
wsprintfW.USER32 ref: 00E1A84F
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?), ref: 00E1A8B7
GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00E1A8C4
SetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00E1A8E4
SetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00E1A8F6
CopyFileW.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?), ref: 00E1A908
wsprintfW.USER32 ref: 00E1A92C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 00E1A967
FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 00E1A985

Strings

szSrcFile: '%s' szTargetDir: '%s', xrefs: 00E1A849
*.mst, xrefs: 00E1A741
mst file not found under windows installer dir, xrefs: 00E1A993
Installer\, xrefs: 00E1A689
mst copied to '%s', xrefs: 00E1A926
CopyLatestMstForPatch with ProductCode '%s', xrefs: 00E1A5C5

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: File$Attributeswsprintf$Find$CloseCopyErrorFirstFormatLastLocalMessageSleepTime
String ID: *.mst$CopyLatestMstForPatch with ProductCode '%s'$Installer\$mst copied to '%s'$mst file not found under windows installer dir$szSrcFile: '%s' szTargetDir: '%s'
API String ID: 255911844-1462931032
Opcode ID: aec06a45ebb11c292dd66b44aca6f6aee5d5f0e3a3029ae7e175df4599349d65
Instruction ID: c1c406b12c656eaf9a9bd5d1b9caa1fbdc1e5f191af26757bdc27d735c84c010
Opcode Fuzzy Hash: aec06a45ebb11c292dd66b44aca6f6aee5d5f0e3a3029ae7e175df4599349d65
Instruction Fuzzy Hash: CEB1A8B1940218AADB21DBA0EC4AFDA73FCAF08704F0454A1F605F61C1E770BB99CB95

Function 00E1D1A0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 160synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(00000000,00000001,00000000,F9744ECF,?,?,00000001), ref: 00E1D1D8
GetLastError.KERNEL32(?,?,00000001), ref: 00E1D1DE

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

Strings

Waiting for process to finish Timed Out...., xrefs: 00E1D30D, 00E1D317
CreateMutex ERROR_ALREADY_EXISTS, xrefs: 00E1D1EB
Waiting for process success...., xrefs: 00E1D376
Waiting for process to finish closing...., xrefs: 00E1D266

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: CreateErrorLastLocalMutexTime
String ID: CreateMutex ERROR_ALREADY_EXISTS$Waiting for process success....$Waiting for process to finish Timed Out....$Waiting for process to finish closing....
API String ID: 3045055881-1882265619
Opcode ID: 5d1af1c64834b94250d65bc4e94dfb9045416a74b84491cae9d7edc28db5ffdd
Instruction ID: 4e449bef9de2ac8d0fe09428f7a92b38f625d9800b9fc6509cd227def24e667d
Opcode Fuzzy Hash: 5d1af1c64834b94250d65bc4e94dfb9045416a74b84491cae9d7edc28db5ffdd
Instruction Fuzzy Hash: F251F832B48308ABEB20DF99EC41BEDB7A4EB46710F00552AF915F72D0DB759884CB91

Function 00E11070 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 106threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00E110AD
OpenThreadToken.ADVAPI32(00000000), ref: 00E110B4
GetCurrentProcess.KERNEL32(0000000A,00000000), ref: 00E110C7
OpenProcessToken.ADVAPI32(00000000), ref: 00E110CE
GetVersionExW.KERNEL32(?), ref: 00E110ED
GetTokenInformation.ADVAPI32(00000000,00000012(TokenIntegrityLevel),?,00000004,?), ref: 00E11122
GetTokenInformation.ADVAPI32(00000000,00000013(TokenIntegrityLevel),00000000,00000004,?), ref: 00E1114D
DuplicateToken.ADVAPI32(00000000,00000001,00000000), ref: 00E1116B
CreateWellKnownSid.ADVAPI32(0000001A,00000000,?,?), ref: 00E1118E
CheckTokenMembership.ADVAPI32(00000000,?,00000000), ref: 00E111A9
GetLastError.KERNEL32 ref: 00E111B3
CloseHandle.KERNEL32(00000000), ref: 00E111CA
CloseHandle.KERNEL32(00000000), ref: 00E111E1

Strings

D, xrefs: 00E1117B

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Token$CloseCurrentHandleInformationOpenProcessThread$CheckCreateDuplicateErrorKnownLastMembershipVersionWell
String ID: D
API String ID: 2197316560-2746444292
Opcode ID: 44815da97c0093a229316d14259e5e658dbd745edc6a5c614cd2b0d40de71fe6
Instruction ID: 418738f55f374f973b483418cbc8c34bcec67195d1e05a3a095e17770ae43e90
Opcode Fuzzy Hash: 44815da97c0093a229316d14259e5e658dbd745edc6a5c614cd2b0d40de71fe6
Instruction Fuzzy Hash: CF41C674A1521CAFEB219B61DD48BEABBBCBB0A705F0001D5EA08F6190D7719E89CF51

Function 00E1CA80 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 97COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(FeatureUpdate,Update,00E52748,?,00000400,?), ref: 00E1CB49
GetPrivateProfileStringW.KERNEL32(FeatureUpdate,Keep,00E52748,?,00000400,?), ref: 00E1CB67
GetPrivateProfileStringW.KERNEL32(FeatureUpdate,Remove,00E52748,?,00000400,?), ref: 00E1CB85
GetPrivateProfileStringW.KERNEL32(FeatureUpdate,Add,00E52748,?,00000400,?), ref: 00E1CBA8
GetPrivateProfileStringW.KERNEL32(FeatureUpdate,CmdLineOverride,00E52748,?,00000400,?), ref: 00E1CBCB

Strings

FeatureUpdate, xrefs: 00E1CB44, 00E1CB62, 00E1CB80, 00E1CBA3, 00E1CBC6
CmdLineOverride, xrefs: 00E1CBC1
Add, xrefs: 00E1CB9E
Update, xrefs: 00E1CB3F
Setup.ini, xrefs: 00E1CB0E
Keep, xrefs: 00E1CB5D
Remove, xrefs: 00E1CB7B

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: PrivateProfileString
String ID: Add$CmdLineOverride$FeatureUpdate$Keep$Remove$Setup.ini$Update
API String ID: 1096422788-2229065965
Opcode ID: 0a818885d9c1c0183d7f8386adc10f8d462638fd4c87a4291863b7a6a87073ef
Instruction ID: 830974d9eaafb1e3b932bf6ba58d430aa4a827492e5d0cb83b5b61e93429f764
Opcode Fuzzy Hash: 0a818885d9c1c0183d7f8386adc10f8d462638fd4c87a4291863b7a6a87073ef
Instruction Fuzzy Hash: 9531C5B5A8031C6ACB50DA54DD42FD973FCEB08705F44A496BF45B61C0DEB06A4D8BD4

Function 00E121A0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51shutdownCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 00E121B6
OpenProcessToken.ADVAPI32(00000000), ref: 00E121BD
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00E121E2
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000), ref: 00E12205
GetLastError.KERNEL32 ref: 00E1220B
ExitWindowsEx.USER32(00000006,80040002), ref: 00E1221C

Strings

SeShutdownPrivilege, xrefs: 00E121DB

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentErrorExitLastLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 107509674-3733053543
Opcode ID: 2278764458f19c9792054bb744a2343cc858ce8bdb86232bcb0fb7aabb604b53
Instruction ID: 0ee9506b01ced2721668ed5ad05e8faa8f74cd9e813beea979e8ec6700373e87
Opcode Fuzzy Hash: 2278764458f19c9792054bb744a2343cc858ce8bdb86232bcb0fb7aabb604b53
Instruction Fuzzy Hash: 40015274B41208AFDB14DFB1EC0AFBE77B8EB06705F500158FA0AF61D0DA7059598762

Function 00E3E91B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,00E3EC3A,?,00000000), ref: 00E3E9B4
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,00E3EC3A,?,00000000), ref: 00E3E9DD
GetACP.KERNEL32(?,?,00E3EC3A,?,00000000), ref: 00E3E9F2

Strings

ACP, xrefs: 00E3E939
OCP, xrefs: 00E3E96F

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: c7b786635aa8e084526d81f25e2ff0b8a3a14d443cc9c21df0797a2d8da7c62d
Instruction ID: 1c02d6fb01944c94aafda0fd328ff3be4d507e439f334c5888795c5f867d010d
Opcode Fuzzy Hash: c7b786635aa8e084526d81f25e2ff0b8a3a14d443cc9c21df0797a2d8da7c62d
Instruction Fuzzy Hash: 5421C422600105AAD7B49F14C809BA7BFA6EFD4F69F56A5E4E909F7380E732DD41C350

Function 00E3EAEF Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E3502F: GetLastError.KERNEL32(?,?,00E2C109,?,00000000,?,00E2C5E9,?), ref: 00E35033
Part of subcall function 00E3502F: _free.LIBCMT ref: 00E35066
Part of subcall function 00E3502F: SetLastError.KERNEL32(00000000,?,00E2C5E9,?), ref: 00E350A7
Part of subcall function 00E3502F: _abort.LIBCMT ref: 00E350AD

Part of subcall function 00E3502F: _free.LIBCMT ref: 00E3508E
Part of subcall function 00E3502F: SetLastError.KERNEL32(00000000,?,00E2C5E9,?), ref: 00E3509B

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 00E3EBFB
IsValidCodePage.KERNEL32(00000000), ref: 00E3EC56
IsValidLocale.KERNEL32(?,00000001), ref: 00E3EC65
GetLocaleInfoW.KERNEL32(?,00001001,00E33B0B,00000040,?,00E33C2B,00000055,00000000,?,?,00000055,00000000), ref: 00E3ECAD
GetLocaleInfoW.KERNEL32(?,00001002,00E33B8B,00000040), ref: 00E3ECCC

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser_abort
String ID:
API String ID: 745075371-0
Opcode ID: 8202585b5d17313f7b807e3745c9b08489f612d7f1f89b82ff8755bd8fd100a2
Instruction ID: 6f42bf987f5aac51b53d1cc3c308a2657a5eb56adfadc880256aa1909a10a490
Opcode Fuzzy Hash: 8202585b5d17313f7b807e3745c9b08489f612d7f1f89b82ff8755bd8fd100a2
Instruction Fuzzy Hash: 93518E72A00249AFDF20DFA5CC49ABEBBB8AF45704F142469E915F7290E7709D44CB61

Function 00E3E1B7 Relevance: 6.2, APIs: 4, Instructions: 236COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E3502F: GetLastError.KERNEL32(?,?,00E2C109,?,00000000,?,00E2C5E9,?), ref: 00E35033
Part of subcall function 00E3502F: _free.LIBCMT ref: 00E35066
Part of subcall function 00E3502F: SetLastError.KERNEL32(00000000,?,00E2C5E9,?), ref: 00E350A7
Part of subcall function 00E3502F: _abort.LIBCMT ref: 00E350AD

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,00E33B12,?,?,?,?,?,?,00000004), ref: 00E3E299
_wcschr.LIBVCRUNTIME ref: 00E3E329
_wcschr.LIBVCRUNTIME ref: 00E3E337
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,00E33B12,00000000,00E33C32), ref: 00E3E3DA

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_abort_free
String ID:
API String ID: 4212172061-0
Opcode ID: 63abede393b8d9e5b879580b383f6377da02729730c524343ec3e0a2bca9d6d2
Instruction ID: 8353677ec856bef542b51bc486e9e0180d14f6dfe21c31ea204861e0d9a8c4e7
Opcode Fuzzy Hash: 63abede393b8d9e5b879580b383f6377da02729730c524343ec3e0a2bca9d6d2
Instruction Fuzzy Hash: CE61FB71600306AADB28AB34DC4ABA77BECEF45714F141429F905F73C1EA71D940CBA0

Function 00E114B0 Relevance: 6.1, APIs: 4, Instructions: 138processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00E11529
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00E11539
Process32NextW.KERNEL32(00000000,?), ref: 00E11640
CloseHandle.KERNEL32(00000000,00000000,-00000002,-00000002,00000000,-00000002), ref: 00E11650

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 4b827180f6afd298c81e807c34b68aab7dcb42bf1b32fcd2cd471571a4ce69d8
Instruction ID: c2b8bfa0d2256d880f79b9cc79f6945ff395f884a20fc0b2aed9f5b60622863b
Opcode Fuzzy Hash: 4b827180f6afd298c81e807c34b68aab7dcb42bf1b32fcd2cd471571a4ce69d8
Instruction Fuzzy Hash: 1141B371900158AACB20EB60DC45BEA73BCFF45304F0455EAE64AF7181EBB46AC58F90

Function 00E3E5A2 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00E3502F: GetLastError.KERNEL32(?,?,00E2C109,?,00000000,?,00E2C5E9,?), ref: 00E35033
Part of subcall function 00E3502F: _free.LIBCMT ref: 00E35066
Part of subcall function 00E3502F: SetLastError.KERNEL32(00000000,?,00E2C5E9,?), ref: 00E350A7
Part of subcall function 00E3502F: _abort.LIBCMT ref: 00E350AD

Part of subcall function 00E3502F: _free.LIBCMT ref: 00E3508E
Part of subcall function 00E3502F: SetLastError.KERNEL32(00000000,?,00E2C5E9,?), ref: 00E3509B

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E3E5F6
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E3E647
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E3E707

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ErrorInfoLastLocale$_free$_abort
String ID:
API String ID: 2829624132-0
Opcode ID: dd0b9f506741543da5622fcfc5f41abf1245743ef3c7ced73a3ab2eb6ecee26b
Instruction ID: e107b9fdb009d6b25939eb344507d2212ca84a1de5da13a5b128d15f5f16eb63
Opcode Fuzzy Hash: dd0b9f506741543da5622fcfc5f41abf1245743ef3c7ced73a3ab2eb6ecee26b
Instruction Fuzzy Hash: 84619F719002179BEB289F24CC8ABBA7BE8EF14354F1050BAE805E66C1FB74D991DB50

Function 00E2BEA1 Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 00E2BF99
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 00E2BFA3
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00E2BFB0

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 13663ad7678159fe1685dde7876354cb64500e05f528d8eacd41c374d568a5ba
Instruction ID: 528ba4c32bd846904621a23dcf4562be5baca822c615f8e4883a4254bc07d728
Opcode Fuzzy Hash: 13663ad7678159fe1685dde7876354cb64500e05f528d8eacd41c374d568a5ba
Instruction Fuzzy Hash: 8331E57590122C9BCB21DF25EC8979DBBB8BF08310F5051EAE80CA7251E7709F858F45

Function 00E23070 Relevance: 4.6, APIs: 3, Instructions: 53COMMON

Download Yara Rule

APIs

LoadResource.KERNEL32(00000000,00000000,00000001,?,?,00E23038,00000000,?,00E1DC79,?,00E13851,00E58D1C,?,?,?,User cancelled operation.), ref: 00E2307B
LockResource.KERNEL32(00000000,00000000,?,00E23038,00000000,?,00E1DC79,?,00E13851,00E58D1C,?,?,?,User cancelled operation.), ref: 00E2308B
SizeofResource.KERNEL32(00000000,00000000,?,00E23038,00000000,?,00E1DC79,?,00E13851,00E58D1C,?,?,?,User cancelled operation.), ref: 00E23099

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Resource$LoadLockSizeof
String ID:
API String ID: 2853612939-0
Opcode ID: 01fe57cd7229666b29f3d1f528087e38541658f6feea0c77bcc3dc51a79cbc53
Instruction ID: aa66121c56366e4ad0f8e5733655ebf6b15834d10b117e76c54e5033cc22f6b0
Opcode Fuzzy Hash: 01fe57cd7229666b29f3d1f528087e38541658f6feea0c77bcc3dc51a79cbc53
Instruction Fuzzy Hash: 16018633A002355A8B302B7ABC48C66B7ACEBC2769305592AE94EE7110E6659D4586A0

Function 00E278E7 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A,?), ref: 00E27900

Strings

, xrefs: 00E27A5D

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-3916222277
Opcode ID: 14d2a73dc1c9adcb710d8276bec932af132b21d2ed99d8802920c23695ac89be
Instruction ID: bc88b8a5fd86e63516101d5f0215d8af1ba687a7b89bda45d3ce3f55213f1b32
Opcode Fuzzy Hash: 14d2a73dc1c9adcb710d8276bec932af132b21d2ed99d8802920c23695ac89be
Instruction Fuzzy Hash: 0441CFB19043159FDB18CF6AE886B9EBBF0FB44328F10956AD449F7390E3709944CB50

Function 00E380C7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,?,?,00000004), ref: 00E3811A

Strings

GetLocaleInfoEx, xrefs: 00E380E2

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: 0ea4be056159c9a97f7900ea0a7180dae5df66480a139bc5695ec48ab475da7b
Instruction ID: 9fd57eba36de5f9f664115404074bf69f7baa03ac2949381f93c640ca007125a
Opcode Fuzzy Hash: 0ea4be056159c9a97f7900ea0a7180dae5df66480a139bc5695ec48ab475da7b
Instruction Fuzzy Hash: 12F0CD31A4031CBBCB15AF61AC0AEAE7F65EB45B10F001214F8047A2A0DB719D12D695

Function 00E31F40 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc39df4cd66180675369183970220c78fccd5fb475e0f577b9f7cd68b5e7b421
Instruction ID: 78752380aaa1340f5e0748dedf68cee78bfd5d3230cedab69ba62da187bc667a
Opcode Fuzzy Hash: dc39df4cd66180675369183970220c78fccd5fb475e0f577b9f7cd68b5e7b421
Instruction Fuzzy Hash: 7E023C71E002199BDF18CFA9D8846AEBBF1FF88314F25916DD955F7284D731AA41CB80

Function 00E3884F Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00E3884A,?,?,00000008,?,?,00E42786,00000000), ref: 00E38A7C

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 9ebde651f31ac0a97ca4e1e1d11167af112cb572a07eabf942b9069547e4092f
Instruction ID: 843004824a14191f6f2f601493f5bae4e6cfdce8804febd5bccdeb5bb2015ac0
Opcode Fuzzy Hash: 9ebde651f31ac0a97ca4e1e1d11167af112cb572a07eabf942b9069547e4092f
Instruction Fuzzy Hash: 6BB15B312106098FD719CF28C58ABA57FE0FF45368F259659F899DF2A1CB35E981CB40

Function 00E3E7F2 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00E3502F: GetLastError.KERNEL32(?,?,00E2C109,?,00000000,?,00E2C5E9,?), ref: 00E35033
Part of subcall function 00E3502F: _free.LIBCMT ref: 00E35066
Part of subcall function 00E3502F: SetLastError.KERNEL32(00000000,?,00E2C5E9,?), ref: 00E350A7
Part of subcall function 00E3502F: _abort.LIBCMT ref: 00E350AD

Part of subcall function 00E3502F: _free.LIBCMT ref: 00E3508E
Part of subcall function 00E3502F: SetLastError.KERNEL32(00000000,?,00E2C5E9,?), ref: 00E3509B

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00E3E846

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ErrorLast$_free$InfoLocale_abort
String ID:
API String ID: 1663032902-0
Opcode ID: 16966edb83950bf1dcdcccb33dce2584d46ee98e1bbd9d7edc781a0b4a7cb79c
Instruction ID: d66022fde65b202ba373b32d71efa9b87113083043de7f901f5fa6ad2c2d150d
Opcode Fuzzy Hash: 16966edb83950bf1dcdcccb33dce2584d46ee98e1bbd9d7edc781a0b4a7cb79c
Instruction Fuzzy Hash: 8421C572900216ABDB289F24DC4ABBA7BE8EF04318F14117AF901F62C1EB359D44DB50

