Edit tour

Windows Analysis Report
Reader_Install_Setup.exe

Overview

General Information

Sample name:	Reader_Install_Setup.exe
Analysis ID:	1391064
MD5:	f543b65c504c5d548e6005f2cba5ddb6
SHA1:	b5484f2abd286c49360077ae18fa1f0fcdc77900
SHA256:	9fd5d542f797d9dc630738d7c1b803d34bc0bab593c8d992f9a159ac0a28b276
Infos:

Detection

Score:	7
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Detected potential crypto function

Found evaded block containing many API calls

Found potential string decryption / allocating functions

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Searches for the Microsoft Outlook file path

Tries to load missing DLLs

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Analysis Advice

Sample tries to load a library which is not present or installed on the analysis machine, adding the library might reveal more behavior

Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--")

Process Tree

System is w10x64

Reader_Install_Setup.exe (PID: 7420 cmdline: C:\Users\user\Desktop\Reader_Install_Setup.exe MD5: F543B65C504C5D548E6005F2CBA5DDB6)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: Reader_Install_Setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: Reader_Install_Setup.exe

Static PE information: certificate valid

Source: Reader_Install_Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Binary string: C:\rdcadm\jenkins\workspace\WindowsBuild\2.0\dev\target\win\Release\Adobe Download Manager.pdb source: Reader_Install_Setup.exe, Reader_Install_Setup.exe, 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_003393E0 GetFileAttributesW,PathFileExistsW,PathIsDirectoryW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_003393E0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00344620 PathIsDirectoryW,GetFileAttributesW,GetLastError,FindFirstFileW,FindNextFileW,GetLastError,FindClose,DeleteFileW,DeleteFileW,RemoveDirectoryW,RemoveDirectoryW,FindClose,GetLastError,		0_2_00344620

Source: Reader_Install_Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: Reader_Install_Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: Reader_Install_Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: Reader_Install_Setup.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: Reader_Install_Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: Reader_Install_Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: Reader_Install_Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: Reader_Install_Setup.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: Reader_Install_Setup.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: Reader_Install_Setup.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: Reader_Install_Setup.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: Reader_Install_Setup.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: Reader_Install_Setup.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2912917971.0000000009E58000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2914228623.000000000ACC2000.00000004.00000800.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	String found in binary or memory: http://typekit.com/eulas/0000000000000000000176ff
Source: Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2912917971.0000000009E58000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2914228623.000000000ACC2000.00000004.00000800.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017701
Source: Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2914228623.000000000ACC2000.00000004.00000800.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2903252619.0000000007E59000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1675262282.0000000007E4C000.00000004.00000020.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017702
Source: Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2912917971.0000000009E58000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2914228623.000000000ACC2000.00000004.00000800.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017703
Source: Reader_Install_Setup.exe, 00000000.00000002.2901308172.0000000004138000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1680102941.000000000413D000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2914228623.000000000ACC2000.00000004.00000800.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1679761273.000000000413D000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2912796622.0000000009DE4000.00000004.00000020.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017704
Source: Reader_Install_Setup.exe, 00000000.00000002.2901308172.0000000004138000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1680102941.000000000413D000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1679761273.000000000413D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://typekit.com/eulas/000000000000000000017704R
Source: Reader_Install_Setup.exe, 00000000.00000002.2901308172.0000000004138000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2914228623.000000000ACC2000.00000004.00000800.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2912796622.0000000009DE4000.00000004.00000020.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017706
Source: Reader_Install_Setup.exe, 00000000.00000002.2901308172.0000000004138000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://typekit.com/eulas/000000000000000000017706(v(
Source: Reader_Install_Setup.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: Reader_Install_Setup.exe, Reader_Install_Setup.exe, 00000000.00000002.2898087056.0000000001484000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1663575978.0000000004155000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2902316987.0000000005601000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2909468149.0000000009AF0000.00000004.00000800.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1669764842.0000000009DD4000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1670096819.0000000007E09000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.2442597818.0000000009520000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getbootstrap.com/)
Source: Reader_Install_Setup.exe	String found in binary or memory: https://github.com/Fin
Source: Reader_Install_Setup.exe, 00000000.00000003.1663642057.0000000004141000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2905428102.0000000007FBA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Financial-Times/polyfill-service/issues/317
Source: Reader_Install_Setup.exe, Reader_Install_Setup.exe, 00000000.00000003.1663575978.0000000004155000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2898087056.000000000146F000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2902316987.0000000005601000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2909468149.0000000009AF0000.00000004.00000800.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1669764842.0000000009DD4000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.2442597818.0000000009520000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/twbs/bootstrap/blob/main/LICENSE)
Source: Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: Reader_Install_Setup.exe, Reader_Install_Setup.exe, 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2905958294.00000000080AB000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1661843913.00000000080A7000.00000004.00000020.00020000.00000000.sdmp, 231[1].0.dr	String found in binary or memory: https://mths.be/array-from
Source: Reader_Install_Setup.exe, Reader_Install_Setup.exe, 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2905958294.00000000080AB000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1661843913.00000000080A7000.00000004.00000020.00020000.00000000.sdmp, 231[1].0.dr	String found in binary or memory: https://mths.be/array-of
Source: Reader_Install_Setup.exe, 00000000.00000002.2912796622.0000000009DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.typekit.net/
Source: Reader_Install_Setup.exe, 00000000.00000002.2912796622.0000000009DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.typekit.net/V
Source: Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2903903113.0000000007F0D000.00000004.00000800.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	String found in binary or memory: https://p.typekit.net/p.gif
Source: Reader_Install_Setup.exe, 00000000.00000002.2903252619.0000000007E6F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://p.typekit.net/p.gif?s=1&k=bxf0ivf&ht=tk&h=C%3A%5CUsers%5Cuser%5CDesktop%5CReader_Install_Se
Source: Reader_Install_Setup.exe, 00000000.00000002.2912796622.0000000009DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rdc.adobe.io
Source: Reader_Install_Setup.exe, 00000000.00000002.2912796622.0000000009DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rdc.adobe.io/
Source: Reader_Install_Setup.exe, Reader_Install_Setup.exe, 00000000.00000002.2902258068.0000000005040000.00000004.00000800.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2898087056.000000000146F000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://rdc.adobe.io/adm/actionList
Source: Reader_Install_Setup.exe, 00000000.00000002.2903252619.0000000007E7B000.00000004.00000020.00020000.00000000.sdmp, Adobe_ADM.log.0.dr	String found in binary or memory: https://rdc.adobe.io/adm/actionList?installerName=readerdc64_en_ha_install.exe&defaultInstallerName=
Source: Reader_Install_Setup.exe, Reader_Install_Setup.exe, 00000000.00000002.2912796622.0000000009DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rdc.adobe.io/analytics/events
Source: Reader_Install_Setup.exe, 00000000.00000002.2902316987.0000000005601000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2903252619.0000000007E4B000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2903252619.0000000007E7B000.00000004.00000020.00020000.00000000.sdmp, Adobe_ADM.log.0.dr	String found in binary or memory: https://rdc.adobe.io/analytics/events?UniqueId=46AAA59F-2AE3-4072-9622-61163E17181B&abbr=rdr&admErro
Source: Reader_Install_Setup.exe, 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://rdc.adobe.io/analytics/eventsanalyticstestWorkflowApplication
Source: Reader_Install_Setup.exe, 00000000.00000002.2912796622.0000000009DE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rdc.adobe.io/w
Source: Reader_Install_Setup.exe	String found in binary or memory: https://reactjs.org/docs/err
Source: Reader_Install_Setup.exe, 00000000.00000003.1676080029.0000000007D21000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2911197588.0000000009C76000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: Reader_Install_Setup.exe, 00000000.00000003.1663276754.00000000092DD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=arguments.length
Source: Reader_Install_Setup.exe, Reader_Install_Setup.exe, 00000000.00000002.2911755940.0000000009D0B000.00000004.00000800.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1663237896.00000000092F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: Reader_Install_Setup.exe, 00000000.00000002.2911755940.0000000009D0B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://reactjs.org/link/react-polyfillsThis
Source: Reader_Install_Setup.exe, 00000000.00000003.1663237896.00000000092F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://reactjs.org/link/react-polyfillsn.unstable_shouldYieldn.unstable_forceFrameRate
Source: Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/
Source: Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014B3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/T
Source: Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2905100153.0000000007FA1000.00000004.00000800.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	String found in binary or memory: https://use.typekit.net/af/40207f/0000000000000000000176ff/27/
Source: Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/af/40207f/0000000000000000000176ff/27/a?primer=0635fba006f1437d962ae878ad04a
Source: Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/af/40207f/0000000000000000000176ff/27/d?primer=0635fba006f1437d962ae878ad04a
Source: Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014F8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/af/40207f/0000000000000000000176ff/27/l?primer=0635fba006f1437d962ae878ad04a
Source: Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2905100153.0000000007FA1000.00000004.00000800.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	String found in binary or memory: https://use.typekit.net/af/4b3e87/000000000000000000017706/27/
Source: Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/af/4b3e87/000000000000000000017706/27/a?primer=0635fba006f1437d962ae878ad04a
Source: Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/af/4b3e87/000000000000000000017706/27/d?primer=0635fba006f1437d962ae878ad04a
Source: Reader_Install_Setup.exe, 00000000.00000002.2902316987.0000000005601000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/af/4b3e87/000000000000000000017706/27/l?primer=0635fba006f1437d962ae878ad04a
Source: Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2905100153.0000000007FA1000.00000004.00000800.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	String found in binary or memory: https://use.typekit.net/af/74ffb1/000000000000000000017702/27/
Source: Reader_Install_Setup.exe, 00000000.00000002.2902316987.0000000005601000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/af/74ffb1/000000000000000000017702/27/a?primer=0635fba006f1437d962ae878ad04a
Source: Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/af/74ffb1/000000000000000000017702/27/d?primer=0635fba006f1437d962ae878ad04a
Source: Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/af/74ffb1/000000000000000000017702/27/l?primer=0635fba006f1437d962ae878ad04a
Source: Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2905100153.0000000007FA1000.00000004.00000800.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	String found in binary or memory: https://use.typekit.net/af/a2527e/000000000000000000017704/27/
Source: Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/af/a2527e/000000000000000000017704/27/a?primer=0635fba006f1437d962ae878ad04a
Source: Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/af/a2527e/000000000000000000017704/27/d?primer=0635fba006f1437d962ae878ad04a
Source: Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/af/a2527e/000000000000000000017704/27/l?primer=0635fba006f1437d962ae878ad04a
Source: Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2905100153.0000000007FA1000.00000004.00000800.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	String found in binary or memory: https://use.typekit.net/af/cb695f/000000000000000000017701/27/
Source: Reader_Install_Setup.exe, 00000000.00000002.2902316987.0000000005601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/af/cb695f/000000000000000000017701/27/a?primer=0635fba006f1437d962ae878ad04a
Source: Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/af/cb695f/000000000000000000017701/27/d?primer=0635fba006f1437d962ae878ad04a
Source: Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2902316987.0000000005601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/af/cb695f/000000000000000000017701/27/l?primer=0635fba006f1437d962ae878ad04a
Source: Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2905100153.0000000007FA1000.00000004.00000800.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	String found in binary or memory: https://use.typekit.net/af/eaf09c/000000000000000000017703/27/
Source: Reader_Install_Setup.exe, 00000000.00000002.2902316987.0000000005601000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/af/eaf09c/000000000000000000017703/27/a?primer=0635fba006f1437d962ae878ad04a
Source: Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/af/eaf09c/000000000000000000017703/27/d?primer=0635fba006f1437d962ae878ad04a
Source: Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/af/eaf09c/000000000000000000017703/27/l?primer=0635fba006f1437d962ae878ad04a
Source: Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014DE000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2899455039.0000000003568000.00000004.00000800.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2900577435.00000000036A3000.00000004.00000800.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2898087056.0000000001418000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2903252619.0000000007DD8000.00000004.00000020.00020000.00000000.sdmp, 160[1].0.dr	String found in binary or memory: https://use.typekit.net/bxf0ivf.js
Source: Reader_Install_Setup.exe, 00000000.00000002.2902316987.0000000005601000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/bxf0ivf.js#
Source: Reader_Install_Setup.exe, 00000000.00000002.2898087056.0000000001484000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/bxf0ivf.jsEvent1256
Source: Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/bxf0ivf.jsL
Source: Reader_Install_Setup.exe, 00000000.00000002.2898087056.000000000144F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/bxf0ivf.js_Install_Setup.exe/160C959/
Source: Reader_Install_Setup.exe, 00000000.00000002.2911694624.0000000009D00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/bxf0ivf.jsinitErrorMultipleInstanceRunningI
Source: Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/bxf0ivf.jsn
Source: Reader_Install_Setup.exe, 00000000.00000003.1663237896.00000000092F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://use.typekit.net/bxf0ivf.jsn.type