Function 00E3E47A Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E3502F: GetLastError.KERNEL32(?,?,00E2C109,?,00000000,?,00E2C5E9,?), ref: 00E35033
Part of subcall function 00E3502F: _free.LIBCMT ref: 00E35066
Part of subcall function 00E3502F: SetLastError.KERNEL32(00000000,?,00E2C5E9,?), ref: 00E350A7
Part of subcall function 00E3502F: _abort.LIBCMT ref: 00E350AD

EnumSystemLocalesW.KERNEL32(00E3E5A2,00000001,00000000,?,00E33B0B,?,00E3EBCF,00000000,?,?,?), ref: 00E3E4EC

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: ab22375054e4844288d0960d5653eb4779407994ad949381b033e0e3216f11c1
Instruction ID: 6b0c7449d6aa5f40090ad7812f8e98521ff73491627cdf82413d9d0f5f2c020d
Opcode Fuzzy Hash: ab22375054e4844288d0960d5653eb4779407994ad949381b033e0e3216f11c1
Instruction Fuzzy Hash: CD11C63B2007055FDB289F39D89557ABB92FB8435CF14482CE58697780E771B942CB40

Function 00E3EA22 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00E3502F: GetLastError.KERNEL32(?,?,00E2C109,?,00000000,?,00E2C5E9,?), ref: 00E35033
Part of subcall function 00E3502F: _free.LIBCMT ref: 00E35066
Part of subcall function 00E3502F: SetLastError.KERNEL32(00000000,?,00E2C5E9,?), ref: 00E350A7
Part of subcall function 00E3502F: _abort.LIBCMT ref: 00E350AD

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00E3E7C0,00000000,00000000,?), ref: 00E3EA4E

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ErrorLast$InfoLocale_abort_free
String ID:
API String ID: 2692324296-0
Opcode ID: 41c40e9151b9a4dfb6378c427857d6f02bcad0d42ae55d7395dde0b6aa09ef9f
Instruction ID: d216142fcddc64916e14a3ab33eed128b7315ce7efdef43379fd8cb3834fdf7a
Opcode Fuzzy Hash: 41c40e9151b9a4dfb6378c427857d6f02bcad0d42ae55d7395dde0b6aa09ef9f
Instruction Fuzzy Hash: 15F0F932A00115BBDB389A65880DABA7FA8FB40358F151429EC19B33C0EA71BE41C6D0

Function 00E3E515 Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E3502F: GetLastError.KERNEL32(?,?,00E2C109,?,00000000,?,00E2C5E9,?), ref: 00E35033
Part of subcall function 00E3502F: _free.LIBCMT ref: 00E35066
Part of subcall function 00E3502F: SetLastError.KERNEL32(00000000,?,00E2C5E9,?), ref: 00E350A7
Part of subcall function 00E3502F: _abort.LIBCMT ref: 00E350AD

EnumSystemLocalesW.KERNEL32(00E3E7F2,00000001,00000000,?,00E33B0B,?,00E3EB93,00E33B0B,?,?,?,?,?,00E33B0B,?,?), ref: 00E3E561

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 1aaab99cbb0cc55e7670cc5961eae5fe46f396443147578ed8626cf4a358202c
Instruction ID: 78a4e0c69125219995ceb65fd8d5ca286d24a8d3877cad9561994df52c956a10
Opcode Fuzzy Hash: 1aaab99cbb0cc55e7670cc5961eae5fe46f396443147578ed8626cf4a358202c
Instruction Fuzzy Hash: 86F0C2362003046FDB245F799C89A7A7F95FF8136CF05442DF946AB790E6B2AC42C650

Function 00E37CD4 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E31C64: EnterCriticalSection.KERNEL32(?,?,00E3468E,00000000,00E5B818,0000000C,00E34649,?,?,?,00E31D08,?,?,00E350E4,00000001,00000364), ref: 00E31C73

EnumSystemLocalesW.KERNEL32(00E37C8E,00000001,00E5B9B8,0000000C), ref: 00E37D0C

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: fb0438e6d3aa4e0a88d94f2c328e0308dd9400d91bc17f237d8a96495e1a83ec
Instruction ID: 72271e2b88778b5957514ac87d33cda236447bcba7bb43e6c981af40fd10b421
Opcode Fuzzy Hash: fb0438e6d3aa4e0a88d94f2c328e0308dd9400d91bc17f237d8a96495e1a83ec
Instruction Fuzzy Hash: 8AF08C76A14300AFD718EF78E84AB9D7BF0AB08321F115555F400FB2E1CA744A45CB01

Function 00E3E42F Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E3502F: GetLastError.KERNEL32(?,?,00E2C109,?,00000000,?,00E2C5E9,?), ref: 00E35033
Part of subcall function 00E3502F: _free.LIBCMT ref: 00E35066
Part of subcall function 00E3502F: SetLastError.KERNEL32(00000000,?,00E2C5E9,?), ref: 00E350A7
Part of subcall function 00E3502F: _abort.LIBCMT ref: 00E350AD

EnumSystemLocalesW.KERNEL32(00E3E386,00000001,00000000,?,?,00E3EBF1,00E33B0B,?,?,?,?,?,00E33B0B,?,?,?), ref: 00E3E466

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_abort_free
String ID:
API String ID: 1084509184-0
Opcode ID: 3f78845cfcde25a68adcfcda412499b8881be4df07206dd94e42909f43c65cc3
Instruction ID: 2d86715fca8f28869663e8d47846ea3a51248c50ccc5d772ff474f8b5b91cfc1
Opcode Fuzzy Hash: 3f78845cfcde25a68adcfcda412499b8881be4df07206dd94e42909f43c65cc3
Instruction Fuzzy Hash: A7F0553A30030857CB14AF35D80966ABF91EFC2754F0A4058EA099B391C6329842CB90

Function 00E27568 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00017574,00E26AC3), ref: 00E2756D

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 569593014f591fe3f1be368196dca169cf870886c665efd75272e6e5c12a75c0
Instruction ID: fe0136eddfd10dd110a73bd6c5bb0baf65049e8219a139c8a19455d1702a04a7
Opcode Fuzzy Hash: 569593014f591fe3f1be368196dca169cf870886c665efd75272e6e5c12a75c0
Instruction Fuzzy Hash:

Function 00E2D9F8 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 00E2DB68

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 4ba2a8a7f36c7eb8bea6061b4ddfb4ddc7e8adf73049128e6dbb7d3d5ac20edd
Instruction ID: b9083b80d15e4cfa832c3c3b5900379972cfecdfff93885a227016554adf39b9
Opcode Fuzzy Hash: 4ba2a8a7f36c7eb8bea6061b4ddfb4ddc7e8adf73049128e6dbb7d3d5ac20edd
Instruction Fuzzy Hash: ED5188E120C67447DF398A68BC66FFE23D99B52308F183909E782FB282C911DE418352

Function 00E3A256 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 00E3A256

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 2a2bb223f6eac89c1ddde86a1f270f66f6e8dd185ad5785ae049597729783b4e
Instruction ID: d16cccf0191f1279f735929d05efa8f08bd4bb247101cc55db74accb5cd38979
Opcode Fuzzy Hash: 2a2bb223f6eac89c1ddde86a1f270f66f6e8dd185ad5785ae049597729783b4e
Instruction Fuzzy Hash: 8DA01130A00300CF8B288F32AE082083AA8AB0A282B000828A808E0220EB3080088B02

Function 00E3A699 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04e11e6e544f349160c660b3edc6670610a69e5dcd229c1e5b8657160663a920
Instruction ID: 4ada6ccd3273f50c0822dc4e8558fa37dd54d4bddf5033bf3205562360453e19
Opcode Fuzzy Hash: 04e11e6e544f349160c660b3edc6670610a69e5dcd229c1e5b8657160663a920
Instruction Fuzzy Hash: CB323921D6AF014DD7635635C826335A658AFB73C8F25E737F816B6EA6EB28C4C38101

Function 00E2AAA6 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction ID: e12a07d47bdb7952a8dec9a01c817e3904ad9cacec4ba211a3ca4152a6cf47ad
Opcode Fuzzy Hash: bf6ffcbe3773841c348058a39a16573d3b2338b254e5945c46ce03dce2746f28
Instruction Fuzzy Hash: CFC1A1722050734BDB2D463AA43453EFBA15BA2BB531E277ED8B2DB0C0EF24C564D621

Function 00E2AEDB Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction ID: c039c79790a2a5faaa132d2e69d9985fa451f1985527efe7a446b3f166ee0f95
Opcode Fuzzy Hash: a635e2a33a60bcf8d734eac2a911e111534612f0cd64c6a362f1e57f4f360174
Instruction Fuzzy Hash: E7C1A5732051B34ADF2D463AA43453FBBA15BA2BB531E276ED8B2DB0D4EF14C524D620

Function 00E2A671 Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: b952f242f0ad7f08662c84d0fa087f96bdb8d5a3ddbe034f8d4093e1b31245b1
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: ACC1A1732051A34BDB2D463AA43453EBBA15BA2BB531E277ED8B3DB0C0EF14C564D611

Function 00E2A259 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 98cdaac03ea5f86600567ca2f0375b6e577ecb352dda6236c47a654a70c13205
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: 2DC191732050B34BDB2D463AA43453EBBA15BA1BB531E277ED8B2DB0D4EF14C5249621

Function 00E2DC27 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4aa451625d7c6826b2554ee4b37edd7766840e2e360f9811224ab490f60497f4
Instruction ID: caaf855679e64cb2ab66381bd42afa63732d66aecfb65f82334b6bf5d026d1a4
Opcode Fuzzy Hash: 4aa451625d7c6826b2554ee4b37edd7766840e2e360f9811224ab490f60497f4
Instruction Fuzzy Hash: EB617CB164CB3856DA385A28BC97BFEA3D4EB41308F10761AEB42FF281D6919D41C355

Function 00E29CB0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: f3dbbe3b3bb9132606cd36f40d0b37a71c54d00fb5b106bce087b7920606054a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 4A11087B2001B243D614862DF4F46B6E795EAC5328F2C727AD0426B75ED622E945BA00

Function 00E17E30 Relevance: 79.2, APIs: 26, Strings: 19, Instructions: 475registryfilewindowCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\ReSound\Aventa3,00000000,00020019,?), ref: 00E17ED8
RegQueryValueExW.ADVAPI32(?,MarketPatchKey,00000000,?,?,?), ref: 00E17F2D
wsprintfW.USER32 ref: 00E1800C
wsprintfW.USER32 ref: 00E17F4E

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

wsprintfW.USER32 ref: 00E18020
wsprintfW.USER32 ref: 00E18039
RegCloseKey.ADVAPI32(?,?), ref: 00E18052
wsprintfW.USER32 ref: 00E181C1
wsprintfW.USER32 ref: 00E1827D
RegSetValueExW.ADVAPI32(?,MarketPatchKey,00000000,00000001,00E58D1C,00000002), ref: 00E18323
RegCloseKey.ADVAPI32(?,Failed to reset MarketPatchKey registry value), ref: 00E18345
PathFileExistsW.SHLWAPI(?), ref: 00E18364
wsprintfW.USER32 ref: 00E18381
wsprintfW.USER32 ref: 00E18395
CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000001,00000080,00000000,?,?,?,Failed to reset MarketPatchKey registry value), ref: 00E183C1
GetLastError.KERNEL32(?,?,Failed to reset MarketPatchKey registry value), ref: 00E183CC
FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,?,?,Failed to reset MarketPatchKey registry value), ref: 00E183EA
CloseHandle.KERNEL32(00000000,?,?,Failed to reset MarketPatchKey registry value), ref: 00E183F9
PathFileExistsW.SHLWAPI(?,Legacy File created successfully,?,?,Failed to reset MarketPatchKey registry value), ref: 00E18430
wsprintfW.USER32 ref: 00E1844D
wsprintfW.USER32 ref: 00E18461
CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000001,00000080,00000000,?), ref: 00E1848D
GetLastError.KERNEL32 ref: 00E18498
FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 00E184B6
CloseHandle.KERNEL32(00000000), ref: 00E184C5
RegCloseKey.ADVAPI32(?,Legacy File created successfully,?,?,Failed to reset MarketPatchKey registry value), ref: 00E184DC

Strings

Creating szMarketSmartTagFilename: %s, xrefs: 00E1845B
szMarketSmartTagFilename: %s, xrefs: 00E18277
Failed to reset MarketPatchKey registry value, xrefs: 00E18334
Legacy File created successfully, xrefs: 00E183FF
MarketPatchKeyRegValue found: %s, xrefs: 00E17F48
szMarketTagFilename already there: %s, xrefs: 00E1837B
File created successfully, xrefs: 00E184CB
MarketPatchKeyRegValue not found. dwRes=%lu, xrefs: 00E1801A
ReSound\SmartFit\, xrefs: 00E181FB
szMarketTagFilename: %s, xrefs: 00E18006, 00E181BB
SOFTWARE\ReSound\Aventa3, xrefs: 00E17ECE, 00E18028
.Aventa, xrefs: 00E17FE6, 00E1819B
szMarketSmartTagFilename already there: %s, xrefs: 00E18447
.SmartFit, xrefs: 00E18257
Creating szMarketTagFilename: %s, xrefs: 00E1838F
ReSound\Aventa\, xrefs: 00E17FAC, 00E1813F
MarketPatchKey, xrefs: 00E17F22, 00E1831D
MarketPatchKey registry value reset successfully, xrefs: 00E1832D
Brand registry key not found or could not open: 'HKLM\%s'. dwRes=%lu, xrefs: 00E18033

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: wsprintf$Close$File$CreateErrorExistsFormatHandleLastMessagePathValue$LocalOpenQueryTime
String ID: .Aventa$.SmartFit$Brand registry key not found or could not open: 'HKLM\%s'. dwRes=%lu$Creating szMarketSmartTagFilename: %s$Creating szMarketTagFilename: %s$Failed to reset MarketPatchKey registry value$File created successfully$Legacy File created successfully$MarketPatchKey$MarketPatchKey registry value reset successfully$MarketPatchKeyRegValue found: %s$MarketPatchKeyRegValue not found. dwRes=%lu$ReSound\Aventa\$ReSound\SmartFit\$SOFTWARE\ReSound\Aventa3$szMarketSmartTagFilename already there: %s$szMarketSmartTagFilename: %s$szMarketTagFilename already there: %s$szMarketTagFilename: %s
API String ID: 2277721569-2322944706
Opcode ID: 50473b3c5c3404e4a15356c42dc1c94a3041623d277665c5dec00b9944c3ac85
Instruction ID: 355eb921dd678d985399b3a8c887e29ab3f0bc39026e6fea91757f0421b1365c
Opcode Fuzzy Hash: 50473b3c5c3404e4a15356c42dc1c94a3041623d277665c5dec00b9944c3ac85
Instruction Fuzzy Hash: D202F9B5A41318ABDB20DB60CD46FDA73BCAF05704F049595F909F61C0DB74AA89CFA1

Function 00E19D60 Relevance: 54.6, APIs: 15, Strings: 16, Instructions: 378windowfileCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00E19DBD

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

wsprintfW.USER32 ref: 00E19FAD
wsprintfW.USER32 ref: 00E1A098
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?), ref: 00E1A104
DeleteFileW.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00E1A115
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 00E1A11F
FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 00E1A13D
MessageBoxW.USER32(00000000,Invalid key for Legacy De-Activation. Look at the log file (%TEMP%PatchInstaller.log) for more details.,De-Activation,00000010), ref: 00E1A1B0
PathFileExistsW.SHLWAPI(?), ref: 00E1A1DC
DeleteFileW.KERNEL32(?), ref: 00E1A1F1
GetLastError.KERNEL32 ref: 00E1A1FB
FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 00E1A219
MessageBoxW.USER32(00000000,De-Activation completed successfully.,De-Activation,00000040), ref: 00E1A24F
MessageBoxW.USER32(00000000,De-Activation did not complete successfully. Look at the log file (%TEMP%PatchInstaller.log) for more details.,De-Activation,00000040), ref: 00E1A260

Strings

De-Activation did not complete successfully. Look at the log file (%TEMP%PatchInstaller.log) for more details., xrefs: 00E1A259
szMarketSmartTagFilename: %s, xrefs: 00E1A092
Error: invalid Key for Legacy De-Activation., xrefs: 00E1A18D
Legacy De-Activation completed successfully., xrefs: 00E1A153, 00E1A173
DeActivation invoked with switch '%s', xrefs: 00E19DB7
Legacy De-Activation did not complete successfully. Look at the log file (%TEMP%PatchInstaller.log) for more details., xrefs: 00E1A17A
ReSound\SmartFit\, xrefs: 00E1A01B
De-Activation, xrefs: 00E1A16A, 00E1A1A4, 00E1A240, 00E1A285
szMarketTagFilename: %s, xrefs: 00E19FA7
Invalid key for De-Activation. Look at the log file (%TEMP%PatchInstaller.log) for more details., xrefs: 00E1A28A
.Aventa, xrefs: 00E19F87
De-Activation completed successfully., xrefs: 00E1A229, 00E1A249
Error: invalid Key for De-Activation., xrefs: 00E1A26E
.SmartFit, xrefs: 00E1A072
Invalid key for Legacy De-Activation. Look at the log file (%TEMP%PatchInstaller.log) for more details., xrefs: 00E1A1A9
ReSound\Aventa\, xrefs: 00E19F29

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Message$File$wsprintf$DeleteErrorExistsFormatLastPath$LocalTime
String ID: .Aventa$.SmartFit$De-Activation$De-Activation completed successfully.$De-Activation did not complete successfully. Look at the log file (%TEMP%PatchInstaller.log) for more details.$DeActivation invoked with switch '%s'$Error: invalid Key for De-Activation.$Error: invalid Key for Legacy De-Activation.$Invalid key for De-Activation. Look at the log file (%TEMP%PatchInstaller.log) for more details.$Invalid key for Legacy De-Activation. Look at the log file (%TEMP%PatchInstaller.log) for more details.$Legacy De-Activation completed successfully.$Legacy De-Activation did not complete successfully. Look at the log file (%TEMP%PatchInstaller.log) for more details.$ReSound\Aventa\$ReSound\SmartFit\$szMarketSmartTagFilename: %s$szMarketTagFilename: %s
API String ID: 3902050073-1805068752
Opcode ID: 0451bc55ab0bf17732968568aaec7a45adcb6deab7a924c0f549de288916da68
Instruction ID: 52fa67788982d052f97e2cd6e2c9e71c64bf7f661fa2770ab2e5d074f7afb9f9
Opcode Fuzzy Hash: 0451bc55ab0bf17732968568aaec7a45adcb6deab7a924c0f549de288916da68
Instruction Fuzzy Hash: 2BD118B1B41318ABDB20DB64CC46FE9B3B8AF05704F0455A4F906B75D1EBB06E89CB91

Function 00E1ADF0 Relevance: 49.3, APIs: 2, Strings: 26, Instructions: 261COMMON

Download Yara Rule

Strings

Noah4 found, xrefs: 00E1AE42
VCRedist Installation: A restart is required to complete the installation. This message indicates success (3010)., xrefs: 00E1B03D
VA build running, skip pre-requisites check as we don't include prereq folder with VA and InstallShield will install if needed., xrefs: 00E1AEDA
.NET8 Installation: A restart is required to complete the installation. This message indicates success (1641)., xrefs: 00E1B0E5
.NET 8 x86 desktop registry value found. Skipping installation., xrefs: 00E1AF90
VCRedist Installation: A restart is required to complete the installation. This message indicates success (1641)., xrefs: 00E1B044
.NET8 Installation: A restart is required to complete the installation. This message indicates success (3010)., xrefs: 00E1B12E
VCRedist Installation: Installer executable file not found (2)., xrefs: 00E1AFCC
.NET8 Installation completed successfully., xrefs: 00E1B0C8
Microsoft Visual C++ 2015-2019 runtime installation seem to have installed successfully., xrefs: 00E1AFDF, 00E1B033, 00E1B057
VCRedist Installation completed successfully., xrefs: 00E1AFD3
.NET8 Installation: Installer executable file not found (2)., xrefs: 00E1B0C1
.NET8 Installation: The user's computer does not meet system requirements (5100)., xrefs: 00E1B127
Microsoft Visual C++ 2015-2019 runtime v14.22 or higher not detected., xrefs: 00E1AEFC
VCRedist Installation: The user canceled installation (1602)., xrefs: 00E1AF69
.NET8 Installation: The user canceled installation (1602)., xrefs: 00E1B0CF
.NET8 Installation: Unknown Error (%d), xrefs: 00E1B108
Noah3 found, xrefs: 00E1AE52
VCRedist Installation: A fatal error occurred during installation (1603)., xrefs: 00E1AFE6
VCRedist Installation: Unknown Error (%d), xrefs: 00E1B00C
Microsoft Visual C++ 2015-2019 runtime installation seem to have failed. Reinstall Microsoft Visual C++ 2015-2019 x86 runtime if n, xrefs: 00E1AF75
Noah not found, xrefs: 00E1AE69
.NET8 Installation: A fatal error occurred during installation (1603)., xrefs: 00E1B0DE
.NET8 Installation: Internal state failure (5101)., xrefs: 00E1B120
VCRedist Installation: A newer versions is already installed (5100)., xrefs: 00E1B027
.NET 8 x86 was not detected., xrefs: 00E1B061

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ConditionMask$HandleInfoLoadModuleStringVerifyVersion
String ID: .NET 8 x86 desktop registry value found. Skipping installation.$.NET 8 x86 was not detected.$.NET8 Installation completed successfully.$.NET8 Installation: A fatal error occurred during installation (1603).$.NET8 Installation: A restart is required to complete the installation. This message indicates success (1641).$.NET8 Installation: A restart is required to complete the installation. This message indicates success (3010).$.NET8 Installation: Installer executable file not found (2).$.NET8 Installation: Internal state failure (5101).$.NET8 Installation: The user canceled installation (1602).$.NET8 Installation: The user's computer does not meet system requirements (5100).$.NET8 Installation: Unknown Error (%d)$Microsoft Visual C++ 2015-2019 runtime installation seem to have failed. Reinstall Microsoft Visual C++ 2015-2019 x86 runtime if n$Microsoft Visual C++ 2015-2019 runtime installation seem to have installed successfully.$Microsoft Visual C++ 2015-2019 runtime v14.22 or higher not detected.$Noah not found$Noah3 found$Noah4 found$VA build running, skip pre-requisites check as we don't include prereq folder with VA and InstallShield will install if needed.$VCRedist Installation completed successfully.$VCRedist Installation: A fatal error occurred during installation (1603).$VCRedist Installation: A newer versions is already installed (5100).$VCRedist Installation: A restart is required to complete the installation. This message indicates success (1641).$VCRedist Installation: A restart is required to complete the installation. This message indicates success (3010).$VCRedist Installation: Installer executable file not found (2).$VCRedist Installation: The user canceled installation (1602).$VCRedist Installation: Unknown Error (%d)
API String ID: 2744954590-3324553952
Opcode ID: 4ccf8405be25694edd1f64719225dbd7dd157c936b4cbfd22e2be633aa021d93
Instruction ID: 410f1af30f9b1b3252e7fe18d9db7f6cf84df596c32deb8cbfac15ef50d60d5f
Opcode Fuzzy Hash: 4ccf8405be25694edd1f64719225dbd7dd157c936b4cbfd22e2be633aa021d93
Instruction Fuzzy Hash: F981AB7174A300A6DB30A7349C16BFE7296AF48718F083969F856772C2DBA559C9C383

Function 00E14910 Relevance: 42.4, APIs: 5, Strings: 19, Instructions: 402windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

Part of subcall function 00E139A0: #70.MSI(?,VersionMajor,?), ref: 00E13A9B
Part of subcall function 00E139A0: #70.MSI(?,VersionMinor,?,?), ref: 00E13ABB
Part of subcall function 00E139A0: #70.MSI(?,Version,?,?), ref: 00E13ADB
Part of subcall function 00E139A0: #70.MSI(?,VersionString,?,?), ref: 00E13AFB

Part of subcall function 00E1A560: wsprintfW.USER32 ref: 00E1A5CB

Part of subcall function 00E12390: GetProcessHeap.KERNEL32(?), ref: 00E123BC
Part of subcall function 00E12390: __Init_thread_footer.LIBCMT ref: 00E123E7
Part of subcall function 00E12390: __Init_thread_footer.LIBCMT ref: 00E12465

wsprintfW.USER32 ref: 00E14AF2

Part of subcall function 00E25100: __CxxThrowException@8.LIBVCRUNTIME ref: 00E25112

wsprintfW.USER32 ref: 00E14B23

Part of subcall function 00E11FB0: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,00000044,?), ref: 00E12067
Part of subcall function 00E11FB0: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,00001CFF), ref: 00E1208A
Part of subcall function 00E11FB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00E120A7
Part of subcall function 00E11FB0: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,00001CFF), ref: 00E120CA
Part of subcall function 00E11FB0: GetExitCodeProcess.KERNEL32(?,00000000), ref: 00E120D7
Part of subcall function 00E11FB0: CloseHandle.KERNEL32(?,?,00000000,00000000,00000001,00000020,00000000,00000000,00000044,?), ref: 00E120F7
Part of subcall function 00E11FB0: CloseHandle.KERNEL32(?,?,00000000,00000000,00000001,00000020,00000000,00000000,00000044,?), ref: 00E120FC

wsprintfW.USER32 ref: 00E14BAF
wsprintfW.USER32 ref: 00E14D23
MessageBoxW.USER32(00000000,?,?,00000030), ref: 00E14DFA

Strings

COUNTRY, xrefs: 00E14AC9, 00E14AFA
Legacy Ratatosk db may have not been copied properly., xrefs: 00E14C72
szCopyFileStatus: %s, xrefs: 00E14D1D
_fswRemoveF.log, xrefs: 00E14A8F
%s /update "%s" %s="%s" %s="%s" /l*v "%s" , xrefs: 00E14B1D
MsiExec.Exe, xrefs: 00E14AE1, 00E14B12
MSIExec Launch call succeeded., xrefs: 00E14B75
MEDIATYPE, xrefs: 00E14AC3
PATCHSOURCE, xrefs: 00E14AD5, 00E14B06
%s /update "%s" %s="%s" %s="%s" %s="%s" /l*v "%s" , xrefs: 00E14AEC
MSIExec Invoke ExitCode: %lu, xrefs: 00E14BA9
Ratatosk db may have not been copied properly., xrefs: 00E14C91
Common Patch files may have not been copied properly., xrefs: 00E14CAE
Some Market files may have not been copied properly., xrefs: 00E14C53
Missing Patch files may have not been copied properly., xrefs: 00E14CCB
Do Patch Install..., xrefs: 00E1494A
/qn, xrefs: 00E14B31
MSIExec Launch call failed., xrefs: 00E14B7C
WEB, xrefs: 00E14ABE

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: wsprintf$Process$CloseHandleInit_thread_footerMessageMultipleObjectsWait$CodeCreateException@8ExitHeapLocalPeekThrowTime
String ID: %s /update "%s" %s="%s" %s="%s" %s="%s" /l*v "%s" $%s /update "%s" %s="%s" %s="%s" /l*v "%s" $/qn$COUNTRY$Common Patch files may have not been copied properly.$Do Patch Install...$Legacy Ratatosk db may have not been copied properly.$MEDIATYPE$MSIExec Invoke ExitCode: %lu$MSIExec Launch call failed.$MSIExec Launch call succeeded.$Missing Patch files may have not been copied properly.$MsiExec.Exe$PATCHSOURCE$Ratatosk db may have not been copied properly.$Some Market files may have not been copied properly.$WEB$_fswRemoveF.log$szCopyFileStatus: %s
API String ID: 1119058580-2985922655
Opcode ID: 119a4c5de1a11e02955e3c88c2ae9ffb572e7cd2a226b15a318e2756a1a84e35
Instruction ID: 034c4e0faf3d8299d5d29f97e65affa4d1ed3d008793a89ba55518c6f9170523
Opcode Fuzzy Hash: 119a4c5de1a11e02955e3c88c2ae9ffb572e7cd2a226b15a318e2756a1a84e35
Instruction Fuzzy Hash: 90F192B1900318ABDB21DB24CC55BD9B7ECAF04314F0495E9F919B72D2DA709F898F90

Function 00E17130 Relevance: 35.2, APIs: 12, Strings: 8, Instructions: 242memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

Part of subcall function 00E24E90: SysFreeString.OLEAUT32(00000000), ref: 00E24EE6

SysAllocString.OLEAUT32(name), ref: 00E17244
VariantCopy.OLEAUT32(?,00000000), ref: 00E17273
SysFreeString.OLEAUT32(00000000), ref: 00E17286
SysAllocString.OLEAUT32(destpath), ref: 00E1728D
VariantCopy.OLEAUT32(?,00000000), ref: 00E172BC
SysFreeString.OLEAUT32(00000000), ref: 00E172CF
SysAllocString.OLEAUT32(dest), ref: 00E172D6
VariantCopy.OLEAUT32(?,00000000), ref: 00E17308
SysFreeString.OLEAUT32(00000000), ref: 00E1731B
VariantClear.OLEAUT32(?), ref: 00E17359
VariantClear.OLEAUT32(?), ref: 00E1735F
VariantClear.OLEAUT32(00000000), ref: 00E17365

Strings

No files specified to copy..., xrefs: 00E1741E
File candidate(s) to Copy found..., xrefs: 00E171CF
name, xrefs: 00E1723B
CopyMissingPatchFiles...., xrefs: 00E1715A
PatchMissingFiles/PatchMissingFile, xrefs: 00E1718F
dest, xrefs: 00E172D1
Getting file(s) to Copy..., xrefs: 00E17183
destpath, xrefs: 00E17288

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: String$Variant$Free$AllocClearCopy$LocalTime
String ID: CopyMissingPatchFiles....$File candidate(s) to Copy found...$Getting file(s) to Copy...$No files specified to copy...$PatchMissingFiles/PatchMissingFile$dest$destpath$name
API String ID: 784096192-4131843049
Opcode ID: 975538eabc48245a9422e24f9a26321a59dde911f7bfeb3f11e4dd54a20a9373
Instruction ID: 2c0854be6c8c42bfb83d5922978f865e86a78ed447cc0bfbfe595dd426d45956
Opcode Fuzzy Hash: 975538eabc48245a9422e24f9a26321a59dde911f7bfeb3f11e4dd54a20a9373
Instruction Fuzzy Hash: F991CF70A05359EFDF14DBA4C884BEEBBB8EF09708F141059E802B7291DB709985CBA1

Function 00E16E30 Relevance: 35.2, APIs: 12, Strings: 8, Instructions: 242memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

Part of subcall function 00E24E90: SysFreeString.OLEAUT32(00000000), ref: 00E24EE6

SysAllocString.OLEAUT32(name), ref: 00E16F44
VariantCopy.OLEAUT32(?,00000000), ref: 00E16F73
SysFreeString.OLEAUT32(00000000), ref: 00E16F86
SysAllocString.OLEAUT32(destpath), ref: 00E16F8D
VariantCopy.OLEAUT32(?,00000000), ref: 00E16FBC
SysFreeString.OLEAUT32(00000000), ref: 00E16FCF
SysAllocString.OLEAUT32(dest), ref: 00E16FD6
VariantCopy.OLEAUT32(?,00000000), ref: 00E17008
SysFreeString.OLEAUT32(00000000), ref: 00E1701B
VariantClear.OLEAUT32(?), ref: 00E17059
VariantClear.OLEAUT32(?), ref: 00E1705F
VariantClear.OLEAUT32(00000000), ref: 00E17065

Strings

File(s) to Copy found, xrefs: 00E16ECF
No files specified to copy..., xrefs: 00E1711E
name, xrefs: 00E16F3B
Files/File, xrefs: 00E16E8F
dest, xrefs: 00E16FD1
Getting file(s) to Copy..., xrefs: 00E16E83
destpath, xrefs: 00E16F88
CopyCommonPatchFiles...., xrefs: 00E16E5A

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: String$Variant$Free$AllocClearCopy$LocalTime
String ID: CopyCommonPatchFiles....$File(s) to Copy found$Files/File$Getting file(s) to Copy...$No files specified to copy...$dest$destpath$name
API String ID: 784096192-2524250316
Opcode ID: 9aacf7d9eba422f6d8c1f5dd6cb1d2ec2a54bff7aa9217f19316f747a539d93c
Instruction ID: 2f4f87f08e1d9b178d05334f443176d971855aef34923330ed201b389dcc0974
Opcode Fuzzy Hash: 9aacf7d9eba422f6d8c1f5dd6cb1d2ec2a54bff7aa9217f19316f747a539d93c
Instruction Fuzzy Hash: 0A91CD70A05349EFDF14DBA4C854BEEBBB8EF09708F145059E802B7291DB709E85CBA1

Function 00E144C0 Relevance: 26.5, APIs: 6, Strings: 9, Instructions: 282windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

wsprintfW.USER32 ref: 00E14560
GetLastError.KERNEL32 ref: 00E1458A
FormatMessageW.KERNEL32(000013FF,00000000,?,00000400,?,00000000,00000000), ref: 00E145AA

Strings

GNWeb Launch ExitCode: %lu, xrefs: 00E148CC
%s /P /K "%s" /U "%s" /B "%s" /E "%s" /T "%s" /I "%s" /M "%s" /V "%s" , xrefs: 00E14848
Invoking GNWeb..., xrefs: 00E14510
GNWeb Launch call failed., xrefs: 00E14899
GNWeb.exe, xrefs: 00E147C4
GNWeb Launch call succeeded., xrefs: 00E1488D
_gnWeb.log, xrefs: 00E146C9
Analytics, xrefs: 00E14769
%lu, xrefs: 00E1455A

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ErrorFormatLastLocalMessageTimewsprintf
String ID: %lu$%s /P /K "%s" /U "%s" /B "%s" /E "%s" /T "%s" /I "%s" /M "%s" /V "%s" $Analytics$GNWeb Launch ExitCode: %lu$GNWeb Launch call failed.$GNWeb Launch call succeeded.$GNWeb.exe$Invoking GNWeb...$_gnWeb.log
API String ID: 4153586964-4153175164
Opcode ID: 94981b540f6c99405daeaa3365db8d2d9d25df19a833b5071fd9ecca604ee0ab
Instruction ID: b5a6474e27849f0a4744fa52a87969c18e086b34c3d29456e3ec319218cda8d7
Opcode Fuzzy Hash: 94981b540f6c99405daeaa3365db8d2d9d25df19a833b5071fd9ecca604ee0ab
Instruction Fuzzy Hash: AAB196B1940218AADB20DB60DC46FDAB7FDAF04704F0095A5F609B72C1D771AB99CFA4

Function 00E1AC90 Relevance: 26.4, APIs: 4, Strings: 11, Instructions: 115registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86,00000000,00020019,F9744ECF,F9744ECF,?,?,?,00E1AEF4,?,Noah not found,F9744ECF,?,?,?), ref: 00E1ACE4
RegQueryValueExW.ADVAPI32(F9744ECF,Installed,00000000,F9744ECF,?,?,?,?,00E1AEF4), ref: 00E1AD16
RegQueryValueExW.ADVAPI32(F9744ECF,Major,00000000,00E1AEF4,00000004,00000004,?,?,00E1AEF4), ref: 00E1AD56

Part of subcall function 00E25720: RegQueryValueExW.ADVAPI32(00000004,?,00000000,00000004,00000004,?,00000004,?,00E1AD86,Minor,00000004), ref: 00E2573D

RegCloseKey.ADVAPI32(00000000,Error Reading VCRedist registry value named Installed under HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86,?,?,00E1AEF4,?,Noah not found,F9744ECF,?,?,?), ref: 00E1ADD3

Strings

SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86, xrefs: 00E1ACD4
Major, xrefs: 00E1AD50
Error Reading VCRedist registry value named Major under HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86, xrefs: 00E1ADBB
Major version is less than 14 under HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86, xrefs: 00E1ADB4
Error Reading VCRedist registry value named Minor under HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86, xrefs: 00E1ADA2
Installed, xrefs: 00E1AD10
Minor version of 21 or lower reported., xrefs: 00E1AD9B
Minor version of 22 or higher reported. No need to install newer VC runtime., xrefs: 00E1AD94
Minor, xrefs: 00E1AD79
VC runtime version higher than 14 found under 14 key. Allow running redist as it will skip if this is a valid future version., xrefs: 00E1ADAD
Error Reading VCRedist registry value named Installed under HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86, xrefs: 00E1ADC2

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Error Reading VCRedist registry value named Installed under HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86$Error Reading VCRedist registry value named Major under HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86$Error Reading VCRedist registry value named Minor under HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86$Installed$Major$Major version is less than 14 under HKLM\SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86$Minor$Minor version of 21 or lower reported.$Minor version of 22 or higher reported. No need to install newer VC runtime.$SOFTWARE\Microsoft\VisualStudio\14.0\VC\Runtimes\x86$VC runtime version higher than 14 found under 14 key. Allow running redist as it will skip if this is a valid future version.
API String ID: 1586453840-1800911297
Opcode ID: 6c55b5d40f0e5e3b8a91bdef0fbd7e12fd96e27375c734c2cc0dc3dd277d0c96
Instruction ID: dd547c0639e3255021951154aa6ac9b0ec2db816827c4e099c7555e09a34482d
Opcode Fuzzy Hash: 6c55b5d40f0e5e3b8a91bdef0fbd7e12fd96e27375c734c2cc0dc3dd277d0c96
Instruction Fuzzy Hash: CC41B3B5A417099ACB20CF41DC41BFFBBB8FB4570AF94152AE901F3680D77059498BA2

Function 00E1B4B0 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 157registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7A22ED05-ABD2-4A20-9C34-51416E5823BD},00000000,00020019,?), ref: 00E1B517
RegCloseKey.ADVAPI32(00000000), ref: 00E1B52C
GetFileAttributesW.KERNEL32(?,ModuleAPI proxy uninstall registry key not found; installing...), ref: 00E1B563
PathQuoteSpacesW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00E1B62A
wsprintfW.USER32 ref: 00E1B6BD

Strings

InvokeModuleApiProxyInstall..., xrefs: 00E1B4C9
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7A22ED05-ABD2-4A20-9C34-51416E5823BD}, xrefs: 00E1B50D
/v/qb, xrefs: 00E1B65F
Prereq\Himsa\ModuleAPIProxy Install.exe, xrefs: 00E1B60A
/S /v/qn, xrefs: 00E1B658
ModuleAPI Invoke ExitCode: %lu, xrefs: 00E1B6B7
ModuleAPI proxy uninstall registry key found in registry; skipping install..., xrefs: 00E1B532
ModuleAPI proxy uninstall registry key not found; installing..., xrefs: 00E1B550