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00325120	0_2_00325120
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002E4170	0_2_002E4170
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002FD240	0_2_002FD240
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002E12E0	0_2_002E12E0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_003213D0	0_2_003213D0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00312410	0_2_00312410
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002FC7B0	0_2_002FC7B0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_003207D0	0_2_003207D0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002F9910	0_2_002F9910
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_0031F970	0_2_0031F970
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00322950	0_2_00322950
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002DEE50	0_2_002DEE50
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00323F00	0_2_00323F00
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00306F90	0_2_00306F90
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002ED000	0_2_002ED000
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002DB040	0_2_002DB040
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00314090	0_2_00314090
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_003100C0	0_2_003100C0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002D10D0	0_2_002D10D0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_004B5150	0_2_004B5150
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_004B3173	0_2_004B3173
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_004AB11B	0_2_004AB11B
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002EE1E0	0_2_002EE1E0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_0031E1C0	0_2_0031E1C0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00302200	0_2_00302200
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_004BD22A	0_2_004BD22A
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_003372E0	0_2_003372E0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_0032C300	0_2_0032C300
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_0031B360	0_2_0031B360
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_0030F3E0	0_2_0030F3E0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002EF430	0_2_002EF430
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002F2500	0_2_002F2500
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002F4570	0_2_002F4570
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_0032B5B0	0_2_0032B5B0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00344620	0_2_00344620
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_004C1661	0_2_004C1661
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_0032E600	0_2_0032E600
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002FF720	0_2_002FF720
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_0031C710	0_2_0031C710
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002D9710	0_2_002D9710
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00343740	0_2_00343740
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_004D07E0	0_2_004D07E0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_0032D7F0	0_2_0032D7F0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002F07E0	0_2_002F07E0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_003387E0	0_2_003387E0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002D87D0	0_2_002D87D0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00351840	0_2_00351840
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002F3850	0_2_002F3850
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_004A58E0	0_2_004A58E0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_003069A0	0_2_003069A0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_0030E990	0_2_0030E990
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00341980	0_2_00341980
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_003529E0	0_2_003529E0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_0033CA30	0_2_0033CA30
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_0030CA00	0_2_0030CA00
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00325A60	0_2_00325A60
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_0030BA40	0_2_0030BA40
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_003ABABB	0_2_003ABABB
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00312AA0	0_2_00312AA0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00335AF0	0_2_00335AF0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00327BA0	0_2_00327BA0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002F1C20	0_2_002F1C20
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_0032BCA0	0_2_0032BCA0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002EFC80	0_2_002EFC80
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00314CF0	0_2_00314CF0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_0034CCE0	0_2_0034CCE0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_0032AD30	0_2_0032AD30
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00302D10	0_2_00302D10
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00328D60	0_2_00328D60
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00338D90	0_2_00338D90
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_004AAD8D	0_2_004AAD8D
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_0031EDD0	0_2_0031EDD0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_0032CE70	0_2_0032CE70
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_004CCE0F	0_2_004CCE0F
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00326E80	0_2_00326E80
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00305ED0	0_2_00305ED0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00315F20	0_2_00315F20
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00329F10	0_2_00329F10
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002DCF50	0_2_002DCF50
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_002DDF90	0_2_002DDF90

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: String function: 0049FB1E appears 56 times
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: String function: 002DBB40 appears 47 times
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: String function: 002DBE30 appears 128 times
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: String function: 0033D100 appears 47 times
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: String function: 0049FC00 appears 44 times
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: String function: 002DC370 appears 97 times
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: String function: 002DC400 appears 87 times

Source: Reader_Install_Setup.exe

Static PE information: Resource name: PNG type: DOS executable (COM, 0x8C-variant)

Source: Reader_Install_Setup.exe, 00000000.00000000.1642519353.000000000070F000.00000008.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAdobe Download ManagerN vs Reader_Install_Setup.exe
Source: Reader_Install_Setup.exe, 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameAdobe Download ManagerN vs Reader_Install_Setup.exe
Source: Reader_Install_Setup.exe	Binary or memory string: OriginalFilenameAdobe Download ManagerN vs Reader_Install_Setup.exe

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Jump to behavior

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: oledlg.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: oleaccrc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: pgpmapih.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: dxgidebug.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: msiso.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: mshtml.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: jscript9.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: msimtf.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: d2d1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: uianimation.dll	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: Reader_Install_Setup.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: clean7.winEXE@1/13@0/0

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

Code function: 0_2_002E9910 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,OpenProcess,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,CloseHandle,

0_2_002E9910

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

Code function: 0_2_002DB040 GetDiskFreeSpaceExW,GetDiskFreeSpaceExW,GetLogicalDrives,

0_2_002DB040

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

Code function: 0_2_002E03E0 FindResourceW,LoadResource,LockResource,SizeofResource,

0_2_002E03E0

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

File created: C:\Users\user\AppData\Local\Adobe\FC8E3F82-914E-4939-8222-C31F7BB4E7DE

Jump to behavior

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Mutant created: \Sessions\1\BaseNamedObjects\Adobe_ADM.log
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Mutant created: \Sessions\1\BaseNamedObjects\Adobe_GDE.log

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

File created: C:\Users\user\AppData\Local\Temp\Adobe_ADMLogs

Jump to behavior

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Reader_Install_Setup.exe	String found in binary or memory: che Fertig stellen und starten Sie den Installationsvorgang neu." }, "invalidSKU": { "message": "Das {0}-Installationsprogramm ist veraltet oder eine Datei wurde umbenannt. Klicken Sie auf Fertig stellen, um das aktuelle Installa
Source: Reader_Install_Setup.exe	String found in binary or memory: 84ydtiU3il6ry9nY {\r\n -webkit-animation: none;\r\n animation: none;\r\n }\r\n}\r\n\r\n.W6C_Cm_0CSNW7ljg2Y9l {\r\n display: -ms-flexbox;\r\n display: flex;\r\n -ms-flex-align: start;\r\n align-items: flex-start;\r\n}\r\n\r\n.xyiYCq7vZX3AEsLK_h4t {\r
Source: Reader_Install_Setup.exe	String found in binary or memory: /launchParams/waitForCompletion
Source: Reader_Install_Setup.exe	String found in binary or memory: /launchParams/launchProcessGuid
Source: Reader_Install_Setup.exe	String found in binary or memory: /launchParams/arguments/argument
Source: Reader_Install_Setup.exe	String found in binary or memory: /launchParams/launchPath
Source: Reader_Install_Setup.exe	String found in binary or memory: /launchParams/returnCode
Source: Reader_Install_Setup.exe	String found in binary or memory: /launchParams/errorCode
Source: Reader_Install_Setup.exe	String found in binary or memory: rrorUpdateMessage": { "message": " -installer " }, "ActionList_AlreadyExists": { "message": "" }, "ActionList_Complete": {
Source: Reader_Install_Setup.exe	String found in binary or memory: -pack: start;\r\n justify-content: flex-start;\r\n }\r\n .bCwZiTNFMMbBWr3jcpcC .UdZ9h4yDyt7zzl_efcFz {\r\n -ms-flex-direction: row;\r\n flex-direction: row;\r\n }\r\n .bCwZiTNFMMbBWr3jcpcC .UdZ9h4yDyt7zzl_efcFz .WNvdx4uqUWtr9A7ET3s8 {\r\n posit
Source: Reader_Install_Setup.exe	String found in binary or memory: /install/arguments/argument
Source: Reader_Install_Setup.exe	String found in binary or memory: /install/progressWaitLimit
Source: Reader_Install_Setup.exe	String found in binary or memory: /install/returnCodes/returnCode
Source: Reader_Install_Setup.exe	String found in binary or memory: /install/progressWaitTime
Source: Reader_Install_Setup.exe	String found in binary or memory: \r\n .yZVqwct25RQtg_rJyphu {\r\n -ms-flex-flow: row nowrap;\r\n flex-flow: row nowrap;\r\n -ms-flex-pack: start;\r\n justify-content: flex-start;\r\n }\r\n .yZVqwct25RQtg_rJyphu .UdZ9h4yDyt7zzl_efcFz {\r\n -ms-flex-direction: row;\r\n flex
Source: Reader_Install_Setup.exe	String found in binary or memory: 5GF_bATvy {\r\n z-index: 1;\r\n}\r\n\r\n.zL1_mT_7fs5uZHMuZ2nw {\r\n display: -ms-flexbox;\r\n display: flex;\r\n -ms-flex-wrap: wrap;\r\n flex-wrap: wrap;\r\n -ms-flex-pack: start;\r\n justify-content: flex-start;\r\n}\r\n\r\n.zL1_mT_7fs5uZHMuZ2nw .c1Sk
Source: Reader_Install_Setup.exe	String found in binary or memory: rt;\r\n align-items: flex-start;\r\n -ms-flex-pack: center;\r\n justify-content: center;\r\n}\r\n\r\n.KreO5lkqzKRYE6kMOpU8 > .SI26_236LLhD2moOSicV,\r\n.KreO5lkqzKRYE6kMOpU8 > .znKiFK8BtK3Ryz9nqB1f {\r\n width: 100%;\r\n}\r\n\r\n.KreO5lkqzKRYE6kMOpU8 > .SI2
Source: Reader_Install_Setup.exe	String found in binary or memory: flex-flow: row nowrap;\r\n flex-flow: row nowrap;\r\n -ms-flex-pack: start;\r\n justify-content: flex-start;\r\n }\r\n .HR7PgL6swGh5IOFzTcX2 .UdZ9h4yDyt7zzl_efcFz {\r\n -ms-flex-direction: row;\r\n flex-direction: row;\r\n }\r\n .HR7PgL6swGh
Source: Reader_Install_Setup.exe	String found in binary or memory: Adobe Acrobat" }, "Congratulations": { "message": "Onnittelut" }, "ActionList_Verify": { "message": "Tarkistetaan asennusta..." }, "ActionList_ErrorUpdateMessage": { "message": "Komentoriviargumentti -installer vaaditaan, mutt
Source: Reader_Install_Setup.exe	String found in binary or memory: "Congratulations": { "message": "Congratulations" }, "ActionList_Verify": { "message": "Verifying install..." }, "ActionList_ErrorUpdateMessage": { "message": "The command line argument -installer is required but not provided."
Source: Reader_Install_Setup.exe	String found in binary or memory: ms-flex-pack: start;\r\n justify-content: flex-start;\r\n}\r\n\r\n.q2Zc28XrMrY0gB3RKQXQ > .P9ttp5CfYv4K8NwPCfAS,\r\n.q2Zc28XrMrY0gB3RKQXQ > .m8oOHyBtRiyoCu3QS5_q, .q2Zc28XrMrY0gB3RKQXQ > .uTTRfMaOKj_KeT7DYxKx, .q2Zc28XrMrY0gB3RKQXQ > .iJvWw3vT2QR1DLdPDvu3, .q
Source: Reader_Install_Setup.exe	String found in binary or memory: r\n\r\n.sSYTlm_fbXuMQ2nOLx0w {\r\n -ms-flex-negative: 1 !important;\r\n flex-shrink: 1 !important;\r\n}\r\n\r\n.DASZHkth1o5IOMZyhTDx {\r\n -ms-flex-pack: start !important;\r\n justify-content: flex-start !important;\r\n}\r\n\r\n.LAWb7Cbf0N5DYoYZseWF {\r\n
Source: Reader_Install_Setup.exe	String found in binary or memory: flex-shrink-0":"on8QKWtR02qa9o9le_l4","flex-shrink-1":"sSYTlm_fbXuMQ2nOLx0w","justify-content-start":"DASZHkth1o5IOMZyhTDx","justify-content-end":"LAWb7Cbf0N5DYoYZseWF","justify-content-center":"FXBomI8D0oPm5hc8wxwA","justify-content-between":"wcoUwDW3XLAvF5XE
Source: Reader_Install_Setup.exe	String found in binary or memory: f_0","justify-content-around":"YZxKsrbvidFu366yCv8k","align-items-start":"kzhaT0Oba_fChd17ICcv","align-items-end":"DfrSF9G_NhJxaBrTyI9E","align-items-center":"T2gjS8V2_aCimczn_mvA","align-items-baseline":"wvV162mt8CM64dJRJC_K","align-items-stretch":"uwleunsKzY
Source: Reader_Install_Setup.exe	String found in binary or memory: essage": "Congratulations" }, "ActionList_Verify": { "message": "Verifying install..." }, "ActionList_ErrorUpdateMessage": { "message": "The command line argument -installer is required but not provided." }, "ActionList_AlreadyExist
Source: Reader_Install_Setup.exe	String found in binary or memory: oW2nYlOE4","align-content-start":"Ux_l3vTkayi2Nq7VsaVG","align-content-end":"NeoGktt2uqAOkIls2tkD","align-content-center":"kFFYrbLbLECA7hshfgB4","align-content-between":"_ovIEpiGXhGpst7ciRVY","align-content-around":"lkHcf3zkijisAIDcTRgA","align-content-stretch
Source: Reader_Install_Setup.exe	String found in binary or memory: ign-items: flex-start !important;\r\n}\r\n\r\n.DfrSF9G_NhJxaBrTyI9E {\r\n -ms-flex-align: end !important;\r\n align-items: flex-end !important;\r\n}\r\n\r\n.T2gjS8V2_aCimczn_mvA {\r\n -ms-flex-align: center !important;\r\n align-items: center !important;\r
Source: Reader_Install_Setup.exe	String found in binary or memory: \n justify-content: flex-start;\r\n align-items: flex-end;\r\n}\r\n\r\n.IDKVSl_h7I8AUkTJyJZR{\r\n color:#505050;\r\n margin-left: auto;\r\n}\r\n\r\n.mdye5L_d5nxHhgXOJzOl {\r\n background-color: #2680eb\r\n}\r\n\r\n.uA6xPsp_APEYTCYzQpAm {\r\n
Source: Reader_Install_Setup.exe	String found in binary or memory: :"NEedZEkDvapuuRM76fDm","align-self-auto":"HZJOrTsRFta7TuRD5mLC","align-self-start":"OcYm86Cu28Oe4t9OrHGy","align-self-end":"Wie7fqOQFV_ARe1Jw09R","align-self-center":"M8kCN1fgOGwZVFJ3wLAX","align-self-baseline":"JItXRBa5bZTWWkWA6xmX","align-self-stretch":"B36
Source: Reader_Install_Setup.exe	String found in binary or memory: VG {\r\n -ms-flex-line-pack: start !important;\r\n align-content: flex-start !important;\r\n}\r\n\r\n.NeoGktt2uqAOkIls2tkD {\r\n -ms-flex-line-pack: end !important;\r\n align-content: flex-end !important;\r\n}\r\n\r\n.kFFYrbLbLECA7hshfgB4 {\r\n -ms-flex-l
Source: Reader_Install_Setup.exe	String found in binary or memory: -content-sm-start":"B5btvvlXn96uf7yGf1tR","justify-content-sm-end":"PoT2qU4sMKBleURcc2cJ","justify-content-sm-center":"AVIeQzlddzrtDxIBXkKd","justify-content-sm-between":"ivJwQA579UzEbjI7CkZ_","justify-content-sm-around":"z68IWjEqXuP67bRb8eEp","align-items-sm-
Source: Reader_Install_Setup.exe	String found in binary or memory: tart":"fJTv_QJTsr6EO2H1q4V3","align-items-sm-end":"w8v8i3VE57doJW3WhKMD","align-items-sm-center":"xPBnP81DTQHre7ixEe_q","align-items-sm-baseline":"Fv8YCtye3D9Er3k3sYNM","align-items-sm-stretch":"V6bazQgwJb2yoGr1NWeW","align-content-sm-start":"WLLVW2mH0bVmfnnPL
Source: Reader_Install_Setup.exe	String found in binary or memory: \r\n align-self: auto !important;\r\n}\r\n\r\n.OcYm86Cu28Oe4t9OrHGy {\r\n -ms-flex-item-align: start !important;\r\n align-self: flex-start !important;\r\n}\r\n\r\n.Wie7fqOQFV_ARe1Jw09R {\r\n -ms-flex-item-align: end !important;\r\n align-self: flex-end !
Source: Reader_Install_Setup.exe	String found in binary or memory: m-auto":"IzdFJiZ2UCQMY9aGg_QA","align-self-sm-start":"iiYDHEA6tQXlGqaKw7jz","align-self-sm-end":"uq0dyk4fScobfEBVnATd","align-self-sm-center":"UpE4hJfsUm5TuZtTZvsv","align-self-sm-baseline":"e4_Oxc7RitQH_sjNSulu","align-self-sm-stretch":"k3cpKukN1yqN0o_bwWbO",
Source: Reader_Install_Setup.exe	String found in binary or memory: reverse":"vy8MgiufjANaWTk_ZwWQ","flex-md-fill":"Oew_loBO0_dkmOrnii5w","flex-md-grow-0":"suF3M9_Dg1jwPDHryUtV","flex-md-grow-1":"NgldPqvt9DiqtAbphcRj","flex-md-shrink-0":"InhTYOgC9dF8dQSb1MLY","flex-md-shrink-1":"OqqmkSrciAjIMRn4zhht","justify-content-md-start"
Source: Reader_Install_Setup.exe	String found in binary or memory: "hkIpV6klVOwAo752VSvr","justify-content-md-end":"eLk5KmeziN3FG_ZvWUbk","justify-content-md-center":"wx9l9CrohZahb5XLMrGW","justify-content-md-between":"ysWVT3V793_xoLXozo0y","justify-content-md-around":"cCZYopTiajqBE6zSF4mb","align-items-md-start":"THpMIn_rv9g
Source: Reader_Install_Setup.exe	String found in binary or memory: J1zTlRSw","align-items-md-end":"GDHTGrjlGD0S0f1_DiJ5","align-items-md-center":"wtOokl2f_oejiBt8WE_w","align-items-md-baseline":"RZpDrGEVofFZ2OwqC2qL","align-items-md-stretch":"wekS_MR1HkGU6Ej1xqxk","align-content-md-start":"LkRjjQuLuuq2HISiPqJR","align-content