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: AttributesCloseFileLocalOpenPathQuoteSpacesTimewsprintf
String ID: /S /v/qn$/v/qb$InvokeModuleApiProxyInstall...$ModuleAPI Invoke ExitCode: %lu$ModuleAPI proxy uninstall registry key found in registry; skipping install...$ModuleAPI proxy uninstall registry key not found; installing...$Prereq\Himsa\ModuleAPIProxy Install.exe$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7A22ED05-ABD2-4A20-9C34-51416E5823BD}
API String ID: 1467927168-2515610524
Opcode ID: 92ee594c240dc043eebb36e145aa03b9d5ce54eafa6568972ac1eca717708647
Instruction ID: 6ee83d121c0d0f662a1c5a076387f72e26506857823bb08c9cb539560a9dcbc2
Opcode Fuzzy Hash: 92ee594c240dc043eebb36e145aa03b9d5ce54eafa6568972ac1eca717708647
Instruction Fuzzy Hash: D351E4B5A00218A6DB24EB60DC06FE973A9EF04705F449895FA49B21C1EF706BCDCBD4

Function 00E1A2C0 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 114registryCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00E1A326

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

RegCreateKeyExW.ADVAPI32(80000002,Software\Policies\Microsoft\Windows\Installer,00000000,00000000,00000000,000F003F,00000000,?,?,?), ref: 00E1A362
RegSetValueExW.ADVAPI32(?,SecureRepairPolicy,00000000,00000004,?,00000004), ref: 00E1A3CA
RegCloseKey.ADVAPI32(?), ref: 00E1A3D6
RegCreateKeyExW.ADVAPI32(80000002,Software\Policies\Microsoft\Windows\Installer\SecureRepairWhiteList,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 00E1A401
RegSetValueExW.ADVAPI32(?,?,00000000,00000001,00000000,00000000), ref: 00E1A439
RegCloseKey.ADVAPI32(?), ref: 00E1A445

Strings

SecureRepairPolicy, xrefs: 00E1A3BF
RegCreateKeyEx failed creating Windows Installer key, xrefs: 00E1A378
Software\Policies\Microsoft\Windows\Installer\SecureRepairWhiteList, xrefs: 00E1A3F7
RegCreateKeyEx failed creating SecureRepairWhiteList key, xrefs: 00E1A417
Software\Policies\Microsoft\Windows\Installer, xrefs: 00E1A358
CreateWhiteListEntries with ProductCode '%s', xrefs: 00E1A320

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: CloseCreateValue$LocalTimewsprintf
String ID: CreateWhiteListEntries with ProductCode '%s'$RegCreateKeyEx failed creating SecureRepairWhiteList key$RegCreateKeyEx failed creating Windows Installer key$SecureRepairPolicy$Software\Policies\Microsoft\Windows\Installer$Software\Policies\Microsoft\Windows\Installer\SecureRepairWhiteList
API String ID: 1290931165-1234784166
Opcode ID: a941179f01017506cafe3f7f2280fe7e0a57b8047cd7aa358834c9210dd8f334
Instruction ID: 13680a4afaf41949d27c734ac019d2c9f5647337ab323d8a9d9e3afcb7d9813c
Opcode Fuzzy Hash: a941179f01017506cafe3f7f2280fe7e0a57b8047cd7aa358834c9210dd8f334
Instruction Fuzzy Hash: 6141A575A40318BBDB309B50EC4AFAE77B9EB09B00F101095F605B61D0D7B16A89CF55

Function 00E31543 Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E315B3
_free.LIBCMT ref: 00E315C9
_free.LIBCMT ref: 00E315DA
_free.LIBCMT ref: 00E315EB
_free.LIBCMT ref: 00E31602
GetCPInfo.KERNEL32(?,?), ref: 00E3164A

Part of subcall function 00E393A0: _free.LIBCMT ref: 00E3940B

_free.LIBCMT ref: 00E317F6
_free.LIBCMT ref: 00E31809
_free.LIBCMT ref: 00E31817
_free.LIBCMT ref: 00E31822
_free.LIBCMT ref: 00E31864
_free.LIBCMT ref: 00E3186C
_free.LIBCMT ref: 00E31874
_free.LIBCMT ref: 00E3187C
_free.LIBCMT ref: 00E3188A

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 15543300dc5fa76a00b3c352c1a140b289706b276f68611f590248121aca175a
Instruction ID: 2d0457ebe8dc9788069d865d9cf90c2deb2b6e5a6738bbfafe50d6174b688ec2
Opcode Fuzzy Hash: 15543300dc5fa76a00b3c352c1a140b289706b276f68611f590248121aca175a
Instruction Fuzzy Hash: 6CB1BD719003059FDB159F69C88ABEEBBF4BF49304F1850ADF599BB242DB759841CB20

Function 00E18500 Relevance: 21.3, APIs: 3, Strings: 9, Instructions: 266COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?), ref: 00E18523
CommandLineToArgvW.SHELL32(00000000), ref: 00E1852A
LocalFree.KERNEL32(?), ref: 00E188BB

Strings

Markets folder not found, running in web update mode., xrefs: 00E186CE
xM, xrefs: 00E185FF
/v/qn, xrefs: 00E18643
Ini Oveerride found. Running in Major upgrade web update mode., xrefs: 00E18840
Markets folder found, running in Major upgrade web update mode., xrefs: 00E186BF
/fu, xrefs: 00E1874E
/webupdate, xrefs: 00E18689, 00E1882E
/noPrereqs, xrefs: 00E18707
/whitelist, xrefs: 00E1872A

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: CommandLine$ArgvFreeLocal
String ID: /fu$/noPrereqs$/v/qn$/webupdate$/whitelist$Ini Oveerride found. Running in Major upgrade web update mode.$Markets folder found, running in Major upgrade web update mode.$Markets folder not found, running in web update mode.$xM
API String ID: 1415666456-4032329724
Opcode ID: f953c38b8e5af289bad64357dd124bf1bf7ac3ec84d7af63883020dbe82b8f77
Instruction ID: 59d97ed560632b866e11a1230adb9e8b36b42b296feb52a6ff007cdc0dc12597
Opcode Fuzzy Hash: f953c38b8e5af289bad64357dd124bf1bf7ac3ec84d7af63883020dbe82b8f77
Instruction Fuzzy Hash: 8B913BB1D0031496DB20EB60DD46FEA73F86F14309F8469A5E94AF7182EF71AAC8C751

Function 00E3D7A5 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00E3D7E9

Part of subcall function 00E3CB88: _free.LIBCMT ref: 00E3CBA5
Part of subcall function 00E3CB88: _free.LIBCMT ref: 00E3CBB7
Part of subcall function 00E3CB88: _free.LIBCMT ref: 00E3CBC9
Part of subcall function 00E3CB88: _free.LIBCMT ref: 00E3CBDB
Part of subcall function 00E3CB88: _free.LIBCMT ref: 00E3CBED
Part of subcall function 00E3CB88: _free.LIBCMT ref: 00E3CBFF
Part of subcall function 00E3CB88: _free.LIBCMT ref: 00E3CC11
Part of subcall function 00E3CB88: _free.LIBCMT ref: 00E3CC23
Part of subcall function 00E3CB88: _free.LIBCMT ref: 00E3CC35
Part of subcall function 00E3CB88: _free.LIBCMT ref: 00E3CC47
Part of subcall function 00E3CB88: _free.LIBCMT ref: 00E3CC59
Part of subcall function 00E3CB88: _free.LIBCMT ref: 00E3CC6B
Part of subcall function 00E3CB88: _free.LIBCMT ref: 00E3CC7D

_free.LIBCMT ref: 00E3D7DE

Part of subcall function 00E32695: HeapFree.KERNEL32(00000000,00000000,?,00E3D2F5,?,00000000,?,00000000,?,00E3D599,?,00000007,?,?,00E3D93D,?), ref: 00E326AB
Part of subcall function 00E32695: GetLastError.KERNEL32(?,?,00E3D2F5,?,00000000,?,00000000,?,00E3D599,?,00000007,?,?,00E3D93D,?,?), ref: 00E326BD

_free.LIBCMT ref: 00E3D800
_free.LIBCMT ref: 00E3D815
_free.LIBCMT ref: 00E3D820
_free.LIBCMT ref: 00E3D842
_free.LIBCMT ref: 00E3D855
_free.LIBCMT ref: 00E3D863
_free.LIBCMT ref: 00E3D86E
_free.LIBCMT ref: 00E3D8A6
_free.LIBCMT ref: 00E3D8AD
_free.LIBCMT ref: 00E3D8CA
_free.LIBCMT ref: 00E3D8E2

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: c9705f0a9496d5aedd54171864404e9b049ad04b6ba0f32a0d5194b6f52644d8
Instruction ID: 26b8bf69c2ab761fa4911ad2c62f21ec644cebfc0bc5fc8ec3acc817ae64ce3e
Opcode Fuzzy Hash: c9705f0a9496d5aedd54171864404e9b049ad04b6ba0f32a0d5194b6f52644d8
Instruction Fuzzy Hash: 77317E71A083009FEB24AA39EC4EB567BE9AF44318F146429E488FB191DF31FC40CB15

Function 00E15930 Relevance: 19.6, APIs: 8, Strings: 3, Instructions: 313commemoryCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00E15986
SysAllocString.OLEAUT32(00000001), ref: 00E159A3
CoCreateInstance.OLE32(00E58D0C,00000000,00000017,00E58CE4,00000000), ref: 00E15A15
VariantInit.OLEAUT32(?), ref: 00E15B4C

Part of subcall function 00E25100: __CxxThrowException@8.LIBVCRUNTIME ref: 00E25112

VariantClear.OLEAUT32(?), ref: 00E15B96
VariantClear.OLEAUT32(?), ref: 00E15DA7

Part of subcall function 00E24BB0: VariantInit.OLEAUT32(?), ref: 00E24BF7
Part of subcall function 00E24BB0: VariantClear.OLEAUT32(?), ref: 00E24C55

Part of subcall function 00E24C80: VariantCopy.OLEAUT32(?,?), ref: 00E24C8F

SysFreeString.OLEAUT32(?), ref: 00E15C54
VariantClear.OLEAUT32(00000000), ref: 00E15D0F

Strings

userSettings/ReSound.Ratatosk.Properties.Settings/setting[@name='AttachDBFilename'], xrefs: 00E15A88
`<u, xrefs: 00E15C54
value, xrefs: 00E15B29

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Variant$Clear$InitString$AllocCopyCreateException@8FreeInstanceThrow
String ID: `<u$userSettings/ReSound.Ratatosk.Properties.Settings/setting[@name='AttachDBFilename']$value
API String ID: 2147581873-3608125196
Opcode ID: bc2432242c1e8b302d2fd6c5b4edfba19d626e3ae3f4fc797626bb05adc2e584
Instruction ID: 05f03dc8bf7c8b331ca736324ad88bb1a9b6a7e679aeabc67f6325d3aadada92
Opcode Fuzzy Hash: bc2432242c1e8b302d2fd6c5b4edfba19d626e3ae3f4fc797626bb05adc2e584
Instruction Fuzzy Hash: 6BD19C71A01619EBDB20DB64DC48BEEB7B8BF55308F1451D8E809BB291DB71AE84CF50

Function 00E1B850 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127libraryloaderwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E12390: GetProcessHeap.KERNEL32(?), ref: 00E123BC
Part of subcall function 00E12390: __Init_thread_footer.LIBCMT ref: 00E123E7
Part of subcall function 00E12390: __Init_thread_footer.LIBCMT ref: 00E12465

wsprintfW.USER32 ref: 00E1B904
PathFileExistsW.SHLWAPI(00E16992,?), ref: 00E1B923
LoadLibraryW.KERNEL32(IOUtilsWrapper.dll), ref: 00E1B932
GetLastError.KERNEL32 ref: 00E1B93E
FormatMessageW.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 00E1B959
FreeLibrary.KERNEL32(00000000), ref: 00E1B96D

Part of subcall function 00E25100: __CxxThrowException@8.LIBVCRUNTIME ref: 00E25112

GetProcAddress.KERNEL32(00000000,GetVersion), ref: 00E1B999
wsprintfW.USER32 ref: 00E1B9CD

Strings

GetMarketVersion for '%s', xrefs: 00E1B8FE
GetVersion, xrefs: 00E1B993
IOUtilsWrapper.dll, xrefs: 00E1B92D

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Init_thread_footerLibrarywsprintf$AddressErrorException@8ExistsFileFormatFreeHeapLastLoadMessagePathProcProcessThrow
String ID: GetMarketVersion for '%s'$GetVersion$IOUtilsWrapper.dll
API String ID: 3779942870-1907825684
Opcode ID: 51a2b883211073ef1b73e788a8192e3169fba9eea37359ede068e0d698b65b22
Instruction ID: 78ff949d52bf45d16162ccc865c897276cb227e3ac8cd8a38668f402cc5cf5bd
Opcode Fuzzy Hash: 51a2b883211073ef1b73e788a8192e3169fba9eea37359ede068e0d698b65b22
Instruction Fuzzy Hash: D94172B5A00218ABDB20DF55DC46BDEB7FCEB49700F008069F909F3281DF745A898BA5

Function 00E11FB0 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 126processfilewindowCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000004,00000003,?,00000002,00000080,00000000), ref: 00E12029
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,00000044,?), ref: 00E12067
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,00001CFF), ref: 00E1208A
PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00E120A7
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,00001CFF), ref: 00E120CA
GetExitCodeProcess.KERNEL32(?,00000000), ref: 00E120D7
GetLastError.KERNEL32(?,00000000,00000000,00000001,00000020,00000000,00000000,00000044,?), ref: 00E120E6
CloseHandle.KERNEL32(?,?,00000000,00000000,00000001,00000020,00000000,00000000,00000044,?), ref: 00E120F7
CloseHandle.KERNEL32(?,?,00000000,00000000,00000001,00000020,00000000,00000000,00000044,?), ref: 00E120FC
GetLastError.KERNEL32(?,00000000,00000000,00000001,00000020,00000000,00000000,00000044,?), ref: 00E12107

Strings

D, xrefs: 00E11FE6

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: CloseCreateErrorHandleLastMultipleObjectsProcessWait$CodeExitFileMessagePeek
String ID: D
API String ID: 4178554234-2746444292
Opcode ID: bfc5e584dd0ddc207ff146887330fef1fc62eec0cff1b673190e3f6f377ab0f3
Instruction ID: 07dae0a8de974c0bef3a0c999100a0b338109da8ef858b56c52aab3f442f46d6
Opcode Fuzzy Hash: bfc5e584dd0ddc207ff146887330fef1fc62eec0cff1b673190e3f6f377ab0f3
Instruction Fuzzy Hash: 80416E71A40218ABFB20CB95DC45FED7BB8EB09714F104219F608FA2D0DBB56985CB55

Function 00E3CC86 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E3CCCE
_free.LIBCMT ref: 00E3CCF2
_free.LIBCMT ref: 00E3CCFF
_free.LIBCMT ref: 00E3CD24
_free.LIBCMT ref: 00E3CD31
_free.LIBCMT ref: 00E3CD3A
_free.LIBCMT ref: 00E3D018
_free.LIBCMT ref: 00E3D020

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: b7a3d084b842a4195ad796a7fc43d165787ab42fd2656e668e3d45b7e6f4c105
Instruction ID: 42e29cc76803e74cea5edf1618cfc065e2d8a13e00c90757f6f3fd4bfde12ace
Opcode Fuzzy Hash: b7a3d084b842a4195ad796a7fc43d165787ab42fd2656e668e3d45b7e6f4c105
Instruction Fuzzy Hash: 3BC155B2E40204AFDB20DBA8CC46FEE7BF9AF09704F541165FA44FB282D6709941C760

Function 00E139A0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 127COMMON

Download Yara Rule

APIs

#70.MSI(?,VersionMajor,?), ref: 00E13A9B
#70.MSI(?,VersionMinor,?,?), ref: 00E13ABB
#70.MSI(?,Version,?,?), ref: 00E13ADB
#70.MSI(?,VersionString,?,?), ref: 00E13AFB
wsprintfW.USER32 ref: 00E13B3B

Strings

VersionMinor, xrefs: 00E13AB5
VersionMajor, xrefs: 00E13A8F
Version, xrefs: 00E13AD5
VersionString, xrefs: 00E13AF5
VerMajor=%s, VerMinor=%s, Version=%s, VersionString=%s, xrefs: 00E13B35

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: wsprintf
String ID: VerMajor=%s, VerMinor=%s, Version=%s, VersionString=%s$Version$VersionMajor$VersionMinor$VersionString
API String ID: 2111968516-2105339926
Opcode ID: e38686bfc74569acd9e0dff3badcb066f669d0a8e1d63d6322b3975005358dac
Instruction ID: 60e2d8ab8c31d67a4a72f09a95c3c8fd6e2a177269f4c809932a4dd18d400335
Opcode Fuzzy Hash: e38686bfc74569acd9e0dff3badcb066f669d0a8e1d63d6322b3975005358dac
Instruction Fuzzy Hash: 694154B594021C9AEB10DB50DC89FDA77FCEB05310F0055E6E649F7181EBB1AB888FA0

Function 00E17B90 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 189COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00E17D30
GetFileAttributesW.KERNEL32(?,?,?,?,?,?,?,00000000,00000001,?), ref: 00E17DAD
SetFileAttributesW.KERNEL32(?,00000000,?,?,?,?,?,?,00000000,00000001,?), ref: 00E17DC2

Part of subcall function 00E15930: VariantClear.OLEAUT32(?), ref: 00E15986
Part of subcall function 00E15930: SysAllocString.OLEAUT32(00000001), ref: 00E159A3
Part of subcall function 00E15930: CoCreateInstance.OLE32(00E58D0C,00000000,00000017,00E58CE4,00000000), ref: 00E15A15

Part of subcall function 00E15930: VariantInit.OLEAUT32(?), ref: 00E15B4C
Part of subcall function 00E15930: VariantClear.OLEAUT32(?), ref: 00E15B96

Strings

Using Market file location: %s, xrefs: 00E17D2A
Market.Pref, xrefs: 00E17D04
ReSound.Ratatosk.Configuration.dll.config, xrefs: 00E17DC8, 00E17DE7
Market, xrefs: 00E17CAA
DATA, xrefs: 00E17C55
ReSound.Fuse2.Config.dll.config, xrefs: 00E17D93

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Variant$AttributesClearFile$AllocCreateInitInstanceStringwsprintf
String ID: DATA$Market$Market.Pref$ReSound.Fuse2.Config.dll.config$ReSound.Ratatosk.Configuration.dll.config$Using Market file location: %s
API String ID: 3507443516-2823571208
Opcode ID: 3f733dd6ec2e3a35dc79f1184fbaf5b70f2b902606960aa4aeeac5be34b0fa9d
Instruction ID: d3e681efe62b4736b870c42aa4f07745c2aa8607a6720776fd9ad10772b99045
Opcode Fuzzy Hash: 3f733dd6ec2e3a35dc79f1184fbaf5b70f2b902606960aa4aeeac5be34b0fa9d
Instruction Fuzzy Hash: 5551C4B5E40318A6DB60D7A0EC4BFDA73BCAB04705F445495BA49F61C1EAB066CCCBD4