Source: Reader_Install_Setup.exe	String found in binary or memory: -flexbox;\r\n display: flex;\r\n -ms-flex-align: start;\r\n align-items: flex-start;\r\n -ms-flex-pack: justify;\r\n justify-content: space-between;\r\n padding: 1rem 1rem;\r\n border-bottom: 1px solid #dee2e6;\r\n border-top-left-radius: calc(0.3rem -
Source: Reader_Install_Setup.exe	String found in binary or memory: z26TjBddI4","align-self-md-start":"xTvlYZBtMd3hxVUw0G1S","align-self-md-end":"fZE3fFOWzrNpoqLg33AU","align-self-md-center":"R1In6pl7PW91BoY3krKQ","align-self-md-baseline":"J1mijNk_O5u2_BNY_hz0","align-self-md-stretch":"NAXMdJmeSI56lhqzCE60","flex-lg-row":"mj9d
Source: Reader_Install_Setup.exe	String found in binary or memory: vvlXn96uf7yGf1tR {\r\n -ms-flex-pack: start !important;\r\n justify-content: flex-start !important;\r\n }\r\n .PoT2qU4sMKBleURcc2cJ {\r\n -ms-flex-pack: end !important;\r\n justify-content: flex-end !important;\r\n }\r\n .AVIeQzlddzrtDxIBXkKd {
Source: Reader_Install_Setup.exe	String found in binary or memory: w99NEZmcvYy","flex-lg-fill":"HKtXJhwNMeSoCd3MgKGQ","flex-lg-grow-0":"dvvTGp7Qb5VsoLexKoAj","flex-lg-grow-1":"MF9RSy7GVU0ZJs8Gio4O","flex-lg-shrink-0":"lPtuBlsAx25tEyrdPW0j","flex-lg-shrink-1":"smDQGRg_vRvZ1zTRxO2O","justify-content-lg-start":"hz1rXkTClh20Fh5LF
Source: Reader_Install_Setup.exe	String found in binary or memory: ex-pack: distribute !important;\r\n justify-content: space-around !important;\r\n }\r\n .fJTv_QJTsr6EO2H1q4V3 {\r\n -ms-flex-align: start !important;\r\n align-items: flex-start !important;\r\n }\r\n .w8v8i3VE57doJW3WhKMD {\r\n -ms-flex-align:
Source: Reader_Install_Setup.exe	String found in binary or memory: 5h","justify-content-lg-end":"mXqDCUtaC_JMHMad0ZwV","justify-content-lg-center":"qOrqtkCp3ivHw7SVfILq","justify-content-lg-between":"LdfUwIH0FNecJPWWPrg1","justify-content-lg-around":"nVtckCgiojWEvbI_02td","align-items-lg-start":"SkBdZQ4j6W8eEExZe0hD","align-i
Source: Reader_Install_Setup.exe	String found in binary or memory: ems-lg-end":"WAJbhUQHN23bq7qy5Sn4","align-items-lg-center":"kd6x9h_3ZymIzA4bgzN7","align-items-lg-baseline":"KO8aNPXTLKYLQxI6em9l","align-items-lg-stretch":"Km2Za0W8caH7Y94_8Cii","align-content-lg-start":"W43tG1Sz8VgKlzT3ABdI","align-content-lg-end":"jl0mwv_1I
Source: Reader_Install_Setup.exe	String found in binary or memory: self-lg-start":"G9A3tlQ35wA03mx2tzqx","align-self-lg-end":"eLScPzCVVKub71kFSTo6","align-self-lg-center":"AjPsmeBDtyK_yy_tIXdq","align-self-lg-baseline":"tEiZrAGTU4ltRxVsQYja","align-self-lg-stretch":"zM8DoQ0E3PzQ1e4NdlbO","flex-xl-row":"xiURbQvawKtv3lpRx8BS","
Source: Reader_Install_Setup.exe	String found in binary or memory: o=e.n(t),a=e(2312),i=e.n(a)()(o());i.push([r.id,".h3prVibJIx6xMWozlLvS{\r\n display: flex;\r\n flex-direction: row;\r\n flex-wrap: nowrap;\r\n align-content: flex-end;\r\n justify-content: flex-start;\r\n align-items: flex-end;\r\n}",""]),i.l
Source: Reader_Install_Setup.exe	String found in binary or memory: xl-fill":"kGKaQXNtKVolETkb6VY_","flex-xl-grow-0":"NeShcrAZ5y_hpxB1Krrg","flex-xl-grow-1":"ysC1kPY5k3OAcyOOrAZF","flex-xl-shrink-0":"c7DdFRyXaVXxSNLm96SA","flex-xl-shrink-1":"vVfhGb47ZI1vy9SKdLAy","justify-content-xl-start":"EMKOqdcLxlLCtgNKAVN9","justify-conte
Source: Reader_Install_Setup.exe	String found in binary or memory: YDHEA6tQXlGqaKw7jz {\r\n -ms-flex-item-align: start !important;\r\n align-self: flex-start !important;\r\n }\r\n .uq0dyk4fScobfEBVnATd {\r\n -ms-flex-item-align: end !important;\r\n align-self: flex-end !important;\r\n }\r\n .UpE4hJfsUm5TuZtTZv
Source: Reader_Install_Setup.exe	String found in binary or memory: t-xl-end":"y9ejXHhttjAEgovYXYMU","justify-content-xl-center":"COPRSpy9kETB_SZQ4smx","justify-content-xl-between":"mYnlm8yqHdRJ8jWo0Ula","justify-content-xl-around":"SRf5p8hsCyhBY1KbbllG","align-items-xl-start":"AwPLyaWsRJ3kVfxTYAKZ","align-items-xl-end":"JLhQy
Source: Reader_Install_Setup.exe	String found in binary or memory: 9YeJ2Xzm4rGI0o","align-items-xl-center":"TnX6CLfh8vo_Q_DeYU2g","align-items-xl-baseline":"VtD1JQ5GGSN55msvqOuH","align-items-xl-stretch":"r3SPzoMrEJe9HyIuwWCJ","align-content-xl-start":"kaIxRiZtzxK_YyZMBHo_","align-content-xl-end":"l1QG33TebFm8kJRTmnh7","align
Source: Reader_Install_Setup.exe	String found in binary or memory: content-xl-center":"MV4EN51PwhHoa9MTCThc","align-content-xl-between":"ch_UlL0T5dkZlpBCGf6z","align-content-xl-around":"qeeJg8mLhC36_AtZhgPi","align-content-xl-stretch":"VnQjhwHZwYkSNDH0IDLS","align-self-xl-auto":"f6I_MfERc6Cd5U2cvKdb","align-self-xl-start":"Pa
Source: Reader_Install_Setup.exe	String found in binary or memory: -ms-flex-pack: start !important;\r\n justify-content: flex-start !important;\r\n }\r\n .eLk5KmeziN3FG_ZvWUbk {\r\n -ms-flex-pack: end !important;\r\n justify-content: flex-end !important;\r\n }\r\n .wx9l9CrohZahb5XLMrGW {\r\n -ms-flex-pack:
Source: Reader_Install_Setup.exe	String found in binary or memory: portant;\r\n justify-content: space-around !important;\r\n }\r\n .THpMIn_rv9gXJ1zTlRSw {\r\n -ms-flex-align: start !important;\r\n align-items: flex-start !important;\r\n }\r\n .GDHTGrjlGD0S0f1_DiJ5 {\r\n -ms-flex-align: end !important;\r\n
Source: Reader_Install_Setup.exe	String found in binary or memory: //launchReader
Source: Reader_Install_Setup.exe	String found in binary or memory: //launchAcrobat
Source: Reader_Install_Setup.exe	String found in binary or memory: //launchReaderSAPP
Source: Reader_Install_Setup.exe	String found in binary or memory: mportant;\r\n }\r\n .wekS_MR1HkGU6Ej1xqxk {\r\n -ms-flex-align: stretch !important;\r\n align-items: stretch !important;\r\n }\r\n .LkRjjQuLuuq2HISiPqJR {\r\n -ms-flex-line-pack: start !important;\r\n align-content: flex-start !important;\r\n
Source: Reader_Install_Setup.exe	String found in binary or memory: https://helpx.adobe.com/acrobat/kb/download-64-bit-installer.html
Source: Reader_Install_Setup.exe	String found in binary or memory: n -ms-flex-item-align: start !important;\r\n align-self: flex-start !important;\r\n }\r\n .fZE3fFOWzrNpoqLg33AU {\r\n -ms-flex-item-align: end !important;\r\n align-self: flex-end !important;\r\n }\r\n .R1In6pl7PW91BoY3krKQ {\r\n -ms-flex-it
Source: Reader_Install_Setup.exe	String found in binary or memory: !important;\r\n justify-content: flex-start !important;\r\n }\r\n .mXqDCUtaC_JMHMad0ZwV {\r\n -ms-flex-pack: end !important;\r\n justify-content: flex-end !important;\r\n }\r\n .qOrqtkCp3ivHw7SVfILq {\r\n -ms-flex-pack: center !important;\r\n
Source: Reader_Install_Setup.exe	String found in binary or memory: -content: space-around !important;\r\n }\r\n .SkBdZQ4j6W8eEExZe0hD {\r\n -ms-flex-align: start !important;\r\n align-items: flex-start !important;\r\n }\r\n .WAJbhUQHN23bq7qy5Sn4 {\r\n -ms-flex-align: end !important;\r\n align-items: flex-end !
Source: Reader_Install_Setup.exe	String found in binary or memory: Km2Za0W8caH7Y94_8Cii {\r\n -ms-flex-align: stretch !important;\r\n align-items: stretch !important;\r\n }\r\n .W43tG1Sz8VgKlzT3ABdI {\r\n -ms-flex-line-pack: start !important;\r\n align-content: flex-start !important;\r\n }\r\n .jl0mwv_1IlwXKTH
Source: Reader_Install_Setup.exe	String found in binary or memory: lighting-color marker-end marker-mid marker-start overline-position overline-thickness paint-order panose-1 pointer-events rendering-intent shape-rendering stop-color stop-opacity strikethrough-position strikethrough-thickness stroke-dasharray stroke-dashoffs
Source: Reader_Install_Setup.exe	String found in binary or memory: Congratulations": { "message": "Gratulerer!" }, "ActionList_Verify": { "message": "Verifiserer installasjon ..." }, "ActionList_ErrorUpdateMessage": { "message": "Kommandolinjeargumentet -installasjonsprogram kreves, men er ikke oppg
Source: Reader_Install_Setup.exe	String found in binary or memory: n: start !important;\r\n align-self: flex-start !important;\r\n }\r\n .eLScPzCVVKub71kFSTo6 {\r\n -ms-flex-item-align: end !important;\r\n align-self: flex-end !important;\r\n }\r\n .AjPsmeBDtyK_yy_tIXdq {\r\n -ms-flex-item-align: center !impor
Source: Reader_Install_Setup.exe	String found in binary or memory: stify-content: flex-start !important;\r\n }\r\n .y9ejXHhttjAEgovYXYMU {\r\n -ms-flex-pack: end !important;\r\n justify-content: flex-end !important;\r\n }\r\n .COPRSpy9kETB_SZQ4smx {\r\n -ms-flex-pack: center !important;\r\n justify-content: ce
Source: Reader_Install_Setup.exe	String found in binary or memory: !important;\r\n }\r\n .AwPLyaWsRJ3kVfxTYAKZ {\r\n -ms-flex-align: start !important;\r\n align-items: flex-start !important;\r\n }\r\n .JLhQyJ9YeJ2Xzm4rGI0o {\r\n -ms-flex-align: end !important;\r\n align-items: flex-end !important;\r\n }\r\n
Source: Reader_Install_Setup.exe	String found in binary or memory: ft..." }, "ActionList_ErrorUpdateMessage": { "message": "Das Befehlszeilenargument -installer muss angegeben werden." }, "ActionList_AlreadyExists": { "message": "Die Anwendung ist bereits installiert." }, "ActionList_Comp
Source: Reader_Install_Setup.exe	String found in binary or memory: \r\n -ms-flex-align: stretch !important;\r\n align-items: stretch !important;\r\n }\r\n .kaIxRiZtzxK_YyZMBHo_ {\r\n -ms-flex-line-pack: start !important;\r\n align-content: flex-start !important;\r\n }\r\n .l1QG33TebFm8kJRTmnh7 {\r\n -ms-fle
Source: Reader_Install_Setup.exe	String found in binary or memory: \n align-self: flex-start !important;\r\n }\r\n .gvNgooS8lRGqBrL8T2NG {\r\n -ms-flex-item-align: end !important;\r\n align-self: flex-end !important;\r\n }\r\n .hd7N4PctGEIBBTckCPnz {\r\n -ms-flex-item-align: center !important;\r\n align-sel