Function 00E1463C Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 183COMMON

Download Yara Rule

APIs

PathQuoteSpacesW.SHLWAPI(?), ref: 00E147E4
wsprintfW.USER32 ref: 00E1484E

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

Part of subcall function 00E11FB0: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000001,00000020,00000000,00000000,00000044,?), ref: 00E12067
Part of subcall function 00E11FB0: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,00001CFF), ref: 00E1208A
Part of subcall function 00E11FB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000000), ref: 00E120A7
Part of subcall function 00E11FB0: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,00001CFF), ref: 00E120CA
Part of subcall function 00E11FB0: GetExitCodeProcess.KERNEL32(?,00000000), ref: 00E120D7
Part of subcall function 00E11FB0: CloseHandle.KERNEL32(?,?,00000000,00000000,00000001,00000020,00000000,00000000,00000044,?), ref: 00E120F7
Part of subcall function 00E11FB0: CloseHandle.KERNEL32(?,?,00000000,00000000,00000001,00000020,00000000,00000000,00000044,?), ref: 00E120FC

wsprintfW.USER32 ref: 00E148D2

Strings

GNWeb Launch ExitCode: %lu, xrefs: 00E148CC
%s /P /K "%s" /U "%s" /B "%s" /E "%s" /T "%s" /I "%s" /M "%s" /V "%s" , xrefs: 00E14848
GNWeb.exe, xrefs: 00E147C4
GNWeb Launch call succeeded., xrefs: 00E1488D
_gnWeb.log, xrefs: 00E146C9
Analytics, xrefs: 00E14769

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: CloseHandleMultipleObjectsProcessWaitwsprintf$CodeCreateExitLocalMessagePathPeekQuoteSpacesTime
String ID: %s /P /K "%s" /U "%s" /B "%s" /E "%s" /T "%s" /I "%s" /M "%s" /V "%s" $Analytics$GNWeb Launch ExitCode: %lu$GNWeb Launch call succeeded.$GNWeb.exe$_gnWeb.log
API String ID: 2375186778-2865028443
Opcode ID: 10c5cf488e4c6a256beaf51aa27fec899bda84b0d0c0acd67da23a249e1019a4
Instruction ID: 06041b295ec436037b1f819b6aabac1cd647bf72e3c35e33c495e51f772df068
Opcode Fuzzy Hash: 10c5cf488e4c6a256beaf51aa27fec899bda84b0d0c0acd67da23a249e1019a4
Instruction Fuzzy Hash: 9C61BAF1D40218A6DB30DB60DC46FDAB3BC6F04700F0494E5AA49B62C1E775A799CFA4

Function 00E18A80 Relevance: 15.9, APIs: 3, Strings: 6, Instructions: 135sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000000FA,0000000A,Displaying Noah4Running message,?,?,F9744ECF), ref: 00E18B88
wsprintfW.USER32 ref: 00E18BEA
Sleep.KERNEL32(0000015E,?), ref: 00E18C0D

Part of subcall function 00E1AAF0: GetModuleHandleW.KERNEL32(00000000,00000000,?,00000800), ref: 00E1ABAF
Part of subcall function 00E1AAF0: LoadStringW.USER32(00000000), ref: 00E1ABB6

Strings

Displaying SetupRunning message, xrefs: 00E18B39
Noah4.exe, xrefs: 00E18B60
Displaying Noah4Running message, xrefs: 00E18B6E
Displaying SoftwareRunning message, xrefs: 00E18B03
FSW still running...., xrefs: 00E18BBB
Killing FSW process '%s'...., xrefs: 00E18BE4

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Sleep$HandleLoadModuleStringwsprintf
String ID: Displaying Noah4Running message$Displaying SetupRunning message$Displaying SoftwareRunning message$FSW still running....$Killing FSW process '%s'....$Noah4.exe
API String ID: 3349528799-3849168952
Opcode ID: a7aae434e555f74bca1f9078ec2c179f81a22100ac35ec343a30b595bd606717
Instruction ID: d6e9fe8b1c3228e78f2c6144769ddc24b53532ec2acccd1dcaea2d6a47e1f1b5
Opcode Fuzzy Hash: a7aae434e555f74bca1f9078ec2c179f81a22100ac35ec343a30b595bd606717
Instruction Fuzzy Hash: 284156B07407149ADA25A7209D26BFEB3D5AF86744F042459F886B72C1CFA419C583E6

Function 00E1D3C0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 131COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00E1D4FE
wsprintfW.USER32 ref: 00E1D524
PathFileExistsW.SHLWAPI(?,?), ref: 00E1D544
PathFileExistsW.SHLWAPI(?), ref: 00E1D551

Strings

szSADbNew: %s, xrefs: 00E1D51E
SADataDB.db, xrefs: 00E1D4BC
szSADb: %s, xrefs: 00E1D4F8
SAData.sdf, xrefs: 00E1D4A3
ReSound\SmartFit\1\, xrefs: 00E1D469

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ExistsFilePathwsprintf
String ID: ReSound\SmartFit\1\$SAData.sdf$SADataDB.db$szSADb: %s$szSADbNew: %s
API String ID: 2360385415-231781144
Opcode ID: 6f6eacf416c5383af0962ec08545d8072bf44c5886a8e2775b80cb3be64e870f
Instruction ID: 238a62aa0bcb9b8dc4838e7c3eb28228be57f9430327d7eba866cb031e8453ce
Opcode Fuzzy Hash: 6f6eacf416c5383af0962ec08545d8072bf44c5886a8e2775b80cb3be64e870f
Instruction Fuzzy Hash: 764159B5D0021CA6DB60D6A0EC46FDA73FCEB04705F4454A2A949F7181EEB0ABDC8BD4

Function 00E14ED0 Relevance: 15.8, APIs: 3, Strings: 6, Instructions: 97windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

wsprintfW.USER32 ref: 00E14F87
GetLastError.KERNEL32(?,?,?,?,?,?,Uninstalling Application with Parmaters), ref: 00E14FD7
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000,?,?,?,?,?,?,Uninstalling Application with Parmaters), ref: 00E14FF5

Strings

%s /uninstall "%s" /qn /l*v "%s", xrefs: 00E14F64
%s /uninstall "%s" /qb! /l*v "%s", xrefs: 00E14F7B
_fswUninstall.log, xrefs: 00E14F2F
%s /uninstall "%s" /l*v "%s", xrefs: 00E14F74
MsiExec.Exe, xrefs: 00E14F5D
Uninstalling Application with Parmaters, xrefs: 00E14F44

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ErrorFormatLastLocalMessageTimewsprintf
String ID: %s /uninstall "%s" /l*v "%s"$%s /uninstall "%s" /qb! /l*v "%s"$%s /uninstall "%s" /qn /l*v "%s"$MsiExec.Exe$Uninstalling Application with Parmaters$_fswUninstall.log
API String ID: 4153586964-1021344114
Opcode ID: 447a437842ef4b373ee81140641ae322823368cfe4a1e5724f1ecd3205a5e98c
Instruction ID: e195e6801d4690f7ecbe5793d73a45ec48e6828e66356f1d9d55c42651142280
Opcode Fuzzy Hash: 447a437842ef4b373ee81140641ae322823368cfe4a1e5724f1ecd3205a5e98c
Instruction Fuzzy Hash: B231B9B5B00318AADB20D764DC06FDEB7A8AB08705F005596F549B63C1DAB06ACDCBA5

Function 00E34F3B Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E34F4F

Part of subcall function 00E32695: HeapFree.KERNEL32(00000000,00000000,?,00E3D2F5,?,00000000,?,00000000,?,00E3D599,?,00000007,?,?,00E3D93D,?), ref: 00E326AB
Part of subcall function 00E32695: GetLastError.KERNEL32(?,?,00E3D2F5,?,00000000,?,00000000,?,00E3D599,?,00000007,?,?,00E3D93D,?,?), ref: 00E326BD

_free.LIBCMT ref: 00E34F5B
_free.LIBCMT ref: 00E34F66
_free.LIBCMT ref: 00E34F71
_free.LIBCMT ref: 00E34F7C
_free.LIBCMT ref: 00E34F87
_free.LIBCMT ref: 00E34F92
_free.LIBCMT ref: 00E34F9D
_free.LIBCMT ref: 00E34FA8
_free.LIBCMT ref: 00E34FB6

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: ae25e2295849bab58e3b9bcbfa77e13556c93fae32f46dcf89160912362a718c
Instruction ID: 8732b85caa80504b4624cde68c0e3f94632e5f4da0ca8593c04e33528a193a38
Opcode Fuzzy Hash: ae25e2295849bab58e3b9bcbfa77e13556c93fae32f46dcf89160912362a718c
Instruction Fuzzy Hash: BC11A476500108AFCB01EF55C956CD93FA6EF08354F4164A9BA48AF262DE32EA50DB81

Function 00E1B6F0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

GetSystemDefaultLCID.KERNEL32 ref: 00E1B74E
GetModuleHandleW.KERNEL32(00000000,000000C9,?,00000800), ref: 00E1B7BA
LoadStringW.USER32(00000000), ref: 00E1B7C1
wsprintfW.USER32 ref: 00E1B7DC
MessageBoxW.USER32(00000000,?,?,00000014), ref: 00E1B804

Strings

Rebooting....., xrefs: 00E1B80F
Handling Reboot...., xrefs: 00E1B718
User opted to reboot later...., xrefs: 00E1B830

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: DefaultHandleLoadLocalMessageModuleStringSystemTimewsprintf
String ID: Handling Reboot....$Rebooting.....$User opted to reboot later....
API String ID: 1737272312-618185655
Opcode ID: 5375690c13a5717834b728febd41cd0d9163e993762a2c42a5c8e8ccb943618b
Instruction ID: 84e12cb126ec77d047051405d1e8976a38f69172fd639dd6178bc2e0c6dab016
Opcode Fuzzy Hash: 5375690c13a5717834b728febd41cd0d9163e993762a2c42a5c8e8ccb943618b
Instruction Fuzzy Hash: CF313975600304ABE724A778EC4AFED33A8EB85704F002566F106F61D1DB645DC98796

Function 00E19C60 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 76windowCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00E19CA0

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

MessageBoxW.USER32(00000000,Activation completed successfully.,Activation,00000040), ref: 00E19D00
MessageBoxW.USER32(00000000,Invalid key for activation. Look at the log file (%TEMP%PatchInstaller.log) for more details.,Activation,00000010), ref: 00E19D39

Strings

Error: invalid Key for activation., xrefs: 00E19D18
Activation completed successfully., xrefs: 00E19CDD, 00E19CF9
Activation invoked with switch '%s', xrefs: 00E19C9A
Invalid key for activation. Look at the log file (%TEMP%PatchInstaller.log) for more details., xrefs: 00E19D32
Activation, xrefs: 00E19CF4, 00E19D2D

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Message$LocalTimewsprintf
String ID: Activation$Activation completed successfully.$Activation invoked with switch '%s'$Error: invalid Key for activation.$Invalid key for activation. Look at the log file (%TEMP%PatchInstaller.log) for more details.
API String ID: 347051814-1400046012
Opcode ID: fbfdb75df8d249144e07bd27f45d8d43c1bb37d954a72d171442378a38b215e5
Instruction ID: e5e2c90ef0a7a1e26a48e5a6d0ac112a9c3cb6c16918e4a30abf3cbb74d5e41e
Opcode Fuzzy Hash: fbfdb75df8d249144e07bd27f45d8d43c1bb37d954a72d171442378a38b215e5
Instruction Fuzzy Hash: 8B216B72F447087ADB20E774AC1BFEDB3A59F45701F401998FC19B72C1DFA0298886A5

Function 00E40E02 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00f4f8939218bb6ef84f90c6659d1a6570a27fdf940e0cf2da19aa4c872e6285
Instruction ID: 6081a93b54dc5c77e70eacd6c892b097a5fefda76d90031ca587713b802723f6
Opcode Fuzzy Hash: 00f4f8939218bb6ef84f90c6659d1a6570a27fdf940e0cf2da19aa4c872e6285
Instruction Fuzzy Hash: 27C1E174A04389AFDF15DFA9E881BADBBF0BF09304F146599E905B7392C7309981CB61

Function 00E3966F Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,Y,00E2E259,?,?,?,00E398C0,00000001,00000001,99E85006), ref: 00E396C9
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00E398C0,00000001,00000001,99E85006,?,?,?), ref: 00E3974F
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,99E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00E39849
__freea.LIBCMT ref: 00E39856

Part of subcall function 00E31E61: RtlAllocateHeap.NTDLL(00000000,00000003,00000000,?,00000003,00E350B2,?,00E2C5E9,?), ref: 00E31E93

__freea.LIBCMT ref: 00E3985F
__freea.LIBCMT ref: 00E39884

Strings

Y, xrefs: 00E39681

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID: Y
API String ID: 1414292761-3314497812
Opcode ID: b03bbb336d0ebf6dd964d062594e0ec9f553f53611adc747c61f31f8c12f5bb6
Instruction ID: 9746ec72c4e5f5a63f33094c4df2324c04ef6febeb00fb3f247852c9ed2c174f
Opcode Fuzzy Hash: b03bbb336d0ebf6dd964d062594e0ec9f553f53611adc747c61f31f8c12f5bb6
Instruction Fuzzy Hash: B951E072600216AFDB298E64DC49EAB7FA9EF81714F14562DFC08F6142EBB4DC44C6A0

Function 00E21CE0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E21D0D
std::_Lockit::_Lockit.LIBCPMT ref: 00E21D30
std::_Lockit::~_Lockit.LIBCPMT ref: 00E21D50
__CxxThrowException@8.LIBVCRUNTIME ref: 00E21DC9
std::_Facet_Register.LIBCPMT ref: 00E21DDF
std::_Lockit::~_Lockit.LIBCPMT ref: 00E21DEA

Strings

8O, xrefs: 00E21D0A, 00E21DE7

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
String ID: 8O
API String ID: 2536120697-3761743594
Opcode ID: 52b88f88a7be4c5107be0e405a821a98def80bd1b09e0b54a5dd3b11b83bf800
Instruction ID: d0ac2bd6a76066d0992eea411d3433073bd46feea56a61aeba258db8b9c14aaa
Opcode Fuzzy Hash: 52b88f88a7be4c5107be0e405a821a98def80bd1b09e0b54a5dd3b11b83bf800
Instruction Fuzzy Hash: 1F31E172A04224DFCB24DF94FC41AADB7B4FB24316F14169AE801B7251DB30AE05CB90

Function 00E21F40 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E21F6D
std::_Lockit::_Lockit.LIBCPMT ref: 00E21F90
std::_Lockit::~_Lockit.LIBCPMT ref: 00E21FB0
__CxxThrowException@8.LIBVCRUNTIME ref: 00E22029
std::_Facet_Register.LIBCPMT ref: 00E2203F
std::_Lockit::~_Lockit.LIBCPMT ref: 00E2204A

Strings

hO, xrefs: 00E21F5F, 00E22051

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
String ID: hO
API String ID: 2536120697-3626264865
Opcode ID: c714bbeaff01c58ad34b582736c3889201342cbd1c2fb99132eb6cc7707175fd
Instruction ID: 492d9d7fe82a81bc8ac2e602ffcf33a2b928cf83c0687dc61c1d82c42beeefeb
Opcode Fuzzy Hash: c714bbeaff01c58ad34b582736c3889201342cbd1c2fb99132eb6cc7707175fd
Instruction Fuzzy Hash: 69311472E042249FDB14CF94F941AADB7B4EF14324F14525AE801B73A1DB70AE09CB90

Function 00E1A470 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 67windowCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00E1A4AF

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

Part of subcall function 00E189B0: GetPrivateProfileStringW.KERNEL32(Startup,PackageCode,00E52748,?,00000400,?), ref: 00E18A5E

Part of subcall function 00E1A2C0: wsprintfW.USER32 ref: 00E1A326
Part of subcall function 00E1A2C0: RegCreateKeyExW.ADVAPI32(80000002,Software\Policies\Microsoft\Windows\Installer,00000000,00000000,00000000,000F003F,00000000,?,?,?), ref: 00E1A362

MessageBoxW.USER32(00000000,Error Whitelisting. Look at the log file (%TEMP%PatchInstaller.log) for more details.,WhiteList,00000010), ref: 00E1A540

Strings

Error Whitelisting. Look at the log file (%TEMP%PatchInstaller.log) for more details., xrefs: 00E1A539
WhiteList, xrefs: 00E1A513, 00E1A534
Setup invoked with WhiteList switch '%s', xrefs: 00E1A4A9
Error Whitelisting: look at log file for more details., xrefs: 00E1A51F
WhiteList completed successfully., xrefs: 00E1A4FE, 00E1A518

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: wsprintf$CreateLocalMessagePrivateProfileStringTime
String ID: Error Whitelisting. Look at the log file (%TEMP%PatchInstaller.log) for more details.$Error Whitelisting: look at log file for more details.$Setup invoked with WhiteList switch '%s'$WhiteList$WhiteList completed successfully.
API String ID: 1034281970-1845519667
Opcode ID: 875b3bbd34133853065b79fac8efe48bb048625d8dde418dcee14b89a746a86c
Instruction ID: 73c85313dcdc159caab8e2d49296c3b5fe575bdcdca0bb907ba67b7a11811de3
Opcode Fuzzy Hash: 875b3bbd34133853065b79fac8efe48bb048625d8dde418dcee14b89a746a86c
Instruction Fuzzy Hash: 15110DB0F4031C66DF24E771AC4AFE977A99B05710F441865F809B71C1DAB05A88C6A2

Function 00E24060 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 59COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00E24099
__CxxThrowException@8.LIBVCRUNTIME ref: 00E240C0
__CxxThrowException@8.LIBVCRUNTIME ref: 00E240E3
__CxxThrowException@8.LIBVCRUNTIME ref: 00E24106

Strings

ios_base::badbit set, xrefs: 00E240A8
ios_base::eofbit set, xrefs: 00E240EE
ios_base::failbit set, xrefs: 00E240CB

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: dd949fbfbb533a7c37fcf6e3c21ee1c020b00cf6b4661a222ffcb99dc6fae552
Instruction ID: b2394f10b2a2b5062c72a7cf1d1986f0edddd9c5385c49a78be6421c0eb885c2
Opcode Fuzzy Hash: dd949fbfbb533a7c37fcf6e3c21ee1c020b00cf6b4661a222ffcb99dc6fae552
Instruction Fuzzy Hash: E21182B16043146AD714FB70FD53F6A73D86B51B02F406819BA91760C2EFA4AA4C8B9A

Function 00E160A0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 277COMMON

Download Yara Rule

APIs

_wcsstr.LIBVCRUNTIME ref: 00E1611C
_wcsrchr.LIBVCRUNTIME ref: 00E16140
wsprintfW.USER32 ref: 00E163EF

Strings

Invalid or corrupt market file version: %s, xrefs: 00E16163
Invalid or corrupt market file major version: %s, xrefs: 00E163E3
Invalid or corrupt market file minor version: %s, xrefs: 00E163DA

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: _wcsrchr_wcsstrwsprintf
String ID: Invalid or corrupt market file major version: %s$Invalid or corrupt market file minor version: %s$Invalid or corrupt market file version: %s
API String ID: 3507916290-4082492693
Opcode ID: cf946a55d99356bc39a1ea2e27f845bae91728e42f7c3758cb9a9def3f328833
Instruction ID: bdb088488c82eff810b807b2f041ad0d04237714a348ccf0a7b79abc063b5486
Opcode Fuzzy Hash: cf946a55d99356bc39a1ea2e27f845bae91728e42f7c3758cb9a9def3f328833
Instruction Fuzzy Hash: 0EB19071A016159BCB24DF68C888BD9B7F4FF55314F1492A9E81ABB291DB30DE84CF50

Function 00E3D0AB Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E3D11A
_free.LIBCMT ref: 00E3D128
_free.LIBCMT ref: 00E3D256
_free.LIBCMT ref: 00E3D261

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 4e36e71f365810b93b5de414fc7ebe4b335588339c20d13f8e8dcb1c25e0484e
Instruction ID: 3218656064f521e33299b07501e5fb4a0131b8d3ba113433347b1a1e65d8cd04
Opcode Fuzzy Hash: 4e36e71f365810b93b5de414fc7ebe4b335588339c20d13f8e8dcb1c25e0484e
Instruction Fuzzy Hash: C161BD71D08205AFDB20DFA8DC46BAABFF5EF48720F1451A9E944FB292DB709941CB50

Function 00E3653E Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(00000000,?,?,?,?,?,?,?,?,00E36CB3,?,?,00000000,?,?,?), ref: 00E36580
__fassign.LIBCMT ref: 00E365FB
__fassign.LIBCMT ref: 00E36616
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,00000000,00000005,00000000,00000000), ref: 00E3663C
WriteFile.KERNEL32(?,00000000,00000000,00E36CB3,00000000,?,?,?,?,?,?,?,?,?,00E36CB3,?), ref: 00E3665B
WriteFile.KERNEL32(?,?,00000001,00E36CB3,00000000,?,?,?,?,?,?,?,?,?,00E36CB3,?), ref: 00E36694

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 174d5d6b5000a0083a68bba9e5995f3fd04817894611600c8ea31e6ee08a9df9
Instruction ID: 78597bb900e55ca28aac894f05dc8f09814ffa56ffd5151175570fbfab30fe34
Opcode Fuzzy Hash: 174d5d6b5000a0083a68bba9e5995f3fd04817894611600c8ea31e6ee08a9df9
Instruction Fuzzy Hash: A251A271900249AFCB14CFB8D88AAEEBBF8FF09301F14955AE956F7251E6309951CB60

Function 00E22520 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 143COMMON

Download Yara Rule

APIs

__Getcvt.LIBCPMT ref: 00E22561
__Getcvt.LIBCPMT ref: 00E225B8
Concurrency::cancel_current_task.LIBCPMT ref: 00E225E0

Strings

,, xrefs: 00E22672
false, xrefs: 00E22607
true, xrefs: 00E2261D

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Getcvt$Concurrency::cancel_current_task
String ID: ,$false$true
API String ID: 1267538876-760133229
Opcode ID: 742f49e6d060a373d6566df9cc12826eb8327642a982c828c2a43eb6362b60f5
Instruction ID: 35c2ec9ad7f380e87fabfe2203f97f87c633017ed491ec8fd3724e7700044a32
Opcode Fuzzy Hash: 742f49e6d060a373d6566df9cc12826eb8327642a982c828c2a43eb6362b60f5
Instruction Fuzzy Hash: 6851E3B1D003589FDB10CFA4D841BEEBBB8FF08304F14926AE905BB241EB71AA45CB51

Function 00E1AAF0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 126windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,?,00000800), ref: 00E1ABAF
LoadStringW.USER32(00000000), ref: 00E1ABB6
MessageBoxW.USER32(00000000,?,?,00000010), ref: 00E1AC6A

Strings

Setup, xrefs: 00E1AB77
Setup.exe, xrefs: 00E1AC0A

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: HandleLoadMessageModuleString
String ID: Setup$Setup.exe
API String ID: 2734547477-2205716801
Opcode ID: ac19633e809d95fbdf7568d9ccb89525d9ba889a39eb2fa558e6a4cf08cc067f
Instruction ID: 61c90328d726e69e80c90acbfba9f592cdc1b2bb640e05be7f0bf6d786fba9c5
Opcode Fuzzy Hash: ac19633e809d95fbdf7568d9ccb89525d9ba889a39eb2fa558e6a4cf08cc067f
Instruction Fuzzy Hash: 7A41E976A011186BDB24DB649C46FFDB3A8EB44300F0492B6F909B7181DF706A98CBD6

Function 00E1B190 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

GetFileAttributesW.KERNEL32(?,Invoking .NET 8 x86 Install,?), ref: 00E1B1D8
PathQuoteSpacesW.SHLWAPI(?), ref: 00E1B29A

Strings

/install /passive /norestart, xrefs: 00E1B2CF
Prereq\Net\windowsdesktop-runtime-8.0.1-win-x86.exe, xrefs: 00E1B27A
Invoking .NET 8 x86 Install, xrefs: 00E1B1A5
/install /quiet /norestart, xrefs: 00E1B2C8

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: AttributesFileLocalPathQuoteSpacesTime
String ID: /install /passive /norestart$/install /quiet /norestart$Invoking .NET 8 x86 Install$Prereq\Net\windowsdesktop-runtime-8.0.1-win-x86.exe
API String ID: 2168460608-3913349600
Opcode ID: 00c1cd3d21bf76b77524167c89b8cdcfed0e3ab11d62c1542dea6c9960b22087
Instruction ID: d282831774848b8dbdd328e89eb88750868957afb50782773cd9111078261b23
Opcode Fuzzy Hash: 00c1cd3d21bf76b77524167c89b8cdcfed0e3ab11d62c1542dea6c9960b22087
Instruction Fuzzy Hash: CA31A47590021896DB74DB60DC06FD973B8EB04704F449994AA89B61C0EF706ACDCBD4

Function 00E1B320 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 109COMMON

Download Yara Rule

APIs

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

GetFileAttributesW.KERNEL32(?,Invoking VC Redist x86 v14.22 Install...,?), ref: 00E1B368
PathQuoteSpacesW.SHLWAPI(?), ref: 00E1B42A

Strings

/quiet /norestart, xrefs: 00E1B458
Prereq\VCRedist\vcredist_x86.exe, xrefs: 00E1B40A
/passive /norestart, xrefs: 00E1B45F
Invoking VC Redist x86 v14.22 Install..., xrefs: 00E1B335

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: AttributesFileLocalPathQuoteSpacesTime
String ID: /passive /norestart$/quiet /norestart$Invoking VC Redist x86 v14.22 Install...$Prereq\VCRedist\vcredist_x86.exe
API String ID: 2168460608-1423580529
Opcode ID: e10781e8cf070c0bd259a7c44f531fef4bdfbf0f8d6e8c02ae7fac0b34382ed4
Instruction ID: a03487fb3da543cb0f1e28a663cbad134927139d7c954385742f0288cf404bcd
Opcode Fuzzy Hash: e10781e8cf070c0bd259a7c44f531fef4bdfbf0f8d6e8c02ae7fac0b34382ed4
Instruction Fuzzy Hash: B831D6B590031896DB64DB60DC06FDA73B8EF04304F409994EA89B6181EFB06ADECBD4

Function 00E11E70 Relevance: 10.6, APIs: 7, Instructions: 90processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00E11EB0
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00E11EC0
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 00E11F61
GetExitCodeProcess.KERNEL32(00000000,?), ref: 00E11F71
TerminateProcess.KERNEL32(00000000,?), ref: 00E11F7E
Process32NextW.KERNEL32(00000000,?), ref: 00E11F8C
CloseHandle.KERNEL32(00000000), ref: 00E11F97

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Process$Process32$CloseCodeCreateExitFirstHandleNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 4076460876-0
Opcode ID: 18c2c47864f976de247be95b4ccf1b083144d8fa1dab6b1596c134f61bf1a022
Instruction ID: c3a8f15fdf24fd2acedd8a830d074fde8cc2d26373de12376b3e635cf97c8ee6
Opcode Fuzzy Hash: 18c2c47864f976de247be95b4ccf1b083144d8fa1dab6b1596c134f61bf1a022
Instruction Fuzzy Hash: A5316675A01218AADB20EB61DC4AFEE73BCEF09704F0041D5F609F6181DB749B998B65

Function 00E431B1 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68b8e7f0d533e841bb42f86fb59635a82394dfecbfaa004c7c3cdb25f882b068
Instruction ID: 778c2721fc0ef63c08ac9c86d74dc237765512cbfbfbfcb42423c69366bdc8db
Opcode Fuzzy Hash: 68b8e7f0d533e841bb42f86fb59635a82394dfecbfaa004c7c3cdb25f882b068
Instruction Fuzzy Hash: FD1136B2505225BFDB202FB6FC08D6F3AA8EF83724B205654B815F7251DE708901D660

Function 00E3D580 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E3D2C7: _free.LIBCMT ref: 00E3D2F0

_free.LIBCMT ref: 00E3D5CE

Part of subcall function 00E32695: HeapFree.KERNEL32(00000000,00000000,?,00E3D2F5,?,00000000,?,00000000,?,00E3D599,?,00000007,?,?,00E3D93D,?), ref: 00E326AB
Part of subcall function 00E32695: GetLastError.KERNEL32(?,?,00E3D2F5,?,00000000,?,00000000,?,00E3D599,?,00000007,?,?,00E3D93D,?,?), ref: 00E326BD

_free.LIBCMT ref: 00E3D5D9
_free.LIBCMT ref: 00E3D5E4
_free.LIBCMT ref: 00E3D638
_free.LIBCMT ref: 00E3D643
_free.LIBCMT ref: 00E3D64E
_free.LIBCMT ref: 00E3D659

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4823ed74ff2b2a181ba03e8bd3704a0034a048cd6f32e05b26b66c1f602ddd3a
Instruction ID: 3fd0dc9ebc60d4b63c7badd0636f3e1074e2ebbd0e32533d0a92e85a97600bfe
Opcode Fuzzy Hash: 4823ed74ff2b2a181ba03e8bd3704a0034a048cd6f32e05b26b66c1f602ddd3a
Instruction Fuzzy Hash: A3110AB1544B04AAD620BBB1DC4FFCB7FECAF04700F445919B29DBB0A2DA69F904C651

Function 00E2BA0E Relevance: 10.6, APIs: 7, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00E2BA05,00E285F7,00E5B4A8,00000010,00E27DBF,?,?,?,?,?,00000000,?), ref: 00E2BA1C
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00E2BA2A
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00E2BA43
SetLastError.KERNEL32(00000000,00E2BA05,00E285F7,00E5B4A8,00000010,00E27DBF,?,?,?,?,?,00000000,?), ref: 00E2BA95

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 9a5d47be3cb9fe52f2ddca60f83c261d017a6d27b6c9aa508b0c4809a54de218
Instruction ID: 6825d2f928616f3a7724e5d423780e69b7bc0a3e7eec90025f9ce2bcc09717fe
Opcode Fuzzy Hash: 9a5d47be3cb9fe52f2ddca60f83c261d017a6d27b6c9aa508b0c4809a54de218
Instruction Fuzzy Hash: EA01D47210E7359EA73C2B767C856A73BD9EB01779B20223DF128750E1EF114C469240

Function 00E24A90 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 46libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,?,?,00E24B57,?,?,?,?,00000000,?), ref: 00E24AA0
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 00E24AB0

Strings

T*, xrefs: 00E24B0C
SOFTWARE\ReSound\Aventa3, xrefs: 00E24AD1
RegCreateKeyTransactedW, xrefs: 00E24AAA
Advapi32.dll, xrefs: 00E24A9B

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedW$SOFTWARE\ReSound\Aventa3$T*
API String ID: 1646373207-1258704450
Opcode ID: 35434b67b706c5c80e1d30cecd660ff1f5c7490a555163db720d9c83c6989418
Instruction ID: f70fa0a21ede88318047a274015d18e374384dc6360217114c2e20e2dec35c11
Opcode Fuzzy Hash: 35434b67b706c5c80e1d30cecd660ff1f5c7490a555163db720d9c83c6989418
Instruction Fuzzy Hash: 8F018FB1240318ABEB248F95EC4AFD67BE4EB0571AF105419FA047A1C1C7F5D868CB94

Function 00E34218 Relevance: 9.3, APIs: 6, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00E3502F: GetLastError.KERNEL32(?,?,00E2C109,?,00000000,?,00E2C5E9,?), ref: 00E35033
Part of subcall function 00E3502F: _free.LIBCMT ref: 00E35066
Part of subcall function 00E3502F: SetLastError.KERNEL32(00000000,?,00E2C5E9,?), ref: 00E350A7
Part of subcall function 00E3502F: _abort.LIBCMT ref: 00E350AD

_memcmp.LIBVCRUNTIME ref: 00E344C2
_free.LIBCMT ref: 00E34533
_free.LIBCMT ref: 00E3454C
_free.LIBCMT ref: 00E3457E
_free.LIBCMT ref: 00E34587
_free.LIBCMT ref: 00E34593

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: _free$ErrorLast$_abort_memcmp
String ID:
API String ID: 1679612858-0
Opcode ID: 475018c02799691c9ecf5ec898876465ea9d40906a789d48aaee4ee1d9a1fa34
Instruction ID: c89dace504c961d1413b66816c65e877a299f1faa4ad71f8c230699e7a88ce7f
Opcode Fuzzy Hash: 475018c02799691c9ecf5ec898876465ea9d40906a789d48aaee4ee1d9a1fa34
Instruction Fuzzy Hash: B4B139B59012199FDB24DF18C889BADBBB4FF48304F1055AAE949B73A1D731AE90CF40

Function 00E21E10 Relevance: 9.1, APIs: 6, Instructions: 94COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00E21E3D
std::_Lockit::_Lockit.LIBCPMT ref: 00E21E60
std::_Lockit::~_Lockit.LIBCPMT ref: 00E21E80
__CxxThrowException@8.LIBVCRUNTIME ref: 00E21EF9
std::_Facet_Register.LIBCPMT ref: 00E21F0F
std::_Lockit::~_Lockit.LIBCPMT ref: 00E21F1A

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_RegisterThrow
String ID:
API String ID: 2536120697-0
Opcode ID: c3f3792ef588f246497c8d8a6fe6735c295307348a658a04971a117f2db688b1
Instruction ID: f7c4b6d368ab16e8f819ef4a4c782777bb474cd31f240a1c8625b85dddeeb351
Opcode Fuzzy Hash: c3f3792ef588f246497c8d8a6fe6735c295307348a658a04971a117f2db688b1
Instruction Fuzzy Hash: 6731D072A00224DFDB14DF54EC41AAEB7B4FF14324F19169AE805B7391DB31AE05CB90

Function 00E3502F Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00E2C109,?,00000000,?,00E2C5E9,?), ref: 00E35033
_free.LIBCMT ref: 00E35066
_free.LIBCMT ref: 00E3508E
SetLastError.KERNEL32(00000000,?,00E2C5E9,?), ref: 00E3509B
SetLastError.KERNEL32(00000000,?,00E2C5E9,?), ref: 00E350A7
_abort.LIBCMT ref: 00E350AD

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ErrorLast$_free$_abort
String ID:
API String ID: 3160817290-0
Opcode ID: 340246fedc1289771e1c3be8295e2753626c8728155dd3cf2c5f910f61d50d04
Instruction ID: d7fbb3cb05283e63ebb1cc0fc2b6c37447e8947ec69fdd9c4611d51b6b891c3f
Opcode Fuzzy Hash: 340246fedc1289771e1c3be8295e2753626c8728155dd3cf2c5f910f61d50d04
Instruction Fuzzy Hash: 67F04937505B002FD73933369C0EE5E1EA99FC2775F252018F404B23D2EE228806C491

Function 00E1CBE0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 157COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00E1CCE3

Part of subcall function 00E15020: GetLocalTime.KERNEL32(?,75BF73E0,?,?,?,?,?,?,00E12EED,?), ref: 00E1503B

#111.MSI(?,00E58924,00000000), ref: 00E1CCAD

Part of subcall function 00E1D8D0: _wcsstr.LIBVCRUNTIME ref: 00E1D955
Part of subcall function 00E1D8D0: _wcsstr.LIBVCRUNTIME ref: 00E1D969

Strings

sUpdates=%s, xrefs: 00E1CD6F
%s=false, xrefs: 00E1CCDD
sKeeps=%s, xrefs: 00E1CDD0

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: _wcsstr$#111LocalTimewsprintf
String ID: %s=false$sKeeps=%s$sUpdates=%s
API String ID: 1346525361-486326842
Opcode ID: 733f7f897ac8b6db729e132ede01662665a6d760607de76964fddd9d559958f7
Instruction ID: 6ebded3a10722c9f879a8fc6d54b71959ec728f46e1f21facc584eab6bb43a59
Opcode Fuzzy Hash: 733f7f897ac8b6db729e132ede01662665a6d760607de76964fddd9d559958f7
Instruction Fuzzy Hash: 6C5151719002289BCB24EF14DD45AADB7F4FF84715F10A5A9E889B7291DF709A88CFC1

Function 00E25AAA Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

__Getcvt.LIBCPMT ref: 00E25B02
MultiByteToWideChar.KERNEL32(00000000,00000009,00000001,00000002,?,00000000,?,00000001,00000000,?,invalid string position,F9744ECF,00000000,?,00E23B35,00000000), ref: 00E25B50
MultiByteToWideChar.KERNEL32(00000000,00000009,?,?,?,00000000,?,00000001,00000000,?,invalid string position,F9744ECF,00000000,?,00E23B35,00000000), ref: 00E25BC2
MultiByteToWideChar.KERNEL32(00000000,00000009,?,00000001,?,00000000,?,00000001,00000000,?,invalid string position,F9744ECF,00000000,?,00E23B35,00000000), ref: 00E25BEA

Strings

_<, xrefs: 00E25BD2, 00E25B9C, 00E25B65, 00E25B5A, 00E25B18

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ByteCharMultiWide$Getcvt
String ID: _<
API String ID: 3195005509-2997813957
Opcode ID: 1fe9c40802413f1c5412a81bec5503f84a80132ee3b80a1183deb3dc1d76a5a0
Instruction ID: a802a3a9893acddc3218cbf4a76196a91365e666da59ea112393d7c2ba0977ca
Opcode Fuzzy Hash: 1fe9c40802413f1c5412a81bec5503f84a80132ee3b80a1183deb3dc1d76a5a0
Instruction Fuzzy Hash: A0411472600B69EFDB218F65E981BAAB7F9FF02314F24552AF811AB290D771DC40CB10

Function 00E39552 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,99E85006,00E2D0E8,00000000,00000000,00E2E259,?,Y,?,00000001,00E2D0E8,99E85006,00000001,00E2E259,00E2E259), ref: 00E3959F
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00E39628
GetStringTypeW.KERNEL32(?,00000000,00000000,?), ref: 00E3963A
__freea.LIBCMT ref: 00E39643

Part of subcall function 00E31E61: RtlAllocateHeap.NTDLL(00000000,00000003,00000000,?,00000003,00E350B2,?,00E2C5E9,?), ref: 00E31E93

Strings

Y, xrefs: 00E39565

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID: Y
API String ID: 2652629310-3314497812
Opcode ID: 9de6cfbe8b97be575b2d1834bf0d48509aa39d630b50cfbbc73baed7e61e1a14
Instruction ID: 2b37521f31f6e0bcaca351f58e34e0578a13e53e6bf1deeaee02b1ff2fd40b96
Opcode Fuzzy Hash: 9de6cfbe8b97be575b2d1834bf0d48509aa39d630b50cfbbc73baed7e61e1a14
Instruction Fuzzy Hash: 7E310172A0121AAFDF258F65DC8ADAE7BA5EF41314F144168FC04EB252E735CC55CBA0