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

File read: C:\Users\user\Desktop\Reader_Install_Setup.exe

Jump to behavior

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\InProcServer32

Jump to behavior

Source: Reader_Install_Setup.exe

Static PE information: certificate valid

Source: Reader_Install_Setup.exe

Static file information: File size 1445432 > 1048576

Source: Reader_Install_Setup.exe

Static PE information: Raw size of UPX1 is bigger than: 0x100000 < 0x159200

Source: Reader_Install_Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

Code function: 0_2_0070DE50 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_0070DE50

Source: Reader_Install_Setup.exe

Static PE information: real checksum: 0x16cd57 should be: 0x166b71

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_0049FAEC push ecx; ret	0_2_0049FAFF
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_080651F3 pushad ; iretd	0_2_080651F6
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_0970D590 pushfd ; ret	0_2_0970D591

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 3520000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 36D0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 43B0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 43D0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 7F60000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 8000000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 8020000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 9750000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 97B0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 9850000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 98B0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 9910000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 9990000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 99D0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 9A10000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 9AD0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 9AF0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 9B10000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 9B40000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 9B60000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 9C80000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 9CC0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 9D40000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 7F40000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 91F0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 9210000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 9470000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 94E0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 9500000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 9520000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: A1A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 95B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: A2A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 9810000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 98D0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 99B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: B5A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: B5C0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: B960000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: BD00000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 95D0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 9630000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 1350000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Memory allocated: 1370000 memory commit \| memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

Evaded block: after key decision

graph_0-78360

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_003393E0 GetFileAttributesW,PathFileExistsW,PathIsDirectoryW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpW,FindNextFileW,FindClose,RemoveDirectoryW,		0_2_003393E0
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_00344620 PathIsDirectoryW,GetFileAttributesW,GetLastError,FindFirstFileW,FindNextFileW,GetLastError,FindClose,DeleteFileW,DeleteFileW,RemoveDirectoryW,RemoveDirectoryW,FindClose,GetLastError,		0_2_00344620

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

Code function: 0_2_004A067B VirtualQuery,GetSystemInfo,

0_2_004A067B

Source: Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWpxN

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

API call chain: ExitProcess graph end node

graph_0-74836

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

Code function: 0_2_004A6EB1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_004A6EB1

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

Code function: 0_2_00358331 OutputDebugStringA,GetLastError,

0_2_00358331

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

Code function: 0_2_0070DE50 EntryPoint,LoadLibraryA,GetProcAddress,ExitProcess,VirtualProtect,VirtualProtect,VirtualProtect,

0_2_0070DE50

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_004C4A24 mov eax, dword ptr fs:[00000030h]		0_2_004C4A24
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_004B6F6C mov ecx, dword ptr fs:[00000030h]		0_2_004B6F6C

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_0049F624 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_0049F624
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: 0_2_004A6EB1 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_004A6EB1

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

Code function: 0_2_002EDB00 GetModuleFileNameW,GetVersionExW,ShellExecuteExW,CloseHandle,

0_2_002EDB00

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

Code function: 0_2_002E95A0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

0_2_002E95A0

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: GetModuleHandleW,GetProcAddress,RtlEncodePointer,RtlDecodePointer,GetLocaleInfoEx,GetLocaleInfoW,	0_2_0036D567
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: GetACP,IsValidCodePage,GetLocaleInfoW,	0_2_004C9387
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: GetLocaleInfoW,	0_2_004C9582
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: EnumSystemLocalesW,	0_2_004C9674
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: EnumSystemLocalesW,	0_2_004C9629
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: EnumSystemLocalesW,	0_2_004C26F3
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: EnumSystemLocalesW,	0_2_004C970F
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	0_2_004C979A
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: GetLocaleInfoW,	0_2_004C99ED
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	0_2_004C9B16
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: GetLocaleInfoW,	0_2_004C9C1C
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	0_2_004C9CEB
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Code function: GetLocaleInfoW,	0_2_004C2CB0

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Queries volume information: C:\Users\user\Desktop\Reader_Install_Setup.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Reader_Install_Setup.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

Code function: 0_2_00330FE0 RtlEnterCriticalSection,RtlLeaveCriticalSection,RtlEnterCriticalSection,RtlLeaveCriticalSection,CreateFileW,Sleep,CreateFileW,CreateNamedPipeW,CreateNamedPipeW,ConnectNamedPipe,GetLastError,GetLastError,Sleep,GetLastError,RtlLeaveCriticalSection,ConnectNamedPipe,GetLastError,GetLastError,GetLastError,GetLastError,CreateThread,RtlLeaveCriticalSection,RtlLeaveCriticalSection,RtlLeaveCriticalSection,

0_2_00330FE0

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

Code function: 0_2_003404D0 GetLocalTime,GetTimeFormatW,GetDateFormatW,

0_2_003404D0

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

Code function: 0_2_004C51D9 GetTimeZoneInformation,

0_2_004C51D9

Source: C:\Users\user\Desktop\Reader_Install_Setup.exe

Code function: 0_2_002DEE50 GetVersionExW,GetModuleFileNameW,PathRemoveFileSpecW,PathFileExistsW,GetModuleHandleW,GetProcAddress,GetSystemWindowsDirectoryW,SetDllDirectoryW,LoadLibraryW,PathIsDirectoryW,LoadLibraryW,LoadLibraryW,6F5433E0,CommandLineToArgvW,__Init_thread_footer,__Init_thread_footer,SHCreateDirectoryExW,GetLastError,WaitForSingleObject,TerminateThread,CloseHandle,LoadIconW,FreeLibrary,

0_2_002DEE50

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Email Collection	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Native API	Boot or Logon Initialization Scripts	1 Access Token Manipulation	1 Virtualization/Sandbox Evasion	LSASS Memory	1 Query Registry	Remote Desktop Protocol	1 Archive Collected Data	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Process Injection	1 Disable or Modify Tools	Security Account Manager	21 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Access Token Manipulation	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Process Injection	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	25 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://mths.be/array-of	0%	Avira URL Cloud	safe
https://mths.be/array-from	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://p.typekit.net/V	Reader_Install_Setup.exe, 00000000.00000002.2912796622.0000000009DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://use.typekit.net/af/a2527e/000000000000000000017704/27/l?primer=0635fba006f1437d962ae878ad04a	Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reactjs.org/docs/err	Reader_Install_Setup.exe	false		high
https://use.typekit.net/af/4b3e87/000000000000000000017706/27/d?primer=0635fba006f1437d962ae878ad04a	Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://use.typekit.net/T	Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014B3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reactjs.org/docs/error-decoder.html?invariant=arguments.length	Reader_Install_Setup.exe, 00000000.00000003.1663276754.00000000092DD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://use.typekit.net/bxf0ivf.jsn.type	Reader_Install_Setup.exe, 00000000.00000003.1663237896.00000000092F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://use.typekit.net/af/a2527e/000000000000000000017704/27/	Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2905100153.0000000007FA1000.00000004.00000800.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	false		high
https://use.typekit.net/af/cb695f/000000000000000000017701/27/l?primer=0635fba006f1437d962ae878ad04a	Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2902316987.0000000005601000.00000004.00000020.00020000.00000000.sdmp	false		high
https://use.typekit.net/af/74ffb1/000000000000000000017702/27/a?primer=0635fba006f1437d962ae878ad04a	Reader_Install_Setup.exe, 00000000.00000002.2902316987.0000000005601000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://use.typekit.net/bxf0ivf.js#	Reader_Install_Setup.exe, 00000000.00000002.2902316987.0000000005601000.00000004.00000020.00020000.00000000.sdmp	false		high
https://use.typekit.net/af/a2527e/000000000000000000017704/27/d?primer=0635fba006f1437d962ae878ad04a	Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reactjs.org/link/react-polyfills	Reader_Install_Setup.exe, Reader_Install_Setup.exe, 00000000.00000002.2911755940.0000000009D0B000.00000004.00000800.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1663237896.00000000092F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://use.typekit.net/af/cb695f/000000000000000000017701/27/	Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2905100153.0000000007FA1000.00000004.00000800.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	false		high
https://use.typekit.net/bxf0ivf.js_Install_Setup.exe/160C959/	Reader_Install_Setup.exe, 00000000.00000002.2898087056.000000000144F000.00000004.00000020.00020000.00000000.sdmp	false		high
http://typekit.com/eulas/000000000000000000017704	Reader_Install_Setup.exe, 00000000.00000002.2901308172.0000000004138000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1680102941.000000000413D000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2914228623.000000000ACC2000.00000004.00000800.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1679761273.000000000413D000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2912796622.0000000009DE4000.00000004.00000020.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	false		high
https://use.typekit.net/af/4b3e87/000000000000000000017706/27/a?primer=0635fba006f1437d962ae878ad04a	Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://typekit.com/eulas/000000000000000000017706	Reader_Install_Setup.exe, 00000000.00000002.2901308172.0000000004138000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2914228623.000000000ACC2000.00000004.00000800.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2912796622.0000000009DE4000.00000004.00000020.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	false		high
https://use.typekit.net/af/40207f/0000000000000000000176ff/27/a?primer=0635fba006f1437d962ae878ad04a	Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://typekit.com/eulas/0000000000000000000176ff	Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2912917971.0000000009E58000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2914228623.000000000ACC2000.00000004.00000800.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	false		high
http://typekit.com/eulas/000000000000000000017701	Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2912917971.0000000009E58000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2914228623.000000000ACC2000.00000004.00000800.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	false		high
http://typekit.com/eulas/000000000000000000017702	Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2914228623.000000000ACC2000.00000004.00000800.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2903252619.0000000007E59000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1675262282.0000000007E4C000.00000004.00000020.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	false		high
http://typekit.com/eulas/000000000000000000017703	Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2912917971.0000000009E58000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2914228623.000000000ACC2000.00000004.00000800.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	false		high
http://typekit.com/eulas/000000000000000000017706(v(	Reader_Install_Setup.exe, 00000000.00000002.2901308172.0000000004138000.00000004.00000020.00020000.00000000.sdmp	false		high
https://use.typekit.net/af/74ffb1/000000000000000000017702/27/	Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2905100153.0000000007FA1000.00000004.00000800.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	false		high
https://mths.be/array-from	Reader_Install_Setup.exe, Reader_Install_Setup.exe, 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2905958294.00000000080AB000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1661843913.00000000080A7000.00000004.00000020.00020000.00000000.sdmp, 231[1].0.dr	false	Avira URL Cloud: safe	unknown
https://mths.be/array-of	Reader_Install_Setup.exe, Reader_Install_Setup.exe, 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2905958294.00000000080AB000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1661843913.00000000080A7000.00000004.00000020.00020000.00000000.sdmp, 231[1].0.dr	false	Avira URL Cloud: safe	unknown
https://use.typekit.net/af/eaf09c/000000000000000000017703/27/a?primer=0635fba006f1437d962ae878ad04a	Reader_Install_Setup.exe, 00000000.00000002.2902316987.0000000005601000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://use.typekit.net/bxf0ivf.jsn	Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://use.typekit.net/bxf0ivf.jsEvent1256	Reader_Install_Setup.exe, 00000000.00000002.2898087056.0000000001484000.00000004.00000020.00020000.00000000.sdmp	false		high
https://use.typekit.net/af/eaf09c/000000000000000000017703/27/d?primer=0635fba006f1437d962ae878ad04a	Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://use.typekit.net/	Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014B3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://use.typekit.net/af/74ffb1/000000000000000000017702/27/l?primer=0635fba006f1437d962ae878ad04a	Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://use.typekit.net/bxf0ivf.jsinitErrorMultipleInstanceRunningI	Reader_Install_Setup.exe, 00000000.00000002.2911694624.0000000009D00000.00000004.00000800.00020000.00000000.sdmp	false		high
https://use.typekit.net/af/a2527e/000000000000000000017704/27/a?primer=0635fba006f1437d962ae878ad04a	Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/twbs/bootstrap/blob/main/LICENSE)	Reader_Install_Setup.exe, Reader_Install_Setup.exe, 00000000.00000003.1663575978.0000000004155000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2898087056.000000000146F000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2902316987.0000000005601000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2909468149.0000000009AF0000.00000004.00000800.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1669764842.0000000009DD4000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.2442597818.0000000009520000.00000004.00000800.00020000.00000000.sdmp	false		high
https://use.typekit.net/af/cb695f/000000000000000000017701/27/d?primer=0635fba006f1437d962ae878ad04a	Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://use.typekit.net/af/eaf09c/000000000000000000017703/27/	Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2905100153.0000000007FA1000.00000004.00000800.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	false		high
https://reactjs.org/docs/error-decoder.html?invariant=	Reader_Install_Setup.exe, 00000000.00000003.1676080029.0000000007D21000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2911197588.0000000009C76000.00000004.00000800.00020000.00000000.sdmp	false		high
https://p.typekit.net/	Reader_Install_Setup.exe, 00000000.00000002.2912796622.0000000009DE4000.00000004.00000020.00020000.00000000.sdmp	false		high
https://use.typekit.net/af/40207f/0000000000000000000176ff/27/d?primer=0635fba006f1437d962ae878ad04a	Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://getbootstrap.com/)	Reader_Install_Setup.exe, Reader_Install_Setup.exe, 00000000.00000002.2898087056.0000000001484000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1663575978.0000000004155000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2902316987.0000000005601000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2909468149.0000000009AF0000.00000004.00000800.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1669764842.0000000009DD4000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1670096819.0000000007E09000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.2442597818.0000000009520000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/Fin	Reader_Install_Setup.exe	false		high
https://use.typekit.net/af/40207f/0000000000000000000176ff/27/l?primer=0635fba006f1437d962ae878ad04a	Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014F8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://use.typekit.net/af/4b3e87/000000000000000000017706/27/	Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2905100153.0000000007FA1000.00000004.00000800.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	false		high
https://use.typekit.net/af/eaf09c/000000000000000000017703/27/l?primer=0635fba006f1437d962ae878ad04a	Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014F8000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	false		high
https://use.typekit.net/af/74ffb1/000000000000000000017702/27/d?primer=0635fba006f1437d962ae878ad04a	Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	false		high
http://typekit.com/eulas/000000000000000000017704R	Reader_Install_Setup.exe, 00000000.00000002.2901308172.0000000004138000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1680102941.000000000413D000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000003.1679761273.000000000413D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://use.typekit.net/bxf0ivf.jsL	Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014DE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://p.typekit.net/p.gif?s=1&k=bxf0ivf&ht=tk&h=C%3A%5CUsers%5Cuser%5CDesktop%5CReader_Install_Se	Reader_Install_Setup.exe, 00000000.00000002.2903252619.0000000007E6F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Financial-Times/polyfill-service/issues/317	Reader_Install_Setup.exe, 00000000.00000003.1663642057.0000000004141000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2905428102.0000000007FBA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://p.typekit.net/p.gif	Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2903903113.0000000007F0D000.00000004.00000800.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	false		high
https://use.typekit.net/bxf0ivf.js	Reader_Install_Setup.exe, 00000000.00000002.2898087056.00000000014DE000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2899455039.0000000003568000.00000004.00000800.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2900577435.00000000036A3000.00000004.00000800.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2898087056.0000000001418000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2903252619.0000000007DD8000.00000004.00000020.00020000.00000000.sdmp, 160[1].0.dr	false		high
https://use.typekit.net/af/40207f/0000000000000000000176ff/27/	Reader_Install_Setup.exe, 00000000.00000002.2902316987.00000000055E3000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2905100153.0000000007FA1000.00000004.00000800.00020000.00000000.sdmp, bxf0ivf[1].js.0.dr	false		high
https://use.typekit.net/af/cb695f/000000000000000000017701/27/a?primer=0635fba006f1437d962ae878ad04a	Reader_Install_Setup.exe, 00000000.00000002.2902316987.0000000005601000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reactjs.org/link/react-polyfillsn.unstable_shouldYieldn.unstable_forceFrameRate	Reader_Install_Setup.exe, 00000000.00000003.1663237896.00000000092F9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://reactjs.org/link/react-polyfillsThis	Reader_Install_Setup.exe, 00000000.00000002.2911755940.0000000009D0B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://use.typekit.net/af/4b3e87/000000000000000000017706/27/l?primer=0635fba006f1437d962ae878ad04a	Reader_Install_Setup.exe, 00000000.00000002.2902316987.0000000005601000.00000004.00000020.00020000.00000000.sdmp, Reader_Install_Setup.exe, 00000000.00000002.2903093855.0000000007D00000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1391064
Start date and time:	2024-02-12 20:06:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Reader_Install_Setup.exe
Detection:	CLEAN
Classification:	clean7.winEXE@1/13@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 88% Number of executed functions: 213 Number of non-executed functions: 82
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.40.205.17, 23.40.205.16, 23.40.205.67, 23.220.188.152, 23.54.168.43, 23.54.168.50, 192.168.2.4, 52.5.13.197, 52.202.204.11, 54.227.187.23, 23.22.254.206
Excluded domains from analysis (whitelisted): rdc.adobe.io, e4578.dscg.akamaiedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, a1874.dscg1.akamai.net, fe3cr.delivery.mp.microsoft.com, p.typekit.net-stls-v3.edgesuite.net, ocsp.digicert.com, use-stls.adobe.com.edgesuite.net, ssl-delivery.adobe.com.edgekey.net, geo-dc.adobe.com, dlmping2.adobe.com, a1988.dscg1.akamai.net
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: Reader_Install_Setup.exe