Function 00E11220 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 68registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\dotnet\Setup\InstalledVersions\x86\sharedfx\Microsoft.WindowsDesktop.App,00000000,00020019,?), ref: 00E1124E
RegEnumValueW.ADVAPI32(?,00000000,?,00000208,00000000,?,?,?), ref: 00E112A0
RegCloseKey.ADVAPI32(?), ref: 00E112E7

Strings

SOFTWARE\dotnet\Setup\InstalledVersions\x86\sharedfx\Microsoft.WindowsDesktop.App, xrefs: 00E11244
8.0, xrefs: 00E112BD

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: CloseEnumOpenValue
String ID: 8.0$SOFTWARE\dotnet\Setup\InstalledVersions\x86\sharedfx\Microsoft.WindowsDesktop.App
API String ID: 4012628704-2633004180
Opcode ID: 1f8251df3c3e251a5fd842b05631d89b6ee54edf0b09119cbef538637cb00548
Instruction ID: dc7180f09edff9993979f178247ad8651a2a07540355a29e32afe31e9e543275
Opcode Fuzzy Hash: 1f8251df3c3e251a5fd842b05631d89b6ee54edf0b09119cbef538637cb00548
Instruction Fuzzy Hash: 5321277598022CAADB308B51DC8CFDAB3BCEB15304F0011E5EA09F2151EA319F88DF91

Function 00E11420 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\HIMSA\Installationinfo\Noah\v4,00000000,00020019,?), ref: 00E1144C
RegQueryValueExW.ADVAPI32(00000000,Installed,00000000,?,00000000,?), ref: 00E11475
RegCloseKey.ADVAPI32(00000000), ref: 00E11492

Strings

SOFTWARE\HIMSA\Installationinfo\Noah\v4, xrefs: 00E11439
Installed, xrefs: 00E1146F

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Installed$SOFTWARE\HIMSA\Installationinfo\Noah\v4
API String ID: 3677997916-3839896131
Opcode ID: 0bc6bd586ba2219243ab62b80a5e317117bb1b21858a11973b1ffb88d974b448
Instruction ID: 9b0814f3a802957ccaeac6b8560327bae9a6b7182d273e7987dd30fbeacef04e
Opcode Fuzzy Hash: 0bc6bd586ba2219243ab62b80a5e317117bb1b21858a11973b1ffb88d974b448
Instruction Fuzzy Hash: 0901D87194121CBFDB30CFD49C45BEEB3BCAB06B19F1051C6EA14B3140D3716A489AA5

Function 00E3323A Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00E3322F,00000003,?,00E331CF,00000003,00E5B790,0000000C,00E332E2,00000003,00000002), ref: 00E3325A
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00E3326D
FreeLibrary.KERNEL32(00000000,?,?,?,00E3322F,00000003,?,00E331CF,00000003,00E5B790,0000000C,00E332E2,00000003,00000002,00000000), ref: 00E33290

Strings

CorExitProcess, xrefs: 00E33265
mscoree.dll, xrefs: 00E33253

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 140b4612b37130443d2554d2bb8528fed0a33d6a27eda65e64864890bee9a6d5
Instruction ID: 49f6ac61611251577f1e1b6bf4350e81b4234410b594adad007b3298e6ad62a6
Opcode Fuzzy Hash: 140b4612b37130443d2554d2bb8528fed0a33d6a27eda65e64864890bee9a6d5
Instruction Fuzzy Hash: 0BF04434904218BFDB159FA5DC09FAEBFB5EF05756F000168F805B6160CB708E45CB95

Function 00E39F08 Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d016166e07be4ee9a84f7e3520df9745307e13eaee2543219158e51b98a87556
Instruction ID: 4d6e85017a8cf6791bfffb9802e7e18e5edc690bab51a6811ae043cbd67a2ce5
Opcode Fuzzy Hash: d016166e07be4ee9a84f7e3520df9745307e13eaee2543219158e51b98a87556
Instruction Fuzzy Hash: FD71D2B19012169BCB249F55CC48ABFBF75EF51354F286239E891B7281D7708DC1CB62

Function 00E348DB Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00E3494D
_free.LIBCMT ref: 00E3496D

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: db6acd16b34335b912f17c2ea73f7a1134f064409bdb33e6cc30e5cf4e0f8cf2
Instruction ID: afdcf04023608b0ea29cff6d8293b121e0079158bd6076c9e946c67c85ef4968
Opcode Fuzzy Hash: db6acd16b34335b912f17c2ea73f7a1134f064409bdb33e6cc30e5cf4e0f8cf2
Instruction Fuzzy Hash: BA41D5B2A002149FCB24DF78C885A6EBBF5EF85314F1556A9E515FB381EB31AD02CB40

Function 00E116A0 Relevance: 7.6, APIs: 5, Instructions: 93processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00E116E0
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00E116F0
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 00E11791
Process32NextW.KERNEL32(00000000,?), ref: 00E1179D
CloseHandle.KERNEL32(00000000), ref: 00E117A8

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextOpenProcessSnapshotToolhelp32
String ID:
API String ID: 1181503618-0
Opcode ID: 46270ff30ad29071eacb18af6c18d885fadbab3cdc67a05f14eff7c5699f4bf9
Instruction ID: e2d9ab697a18e586e2993255d35f4c0b1ef1155524b5755c7ed68a69d31458fc
Opcode Fuzzy Hash: 46270ff30ad29071eacb18af6c18d885fadbab3cdc67a05f14eff7c5699f4bf9
Instruction Fuzzy Hash: CE218C76A012186AD720EB659C46FDE73FCFF45701F0011A6F609F6141DE349B998B61

Function 00E350B3 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,00000000,00000000,00E2C006,00000000,?,?,00E2C08A,00000000,00000000,00000000,00000000,00000000,?,00E25685), ref: 00E350B8
_free.LIBCMT ref: 00E350ED
_free.LIBCMT ref: 00E35114
SetLastError.KERNEL32(00000000), ref: 00E35121
SetLastError.KERNEL32(00000000), ref: 00E3512A

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: c88986d12d3989bcec8cbb4090766b329e58aba63b0c9413d68e6be7de1303a1
Instruction ID: 4d6e66887680cf5699d8a3d1fea60b4158658bec7818cf0a6a874eb1969c582f
Opcode Fuzzy Hash: c88986d12d3989bcec8cbb4090766b329e58aba63b0c9413d68e6be7de1303a1
Instruction Fuzzy Hash: 8601213B142F002AD32A63365C8EA5B2EA9DFC6375F302428F414B2392EE24880AC161

Function 00E3D042 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00E3D05A

Part of subcall function 00E32695: HeapFree.KERNEL32(00000000,00000000,?,00E3D2F5,?,00000000,?,00000000,?,00E3D599,?,00000007,?,?,00E3D93D,?), ref: 00E326AB
Part of subcall function 00E32695: GetLastError.KERNEL32(?,?,00E3D2F5,?,00000000,?,00000000,?,00E3D599,?,00000007,?,?,00E3D93D,?,?), ref: 00E326BD

_free.LIBCMT ref: 00E3D06C
_free.LIBCMT ref: 00E3D07E
_free.LIBCMT ref: 00E3D090
_free.LIBCMT ref: 00E3D0A2

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e98d56a80bfb8949fd4d56358726b67ed5bff62e50b6c9eeec139c8eb1d9d912
Instruction ID: 7c15886139ce9fd42441d8252bc08e007ab78b31229b7672239fee77c7cb7c86
Opcode Fuzzy Hash: e98d56a80bfb8949fd4d56358726b67ed5bff62e50b6c9eeec139c8eb1d9d912
Instruction Fuzzy Hash: C9F03C725097006B8638EB65FD8AC5A7BEBAF44B29F982809F144FB550CA30FC81CA55

Function 00E34B2D Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E34B4B

Part of subcall function 00E32695: HeapFree.KERNEL32(00000000,00000000,?,00E3D2F5,?,00000000,?,00000000,?,00E3D599,?,00000007,?,?,00E3D93D,?), ref: 00E326AB
Part of subcall function 00E32695: GetLastError.KERNEL32(?,?,00E3D2F5,?,00000000,?,00000000,?,00E3D599,?,00000007,?,?,00E3D93D,?,?), ref: 00E326BD

_free.LIBCMT ref: 00E34B5D
_free.LIBCMT ref: 00E34B70
_free.LIBCMT ref: 00E34B81
_free.LIBCMT ref: 00E34B92

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: da247b23af90f801b8707261c3f9910d8e4c05563feaa408c01fcfd405612d42
Instruction ID: 0d3d86c815518a560e17cb4f27352c7a553db623f41d18e838af381b8723b7b8
Opcode Fuzzy Hash: da247b23af90f801b8707261c3f9910d8e4c05563feaa408c01fcfd405612d42
Instruction Fuzzy Hash: 4DF030B04153108F871E6F26BC4B4183FB1FB09726B081949F5587A371DF711A49CB87

Function 00E23320 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00E233F3
std::_Xinvalid_argument.LIBCPMT ref: 00E233FD
__Wcrtomb.LIBCPMT ref: 00E23444

Strings

string too long, xrefs: 00E233EE, 00E233F8

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Wcrtomb
String ID: string too long
API String ID: 1459785110-2556327735
Opcode ID: e92fcd803b7ba08daa7e6804b89088cb36938b7c5d795ab6e123f74eefa42f78
Instruction ID: 35c17d97f82cb73701cbf01fd9996c74ca7accdd7722fc90e503d5f4cf13033d
Opcode Fuzzy Hash: e92fcd803b7ba08daa7e6804b89088cb36938b7c5d795ab6e123f74eefa42f78
Instruction Fuzzy Hash: E151D772700224DBCB24DF6CF8819AEB3F8FF58711B10556FE956E7241DA319A14CBA0

Function 00E18C70 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

#70.MSI(?,VersionMajor,?,?), ref: 00E18D3C
#70.MSI(?,VersionMinor,?,?), ref: 00E18D5C

Strings

VersionMinor, xrefs: 00E18D56
VersionMajor, xrefs: 00E18D30

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID:
String ID: VersionMajor$VersionMinor
API String ID: 0-2995207800
Opcode ID: 45d315c603d2c4e0b8adc0f3dff1e29430dfb906d61e661e56cc9ac70971f500
Instruction ID: 78f8013cdb8ec620cc5cca016f2f0275f77553d70873c6585a6a833316152984
Opcode Fuzzy Hash: 45d315c603d2c4e0b8adc0f3dff1e29430dfb906d61e661e56cc9ac70971f500
Instruction Fuzzy Hash: 2B5126B590021C8ADB24DB10DD45BFAB3B9EF55304F4445E9D90ABB282DF32AF85CB64

Function 00E18C62 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 149COMMON

Download Yara Rule

APIs

#70.MSI(?,VersionMajor,?,?), ref: 00E18D3C
#70.MSI(?,VersionMinor,?,?), ref: 00E18D5C

Strings

VersionMinor, xrefs: 00E18D56
VersionMajor, xrefs: 00E18D30

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID:
String ID: VersionMajor$VersionMinor
API String ID: 0-2995207800
Opcode ID: ba9183e36ba304b0cb0464ae7a3e1c99c5302dcb2f76cd84879449a58eddadbb
Instruction ID: e612ccc26e7cd0126b3f0cd7a7493590a043e9565a24fabeffb190dfcdf8de00
Opcode Fuzzy Hash: ba9183e36ba304b0cb0464ae7a3e1c99c5302dcb2f76cd84879449a58eddadbb
Instruction Fuzzy Hash: 215127B590021C9ADB24DB10CD45FEAB3BDEF55304F4445E5DA0ABB182EB31AF86CB64

Function 00E37014 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E3716D
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00E37182

Strings

o, xrefs: 00E3717C
o, xrefs: 00E3708F

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: o$o
API String ID: 885266447-2774027131
Opcode ID: 0db5bd88e037f7f0837ced7c33efb990530580da5dfda529b61d2c2409944ff3
Instruction ID: 5081e22fa08cebe354a601b15d47d34f9f8addcddbf11476e9f846aabc07b62a
Opcode Fuzzy Hash: 0db5bd88e037f7f0837ced7c33efb990530580da5dfda529b61d2c2409944ff3
Instruction Fuzzy Hash: D55171B2A04209AFCB28DF59C888AADBFF2EF84314F199159E858A7361D7319D41DB40

Function 00E214E0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00E215E6
std::_Xinvalid_argument.LIBCPMT ref: 00E215F0

Strings

invalid string position, xrefs: 00E215D7
string too long, xrefs: 00E215E1, 00E215EB

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 909987262-4289949731
Opcode ID: 9d95002b8d9bddf61ca7ee85b23cb444565022be56900eb2ce8fe49128aa19b0
Instruction ID: 4231f48698aebf533c573a0a3801528141a00222889bd7db8e1be3bdda59f489
Opcode Fuzzy Hash: 9d95002b8d9bddf61ca7ee85b23cb444565022be56900eb2ce8fe49128aa19b0
Instruction Fuzzy Hash: C931E4327447249B8B24DF58F88186AB3F9FFE475431069AFF443EB250DA31EA048794

Function 00E32A93 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\Desktop\Setup.exe,00000104), ref: 00E32ACE
_free.LIBCMT ref: 00E32B99
_free.LIBCMT ref: 00E32BA3

Strings

C:\Users\user\Desktop\Setup.exe, xrefs: 00E32AC5, 00E32ACC, 00E32AFB, 00E32B33

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\Users\user\Desktop\Setup.exe
API String ID: 2506810119-2320538190
Opcode ID: 0b63f07c6d5c01e605cb5a4ad639d25c80bfa432d86e7ac9cbadf1dea2c1e4af
Instruction ID: 16c8f5a756b635b622d25b6a27329ab702c425162a029a35dbb2b0f80a0fc05e
Opcode Fuzzy Hash: 0b63f07c6d5c01e605cb5a4ad639d25c80bfa432d86e7ac9cbadf1dea2c1e4af
Instruction Fuzzy Hash: FF318171A00318AFCB25DF9ADC89C9EBFF8EB89314F1050AAEA44B7210D6715E45CB90

Function 00E236C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 108COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00E237A8
std::_Xinvalid_argument.LIBCPMT ref: 00E237B2

Strings

invalid string position, xrefs: 00E23799
string too long, xrefs: 00E237A3, 00E237AD

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 909987262-4289949731
Opcode ID: eb57b14b016541a57c9e540da04d3632e7b85aaf0ef04a0b15150412e293940f
Instruction ID: b11371fbd3fa42e168047aec918fbd8e0ef91e4f502e08dbfd406af931071d03
Opcode Fuzzy Hash: eb57b14b016541a57c9e540da04d3632e7b85aaf0ef04a0b15150412e293940f
Instruction Fuzzy Hash: EB31A2B63017208FDB24CE6CF840A6BB3E5EF95711B10192FE552E7681C771D9408BA5

Function 00E1BA30 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000400), ref: 00E1BAAC
GetLongPathNameW.KERNEL32(?,?,00000400), ref: 00E1BABF
GetFileAttributesW.KERNEL32(?), ref: 00E1BB3E

Strings

Markets, xrefs: 00E1BB13

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: FileName$AttributesLongModulePath
String ID: Markets
API String ID: 489188955-3631104298
Opcode ID: 0f1f1cd85c24c232d61d943448195829c8252444dfb6198a7985bfd86014cc49
Instruction ID: f2092e77ac4b7b7f8c68e6aac0a78c45887b772f31750b8ddde84a48b9f56fff
Opcode Fuzzy Hash: 0f1f1cd85c24c232d61d943448195829c8252444dfb6198a7985bfd86014cc49
Instruction Fuzzy Hash: 3A31F1B6D5031CAAEB11DBA0DC86FDA73BCAB08701F5056D1B709F60C1DA70AB49CB64

Function 00E11300 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 83registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\HIMSA\Installationinfo\NOAH Engine,00000000,00020019,?), ref: 00E11376

Part of subcall function 00E256A0: RegQueryValueExW.ADVAPI32(00000000,Major,00000000,?,?,?,?,00000000,?,00E113B1,?,?,00000104), ref: 00E256CA

RegCloseKey.ADVAPI32(00000000,?,?,00000104), ref: 00E113F6

Strings

,#, xrefs: 00E113B5
SOFTWARE\HIMSA\Installationinfo\NOAH Engine, xrefs: 00E1136C

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: ,#$SOFTWARE\HIMSA\Installationinfo\NOAH Engine
API String ID: 3677997916-2636575691
Opcode ID: 9f89cff8e75493e6566c01e36b9033e4b0e41ba732f7db2ae5830cee1989f491
Instruction ID: 435835bbad77b88c9aa38f287ed148e615b147b16b60f3793be9fd34624746f4
Opcode Fuzzy Hash: 9f89cff8e75493e6566c01e36b9033e4b0e41ba732f7db2ae5830cee1989f491
Instruction Fuzzy Hash: 4B21F8B194122C9ADB20EF50DC49BEAB3B4EB35308F5111E6D919B7241E7715E84CE90

Function 00E24E90 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 57memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(00000000), ref: 00E24EE6
SysAllocString.OLEAUT32(00E13DD8), ref: 00E24F02
VariantClear.OLEAUT32 ref: 00E24F21

Strings

`<u, xrefs: 00E24EE6

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: String$AllocClearFreeVariant
String ID: `<u
API String ID: 1665868789-3367579956
Opcode ID: f794fee0e12c74f39edf0a418b25521bd214e4d385ab304d3da4c95dbb380478
Instruction ID: 70e3766a12041a7579891de8d1ecc05ca06e73e4495c064b9cf827b456df1ebf
Opcode Fuzzy Hash: f794fee0e12c74f39edf0a418b25521bd214e4d385ab304d3da4c95dbb380478
Instruction Fuzzy Hash: 8C115E72904618EFDB14CF6ADD08B9ABBECFB46724F10825AF814E7750D7B599018B90

Function 00E188E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(Startup,UpgradeCode,00E52748,?,00000400,?), ref: 00E1898E

Strings

UpgradeCode, xrefs: 00E18984
Startup, xrefs: 00E18989
Setup.ini, xrefs: 00E18959

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: PrivateProfileString
String ID: Setup.ini$Startup$UpgradeCode
API String ID: 1096422788-3103580541
Opcode ID: afc31eb6822c728d63356f9976b165a8a3c87f01b78b7359b2a2be4ccc7e64ed
Instruction ID: f329fa544e56ea30fe7bab618b3ac16e9d5d42b1d80607706ccaf02adda57564
Opcode Fuzzy Hash: afc31eb6822c728d63356f9976b165a8a3c87f01b78b7359b2a2be4ccc7e64ed
Instruction Fuzzy Hash: 3411A7F1A402186BCB20DB94DD06FEA73F8EB04705F45A4A1EB49B71C0EE706A5D87D5

Function 00E189B0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(Startup,PackageCode,00E52748,?,00000400,?), ref: 00E18A5E

Strings

PackageCode, xrefs: 00E18A54
Startup, xrefs: 00E18A59
Setup.ini, xrefs: 00E18A29

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: PrivateProfileString
String ID: PackageCode$Setup.ini$Startup
API String ID: 1096422788-2852067979
Opcode ID: 08c543c8a01f13b134d1bedba35612af038cb4c6b927ee17723035e83304c06f
Instruction ID: d76179de192d6f10e2ec8356a2027dff75ed45e3902616bf2d87131f290788fc
Opcode Fuzzy Hash: 08c543c8a01f13b134d1bedba35612af038cb4c6b927ee17723035e83304c06f
Instruction Fuzzy Hash: 2E11A7F1A403186BCB20DB94DD06FEA73F8EB04705F45A4A1EA49B71C0EE706A5D87D5