Process:	C:\Users\user\Desktop\Reader_Install_Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	49120
Entropy (8bit):	0.0017331682157558962
Encrypted:	false
SSDEEP:	3:Ztt:T
MD5:	0392ADA071EB68355BED625D8F9695F3
SHA1:	777253141235B6C6AC92E17E297A1482E82252CC
SHA-256:	B1313DD95EAF63F33F86F72F09E2ECD700D11159A8693210C37470FCB84038F7
SHA-512:	EF659EEFCAB16221783ECB258D19801A1FF063478698CF4FCE3C9F98059CA7B1D060B0449E6FD89D3B70439D9735FA1D50088568FF46C9927DE45808250AEC2E
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\160[1]

Download File

Process:	C:\Users\user\Desktop\Reader_Install_Setup.exe
File Type:	HTML document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	1369
Entropy (8bit):	5.042349729995224
Encrypted:	false
SSDEEP:	24:OPH/wMz8MespW0mWUvF0k6aM94NaM94SKCBMazEJMThHyaPqAVg7vVsI6:OXntkRWmFC9u9sCaazECFHyafVFH
MD5:	AB2A2BC6C53F862BA5018B7A6EA76C08
SHA1:	3BF47FD954DC9DCE93DA87B0EA42F78488646A4E
SHA-256:	240B1B561A404C5309587A17F3B0FBFF6ACEE2E816D565BDE1999C60CB00FC1F
SHA-512:	78180D38566AF52FB74B71AB9BE9009E4A75B36C6D27056C851849B7077CD1F8C0500F1178FBFE3CDFAE590B9A9A6DDAB812E460971D03F0127C01E09648AF03
Malicious:	false
Reputation:	low
Preview:	.<!doctype html>..<html lang="en" style="font-size:3.26vh">..<head>.. <meta charset="UTF-8">.. <meta http-equiv="X-UA-Compatible" content="IE=Edge">.. <script src="https://use.typekit.net/bxf0ivf.js" type="text/javascript"></script>.. <script type="text/javascript">try { Typekit.load(); } catch (e) {}</script>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>ADM</title>.. <style>.. body {.. margin: 0px;.. background-color: #ffffff;.. -webkit-tap-highlight-color: rgba(0,0,0,0);.. font-style: normal;.. border-top:1px solid #c7c6c7;.. }.. </style>.. <script>.. function onLoadComplete() {.. function messageFromNative(message, jsonDataString) {.. window.messageFromNative(message, jsonDataString).. }.. window.sendMessageToNative("documentReady", "").. }.. </script>.. <script defer="defer" src="../SC

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\d[1]

Download File

Process:	C:\Users\user\Desktop\Reader_Install_Setup.exe
File Type:	Web Open Font Format, CFF, length 40156, version 0.0
Category:	dropped
Size (bytes):	40156
Entropy (8bit):	7.99077330546425
Encrypted:	true
SSDEEP:	768:zqK4oMIHg6OWlw62kItML9n0TM+rMiVIoZSruxA443l0PPv:zf45IAFemML9n0TfVIeauxB43l03v
MD5:	83E5380B9DC2077B664E383CF6FCF47E
SHA1:	D8AE10285EADED477A647A39293E9294958C0572
SHA-256:	741A4BC7D04FC8385F9A1DB0CCC586A224F14233B08D764D37EA165163A247A0
SHA-512:	8EB2833ABC2C13491D2BD30B962A41457AEEA3F5C782108E6319B0ABDE0C97AA3B347D57E8A031DBC5B4BCF5DB3729D68D6F2A098E182BD5C62E761A1476B313
Malicious:	false
Reputation:	low
Preview:	wOFFOTTO...........l........................BASE...D...F...Fe!].CFF ...8..v.....Q<..DYNA..zD........d...GDYN..{@.......Q.ow#GPOS..\|`...z..7LUd..OS/2.......Y...`].y.cmap................gasp................head.......5...6..%ghhea.......!...$....hmtx............h8+.maxp...0.........0P.name............E..post........... ...2..............ideoromn..DFLT..cyrl..grek..latn...................Y..............x.c`d```5...5...+.3.......P/....??...[.....L Q.b..n...x...n.@.....!.V,.@.cGV.FB$m..j.H..6N<i..`O#...@..X.$<......#g........x....^}.-.x.S..t1.\|......,=.b...............S.J\|...e..s.O......;.]j>z>D.\|.\|.W...1...R.b.....}muQ..ra...R.3)Fy......T..1...s..c.g...d8..O....'M......FW...-...X..+c...H....t..].\|=.e"..R........o.fm.......:T.^Q..z...c(.S..........a..w.KN{.l...M]..tu9...k.b.L.N...v...Y..R.[0....1...C*/..8.^...GM..r....jvfx..<.o..t.P.....=Kv-.kr..n.....5.%.9].>q......f:.3<C.e9.-5.:Yz4O....:e....+b.}.oS..1x.c`f.........).....B3.1.1..E.9..XX..X......P........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\d[2]

Download File

Process:	C:\Users\user\Desktop\Reader_Install_Setup.exe
File Type:	Web Open Font Format, CFF, length 39564, version 0.0
Category:	dropped
Size (bytes):	39564
Entropy (8bit):	7.989107484119666
Encrypted:	false
SSDEEP:	768:cyVNSFlHRrs14+NsyQTfaVEAiYgPA9eFXPi37iRX3+qqVFtZN7Pv:XSFlKTcfaVaYgweFXPiLknHqXtDv
MD5:	A870EE6A735514C321010F19CE3644D7
SHA1:	59FE54D58D3C53AF232A98A6EFA98170ECCEDD20
SHA-256:	79E3A4E2C2274ACD602155924DC8C0B7C3AFDCD40450B2DFEDA302AD8E140649
SHA-512:	B0AEBF67D8989C8F794592A892997C2372FEA9D0076E6EFAD032DD643FB5BB23C730A7EF1FF14807A52DB058E68D9094D8EE713DD2EB82E2676E90430BE29F1C
Malicious:	false
Reputation:	low
Preview:	wOFFOTTO........... ........................BASE...D...F...Fe(].CFF ...@..sm.....m..DYNA..w.........c...GDYN..x...."...Q.y.GPOS..y.......7vo...OS/2.......Y...`[.t.cmap................gasp................head.......4...6..%`hhea.......!...$....hmtx............9!2.maxp...8.........0P.name.............8I.post...p....... ...2..............ideoromn..DFLT..cyrl..grek..latn...................`..............x.c`d```5.J}..5...+.3........P..?.?....1 ....$..fn.Rx..An.@....I..jo0.>...!..$H........`a{.=Ab.u.]...B..E..T..<...Y....3.{o....._.....k....x......c.Mj.......f~..B......9...s..A.V......g.Mj.{>F...\|..0.[.5>=.P..1X....}iuV..\|n..)b..R..TL...b.K].X.R...M..!..H...?....N...N...p..x..21...wS.J.T.m...;.Jv..Y....e..B.....kk....o.&.rn....z~u...%. .Bq\..X.`.M.b.....)p...Y-........r.L.`.5+..i>5.;.<..C3%'...U...X......D..{.!F.~...8=..c.~y.{w.s..{..U........._....~.j......)Sg.....R^:.u[v..m.....j.eJ.w.u.T.....Oy.s-..m.x..x.c`f.........................L,,LL,..L.@yF.(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\231[1]

Download File

Process:	C:\Users\user\Desktop\Reader_Install_Setup.exe
File Type:	data
Category:	dropped
Size (bytes):	565859
Entropy (8bit):	5.75699707817581
Encrypted:	false
SSDEEP:	6144:WbbVuAi2W7oxxnXKC9SjJ0Xh1kb9um4GMJ2z4vwOrtJNiidS:gVuAnW7unXrzrDS
MD5:	6C465CC474639C94025D46A7ECCC839D
SHA1:	DE19BA37FE2C39BB6C17CC8243632C94A65BA55E
SHA-256:	00D1E5374C7EB8B7B6F92E3E21EEDEFEA23E7E930564101AAC9D8C0A2EE1DA10
SHA-512:	78F6BD67D398E4A0AE6F5E58D1EE51BB7EC4DBE0E2900BAE519D53D1FA147129578F940846A0C0806AD479D75F83864D3593D7944BE5A89B05F9E3C16D4016B4
Malicious:	false
Reputation:	low
Preview:	var index;!function(){var r={5500:function(r,n,e){function t(r){return t="function"==typeof Symbol&&"symbol"==typeof Symbol.iterator?function(r){return typeof r}:function(r){return r&&"function"==typeof Symbol&&r.constructor===Symbol&&r!==Symbol.prototype?"symbol":typeof r},t(r)}!function(r,n){./! https://mths.be/array-of v0.1.0 by @mathias /.!function(){"use strict";var r=function(){try{var r={},n=Object.defineProperty,e=n(r,r,r)&&n}catch(r){}return e}(),n=function(){for(var n,e=arguments,t=e.length,o=function(r){try{return!!new r}catch(r){return!1}}(this)?new this(t):new Array(t),a=0;a<t;)n=e[a],r?r(o,a,{value:n,writable:!0,enumerable:!0,configurable:!0}):o[a]=n,a+=1;return o.length=t,o};r?r(Array,"of",{value:n,configurable:!0,writable:!0}):Array.of=n}(),Object.defineProperty(Array.prototype,"fill",{configurable:!0,value:function(r){if(this===n\|\|null===this)throw new TypeError(this+" is not an object");var e=Object(this),t=Math.max(Math.min(e.length,9007199254740991),0)\|\|0,o=1 in a

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\p[1].gif

Download File

Process:	C:\Users\user\Desktop\Reader_Install_Setup.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	GIF89a.............,..............;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\d[1]

Download File

Process:	C:\Users\user\Desktop\Reader_Install_Setup.exe
File Type:	Web Open Font Format, CFF, length 37480, version 0.0
Category:	dropped
Size (bytes):	37480
Entropy (8bit):	7.989671357448148
Encrypted:	false
SSDEEP:	768:+Fth4mFn+GiKkGQPWdGPgIVw9xRju2H3/Nn/byU:Am+nxiKsPWdGPH+FuVU
MD5:	EE10AE517D40542F597A9E0E2852B52B
SHA1:	D30F8C2467A4689844268B82E0E2ECFE3464CDAE
SHA-256:	ED1815F9829E1F6A710FCDC182613F614F4887E39281E095360BEEC1CCC72348
SHA-512:	A327F9E3B5B9AA8CB13BC118DA5F26AF5C3A8DBB66128F36F18E09EB019A222846694A6A8C13FDC48F0460BC9E79BA7EA9DC8AA9EB8B30F63576448328E83ACB
Malicious:	false
Reputation:	low
Preview:	wOFFOTTO...h.......T........................BASE...D...F...Fe$].CFF ...8..l....x.Q.DYNA..pT.......\|Zh`.GDYN..q<.......9J..uGPOS..rL......3.*^..OS/2.......]...`\Xv.cmap...T.........G.;gasp................head.......4...6.:%Fhhea.......$...$.$..hmtx...T........;..Xmaxp...0.........0P.name...........~n\.hpost...<....... ...2..............ideoromn..DFLT..cyrl..grek..latn...................\..............x.c`d```5...v........(.p>9..F.W...b.\|............8x.RKn.0..9...m.U.]..@(Z..8..N...6.$.`}\.1.#....A.=I......"(...>>..;<.C..8[..5w-...G..O.w.Y;\|.!>;..[\|u..}<R.u_qW.....{K.;x.e......p..o....;....'.;...(u..2.bq...k1+...Ud.J.q..yz.1...ZW{.[.U..bf.,MB.....z2..M...C7..3.RWuZ.....D .R.Mi....Trp6....Zfi..P.C.^.n..]..9..652)s_.gQ.?..`..<@ ..8'.c..14....0.9W..{.0[ag.. .....#..6..v..jr.......M...kFm...._8..k.%S.~.~.N..e.X.......%w.....es.i;...e.=.V-.kr.....9...k8kF..c....Z..W.t....9.;.c~K.C}sj..=u.k.]]..}.7........x.c`f..8.......)....o......`....fefba.dbQ``jg```d..G.'W....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\d[2]

Download File

Process:	C:\Users\user\Desktop\Reader_Install_Setup.exe
File Type:	Web Open Font Format, CFF, length 39972, version 0.0
Category:	dropped
Size (bytes):	39972
Entropy (8bit):	7.991697943495219
Encrypted:	true
SSDEEP:	768:/CjC6+7R1Cf1RSIpcme1GO3SgcXFwwSUyaXgofeoUyN+MPv:/Cjh+lQf1xpG3S1XFwwSUyaXgofPqov
MD5:	DF0CD5EDE266E9EA694C3D28209FCE9F
SHA1:	ECCA8585322A40CF1D0A479EBE67597ADF50E69D
SHA-256:	5ECD3C64E4C0D1A51D13E2762BECB9E7DA2ACD30D670058A6B16761BE3E017DB
SHA-512:	B747532E1CDF0C57EF67D45389B61D14ACAF19BC36A9E007189F0F551CBC3D13AD518803A572AB061CB42F129C1AAEEFF25AB066C72CBE4B562841624D5EAE75
Malicious:	false
Preview:	wOFFOTTO...$.......8........................BASE...D...F...Fe$].CFF ...4..t..../.>.PDYNA..y ........c...GDYN..z...."...Q..mGPOS..{@......7v_...OS/2.......Y...`\Wv.cmap................gasp................head.......4...6..%uhhea.......!...$....hmtx...$........P+/kmaxp...,.........0P.name................post........... ...2..............ideoromn..DFLT..cyrl..grek..latn...................\..............x.c`d```5..S.........(.p>94.F......\|..ef`....&c..x.RKn.0..9N...Qt.5.v..R 8.Wv..Y%...%..........0...]t.S...@G...M..!q.{3C.Q....<t.o.=.a...^a...>...>9....a.........J.....O.=..b.{.x{......p.......~8\|......$.....:..U.h.84F...e].ul.J.I...f..F.u......2.q1..,.#...xr5..m..N]......N..,D..].P..ii.e...Trx6.....6I(#...z..S]..9Tz.1rY.f....'..U.G..P..D..P".&^....8.,x].....7.....e..sl.F.Jc#.Y..s...Th............aL.....E...t..(;..U...;....,......^H...LJ..g.x.A^[....X.._.g6.kb..}G..%.n.e......}.X....]?g^;~C.^4..t...<...x.c`f\|.8.......).....B3.1.1.E.Y..XX..X......P............

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\bxf0ivf[1].js

Download File

Process:	C:\Users\user\Desktop\Reader_Install_Setup.exe
File Type:	Unicode text, UTF-8 text, with very long lines (2369)
Category:	dropped
Size (bytes):	18413
Entropy (8bit):	5.5692261470401165
Encrypted:	false
SSDEEP:	384:S12hpIgIVsUGiRm4lIeU4iDFeFs2NdFJsQF+i:SF7GiRm4X0JqsG7Ui
MD5:	CFE609917C9E7D4EED2C80563DED171B
SHA1:	2E5BBD88B040662BF8023FD6A9D55CC760008695
SHA-256:	AD84B43FFD121E46AC4D2FA817B5863E4802C523BC3FB5E864DB28B3DB0E2514
SHA-512:	1F600E1ABF1814C89589462ADE13F2E5399082236829EB45A530C852AE135910CB332D540B228DA744B60241BC74E85A3E5EB60CBC65B860E8E9148AF79C54D7
Malicious:	false
Preview:	/. The Typekit service used to deliver this font or fonts for use on websites. * is provided by Adobe and is subject to these Terms of Use. * http://www.adobe.com/products/eulas/tou_typekit. For font license. * information, see the list below.. . adobe-clean:. * - http://typekit.com/eulas/000000000000000000017701. * - http://typekit.com/eulas/000000000000000000017702. * - http://typekit.com/eulas/000000000000000000017703. * - http://typekit.com/eulas/0000000000000000000176ff. * - http://typekit.com