Function 00E257A5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00E25780: InitializeCriticalSectionEx.KERNEL32(?,00000000,00000000,00E257D4,?,?,?,00E1100A), ref: 00E25785
Part of subcall function 00E25780: GetLastError.KERNEL32(?,?,?,00E1100A), ref: 00E2578F

IsDebuggerPresent.KERNEL32(?,?,?,00E1100A), ref: 00E257D8
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,00E1100A), ref: 00E257E7

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00E257E2
b, xrefs: 00E257C8

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule$b
API String ID: 3511171328-4164368264
Opcode ID: bcba7fe18981b493863d82c127cc13084cd606b12707a98b5cb08e1483e65375
Instruction ID: 0683580cf28b700977b1ad5d9fa5d18716d39467e62c60d835cdc5995b026547
Opcode Fuzzy Hash: bcba7fe18981b493863d82c127cc13084cd606b12707a98b5cb08e1483e65375
Instruction Fuzzy Hash: 89E06D71200B618FC334DF26F5093467AE4AB06344F00982EE492F2650EBF4D4888BA2

Function 00E35672 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00E356FD
__alldvrm.LIBCMT ref: 00E358FE
__alldvrm.LIBCMT ref: 00E35920

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: ddb67ea5e7390498592550945761c74f9022e2f8b1ae10fba023ebbbe9c96b51
Instruction ID: d0585446d9e555ff32e54025c8360ec37a19362ac995e9524cedbdf2d1b0f989
Opcode Fuzzy Hash: ddb67ea5e7390498592550945761c74f9022e2f8b1ae10fba023ebbbe9c96b51
Instruction Fuzzy Hash: AFA13373A00B86DFEB258F28C8867BEBFE5EF55314F24516EE495AB381C2348941C750

Function 00E1D8D0 Relevance: 6.2, APIs: 4, Instructions: 232COMMON

Download Yara Rule

APIs

_wcsstr.LIBVCRUNTIME ref: 00E1D955
_wcsstr.LIBVCRUNTIME ref: 00E1D969
_wcsstr.LIBVCRUNTIME ref: 00E1DA06

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: _wcsstr
String ID:
API String ID: 1512112989-0
Opcode ID: 791109fb9614cba2f59bae7c047191e4be5d86144869c9c1133bba8f579bddd0
Instruction ID: 3ea93f4373b05d0ecff6a98521bc3bac919140736f3721891ec4c6b10dc66791
Opcode Fuzzy Hash: 791109fb9614cba2f59bae7c047191e4be5d86144869c9c1133bba8f579bddd0
Instruction Fuzzy Hash: 3371C175E0861A8FCF14DFA8DD819EEB7B5EF88304B155169DD05B7200EB70AE45CB90

Function 00E43278 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00E433A7

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: e61f259f34bf3a954350fc2a873c530e588ffbb2917e9b2ced9946a5558c538e
Instruction ID: 7557591c710bb7dc3a78e3dc6d12f1417a2b5aa7f3cb4e4455c9879789955be2
Opcode Fuzzy Hash: e61f259f34bf3a954350fc2a873c530e588ffbb2917e9b2ced9946a5558c538e
Instruction Fuzzy Hash: 68413931A00210ABDB316FBDAC4AAAE3EE5EF41374F246659F438F7191DE344E019262

Function 00E25350 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00E253D4

Part of subcall function 00E278AD: __CxxThrowException@8.LIBVCRUNTIME ref: 00E278C4

Concurrency::cancel_current_task.LIBCPMT ref: 00E253E9
new.LIBCMT ref: 00E253EF
new.LIBCMT ref: 00E25403

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Concurrency::cancel_current_task$Exception@8Throw
String ID:
API String ID: 3339364867-0
Opcode ID: f3c91ac5e71468208783491a5b7dca96217866e04bf46314a8f99bfef4c115ec
Instruction ID: d0497284b4c0931e10a0a44a2dc5a48510098ad5a90af5fadb6af174d3c778b4
Opcode Fuzzy Hash: f3c91ac5e71468208783491a5b7dca96217866e04bf46314a8f99bfef4c115ec
Instruction Fuzzy Hash: 8641E772604A20DBC724EF24FA8166AF7F5EB44355B20272DE463E7390EB709944C7A1

Function 00E37E36 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,00E37DDD,?,00000000,00000000,00000000,?,00E38095,00000006,FlsSetValue), ref: 00E37E68
GetLastError.KERNEL32(?,00E37DDD,?,00000000,00000000,00000000,?,00E38095,00000006,FlsSetValue,00E4BEC8,00E4BED0,00000000,00000364,?,00E35101), ref: 00E37E74
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,00E37DDD,?,00000000,00000000,00000000,?,00E38095,00000006,FlsSetValue,00E4BEC8,00E4BED0,00000000), ref: 00E37E82

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 23ff6b866146e4f8e4f56514cc3e1571514778bcf1fbf41731818e8c2ca3958a
Instruction ID: 17442b4125d034ffab359aa53f9526f8f55f73dd5b9a5f0b8034bcdacd29e325
Opcode Fuzzy Hash: 23ff6b866146e4f8e4f56514cc3e1571514778bcf1fbf41731818e8c2ca3958a
Instruction Fuzzy Hash: AE01D47661A322AFC7314B6BDC489577F98AF46BA1B210668F98AF3241D720DC05C6E0

Function 00E27D7A Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00E27D91

Part of subcall function 00E283C9: ___AdjustPointer.LIBCMT ref: 00E28413

_UnwindNestedFrames.LIBCMT ref: 00E27DA8
___FrameUnwindToState.LIBVCRUNTIME ref: 00E27DBA
CallCatchBlock.LIBVCRUNTIME ref: 00E27DDE

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: CatchUnwind$AdjustBlockBuildCallFrameFramesNestedObjectPointerState
String ID:
API String ID: 2633735394-0
Opcode ID: 19d28792bf5ad10568d26a9260ad0be167e286851862e4513cb67c6fa0c2f46d
Instruction ID: b344ab17275497a74e19cb47190fc4806d20f745953e67fd62ab3af915741dd5
Opcode Fuzzy Hash: 19d28792bf5ad10568d26a9260ad0be167e286851862e4513cb67c6fa0c2f46d
Instruction Fuzzy Hash: ED01E532000129BBCF129F55EC01EEA7BBAFF49754F15A014FD5876121D772E8A1EBA0

Function 00E252F0 Relevance: 6.0, APIs: 4, Instructions: 40COMMON

Download Yara Rule

APIs

new.LIBCMT ref: 00E2531A

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ab4bb586d9406ce3075532d00346e5fbac91d128ee3bcd05abf8e932d62cc2d1
Instruction ID: e64bb81afd621619908769d443a8096fe2f6f03a20d5677853b5c5af9c641b62
Opcode Fuzzy Hash: ab4bb586d9406ce3075532d00346e5fbac91d128ee3bcd05abf8e932d62cc2d1
Instruction Fuzzy Hash: C3F020F36082300B9B0CF374BC5793E73C8CB203A87102239F01AE6285F932E814C269

Function 00E2B944 Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00E2B944
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 00E2B949
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00E2B94E

Part of subcall function 00E2BCBE: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 00E2BCCF

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00E2B963

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: 7041c0a9c5153094988800ed5fbccf238efb4d57f388d269b370a6803fb669da
Instruction ID: e4ac869e25fb50f75a70e2dc5c88318f545eb20dbb5800a629183198da97af5b
Opcode Fuzzy Hash: 7041c0a9c5153094988800ed5fbccf238efb4d57f388d269b370a6803fb669da
Instruction Fuzzy Hash: 4CC04C54044272501C243BB131132AE93D41CD6BC9B9034C1FAAA374135F06148A5237

Function 00E3248D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00E3251D

Strings

pow, xrefs: 00E324F5, 00E32512

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: e8dcedfda6431aa05b69925b0e60590b7eb1988bf32891f73a5f6afa48742ee2
Instruction ID: bd7143550ec00998550540abbd54b7a8bd79a0f73879b8b07f288d4ca1df16f6
Opcode Fuzzy Hash: e8dcedfda6431aa05b69925b0e60590b7eb1988bf32891f73a5f6afa48742ee2
Instruction Fuzzy Hash: 8351BB71A05205AACB117B14C91E3BE2FD0DB40704F30AD5DE2C7B62B9EB708D95DA47

Function 00E23AD0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 171COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00E23BEB

Strings

invalid string position, xrefs: 00E23BD2, 00E23BDC
string too long, xrefs: 00E23BE6

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 909987262-4289949731
Opcode ID: e40af0bf6662129aed4f4a33d9a0c4896c0e3f06c38dab908e192a1928c7cbc1
Instruction ID: 02f4b62211d36eb8cb63b375759f8a4837d935808d471fb7f6379aacd8f6b6b8
Opcode Fuzzy Hash: e40af0bf6662129aed4f4a33d9a0c4896c0e3f06c38dab908e192a1928c7cbc1
Instruction Fuzzy Hash: 3241E8323007208BD7349E7CF881A5AF7E9EF94711F20192FE556A7681C775DD408BA5

Function 00E235A0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00E236A4
std::_Xinvalid_argument.LIBCPMT ref: 00E236AE

Strings

string too long, xrefs: 00E2369F, 00E236A9

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: string too long
API String ID: 909987262-2556327735
Opcode ID: 418bc580028e8b792d14a6d938b9606b4f97ea9272273051a98140c37f5b5128
Instruction ID: a2b4a328296a4cbe22a42c2caafff8a022e7d6c52710dd1c83e92154ae53ef28
Opcode Fuzzy Hash: 418bc580028e8b792d14a6d938b9606b4f97ea9272273051a98140c37f5b5128
Instruction Fuzzy Hash: 323129323406305BD734D96CB88096AF3EDEB95721B202D2EE596F7781CB25DD448BA0

Function 00E251D0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 121COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00E252E5

Strings

invalid string position, xrefs: 00E251BD, 00E252CC, 00E252D6
string too long, xrefs: 00E252E0

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 909987262-4289949731
Opcode ID: 52055a585d57704e42fc5eaa0a93e835eedac5d7d83859932ad089267695565e
Instruction ID: c550b7d3234806f863ebe012fc815feb781af1b21cb6422c29f67796e718e4ce
Opcode Fuzzy Hash: 52055a585d57704e42fc5eaa0a93e835eedac5d7d83859932ad089267695565e
Instruction Fuzzy Hash: 0E318033305B24CB87249F98F98096AF3F9FFD4751310292FE456E76A1EB31A81487A5

Function 00E24740 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00E24817
std::_Xinvalid_argument.LIBCPMT ref: 00E24821

Strings

string too long, xrefs: 00E24812, 00E2481C

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: string too long
API String ID: 909987262-2556327735
Opcode ID: 34f10128ab795aa3e870e1e1ebeb1efd4ab204c09952fc1c5237b698fa0eaccc
Instruction ID: fb8fe2d0648d5e2cd59adcf60e0104ec6c801f3dd3adff2eb89921b707143e8e
Opcode Fuzzy Hash: 34f10128ab795aa3e870e1e1ebeb1efd4ab204c09952fc1c5237b698fa0eaccc
Instruction Fuzzy Hash: 53215C763147708BD7359E5CF440966F7E8EFA2714B10192FE5A2EB6C2C7B29804C7A1

Function 00E24320 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 91COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00E243D5
std::_Xinvalid_argument.LIBCPMT ref: 00E243DF

Strings

string too long, xrefs: 00E243D0, 00E243DA

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Xinvalid_argumentstd::_
String ID: string too long
API String ID: 909987262-2556327735
Opcode ID: 0b333499b39667639d60825085b490279672b6fee3f1d273909eb99a30096ff0
Instruction ID: 5c90ea91b3467ce90a9942403bc4be215581b2ade52b303a886d8479efea0dff
Opcode Fuzzy Hash: 0b333499b39667639d60825085b490279672b6fee3f1d273909eb99a30096ff0
Instruction Fuzzy Hash: 5E21D672304770DBC731DE5CB40066AFBE8EBA6721B10191FE5D1AB2D2C7729444C7A1

Function 00E3E016 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,00E3E271,00000000,00000050,?,?,?,?,?), ref: 00E3E0F1

Strings

ACP, xrefs: 00E3E034
OCP, xrefs: 00E3E06A

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: 730dcafd7c3b3de89dcb7358a6dfde90c9573bb44a399b6fbd6543b1226111db
Instruction ID: 9b5057f6861a1c86be905a9beed5e9b3898dd3fd42352c0408fbfcdb6a4655d1
Opcode Fuzzy Hash: 730dcafd7c3b3de89dcb7358a6dfde90c9573bb44a399b6fbd6543b1226111db
Instruction Fuzzy Hash: 9821F862A00100A6EB3C8F65D909BA77BA6DF94B58F565424F909FB380FB73DD41CB50

Function 00E36061 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00E360D9

Strings

H, xrefs: 00E360A6
D, xrefs: 00E36094

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: _free
String ID: D$H
API String ID: 269201875-841036128
Opcode ID: de43f3b3b7ce29269c3c83244770b84b786dff8682f1770c113f26df813d5ea6
Instruction ID: b8ae9e541cc2b8b3312bfd8d41acd905c177473e104de35e4d01fac4aa1028ce
Opcode Fuzzy Hash: de43f3b3b7ce29269c3c83244770b84b786dff8682f1770c113f26df813d5ea6
Instruction Fuzzy Hash: F811B771105302AFDB349F39D45AB577BE4EF54358F20A42DF54DA7242DB719841CB50

Function 00E24B30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(80000002,SOFTWARE\ReSound\Aventa3,00000000,00000000,00000000,0002001F,00000000,00000000,?), ref: 00E24B70
RegCloseKey.ADVAPI32(00000000), ref: 00E24B83

Part of subcall function 00E24A90: GetModuleHandleW.KERNEL32(Advapi32.dll,?,?,00E24B57,?,?,?,?,00000000,?), ref: 00E24AA0
Part of subcall function 00E24A90: GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 00E24AB0

Strings

SOFTWARE\ReSound\Aventa3, xrefs: 00E24B66

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: AddressCloseCreateHandleModuleProc
String ID: SOFTWARE\ReSound\Aventa3
API String ID: 1765684683-2604720436
Opcode ID: 5d107290dfad4a887e2a747d4d9ad972cfb58a371e1a8a18c8524d639f988365
Instruction ID: 49de5245303fd16a3843f0ca24205c3abee7fe6593c25d0888d24ef8c142e5e3
Opcode Fuzzy Hash: 5d107290dfad4a887e2a747d4d9ad972cfb58a371e1a8a18c8524d639f988365
Instruction Fuzzy Hash: 9201A4B5740315ABE734DF69EC06F96B7ECAB08700F20406DAA45F32C1EB70E9049B65

Function 00E24E50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00E24E67
SysFreeString.OLEAUT32 ref: 00E24E82

Strings

`<u, xrefs: 00E24E82

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: String$AllocFree
String ID: `<u
API String ID: 344208780-3367579956
Opcode ID: 982c3f8f64e8f9afcc2e653fd93bccb929132a299779e6c7ec6c617ab1236f93
Instruction ID: 7fcd5c19d9078cd4a0bd205e55f9e87d79a60dffa9c34412b3be6d2a65f5a93d
Opcode Fuzzy Hash: 982c3f8f64e8f9afcc2e653fd93bccb929132a299779e6c7ec6c617ab1236f93
Instruction Fuzzy Hash: FAE086B520071A9BCB245FB9E80454277D8EB16758B104435BB44EBA11E671D8108792

Function 00E12A28 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 7windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Could not create log file.,Setup,00000030), ref: 00E12A36

Strings

Setup, xrefs: 00E12A2A
Could not create log file., xrefs: 00E12A2F

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: Message
String ID: Could not create log file.$Setup
API String ID: 2030045667-1997299431
Opcode ID: d18691a758cf0bce94b7e1b9edf6ddbf76e08022d8e31ffc48924c847f1701b8
Instruction ID: 5900867e96007c3cab3854bc46d0ca398b3adf3618ecaff6c223404b13d84c35
Opcode Fuzzy Hash: d18691a758cf0bce94b7e1b9edf6ddbf76e08022d8e31ffc48924c847f1701b8
Instruction Fuzzy Hash: CAB012383C23023ED11413902C27F0424006743F03FA02548BB00BD1E062D01248C40F

Function 00E39C8C Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,F9744ECF,00000000,00000000,00000000,00000000,00E22B1F,00E22B1F,00000000,00000000,00000000,F9744ECF,008CEF00), ref: 00E39D22
GetLastError.KERNEL32 ref: 00E39D30
MultiByteToWideChar.KERNEL32(?,00000001,?,?,F9744ECF,00000000), ref: 00E39D8B

Memory Dump Source

Source File: 00000000.00000002.1779433342.0000000000E11000.00000020.00000001.01000000.00000003.sdmp, Offset: 00E10000, based on PE: true

Associated: 00000000.00000002.1779418342.0000000000E10000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779458961.0000000000E46000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779477317.0000000000E5D000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779491698.0000000000E5F000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1779505912.0000000000E61000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_e10000_Setup.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 812b67e1dfd4ab1cedf5e7e308bdf43eb0a594e2eca65766e7496ca29f8439be
Instruction ID: 8fe61a8031dcd3aecc674a87869f289354cb2e34390a91ae86f7862287ded865
Opcode Fuzzy Hash: 812b67e1dfd4ab1cedf5e7e308bdf43eb0a594e2eca65766e7496ca29f8439be
Instruction Fuzzy Hash: 77410731A00255AFCF219F75C849BAE7FB4EF42314F645159E8597B2A3DBB18C01C750

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Setup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\PatchInstaller.Log

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Statistics

CPU Usage

Memory Usage

System Behavior

Analysis Process: Setup.exePID: 7508, Parent PID: 2580

General

Chronological Activities

Disassembly

Analysis Process: Setup.exePID: 7508, Parent PID: 2580COMMON

Execution Graph

Graph

Executed Functions

Function 00E12D30 Relevance: 47.6, APIs: 18, Strings: 9, Instructions: 382windowfileCOMMON

Windows Analysis Report
Setup.exe

Function 00E12D30 Relevance: 47.6, APIs: 18, Strings: 9, Instructions: 382
windowfileCOMMON

Function 00E15020 Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 68
timeCOMMON

Function 00E1A9B0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 101
commemorywindowCOMMON

Function 00E331F9 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Function 00E41CF6 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272
COMMONLIBRARYCODE

Function 00E33D9A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 187
COMMONLIBRARYCODE

Function 00E31A29 Relevance: 9.2, APIs: 6, Instructions: 200
COMMONLIBRARYCODE

Function 00E22070 Relevance: 9.1, APIs: 6, Instructions: 94
COMMON

Function 00E127E0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 188
COMMON

Function 00E22AA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71
COMMON

Function 00E22D00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 63
COMMON

Function 00E36BB9 Relevance: 4.7, APIs: 3, Instructions: 186
COMMONLIBRARYCODE

Function 00E367D4 Relevance: 3.1, APIs: 2, Instructions: 77
fileCOMMONLIBRARYCODE

Function 00E1D130 Relevance: 2.5, APIs: 2, Instructions: 28
COMMON

Function 00E39B09 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON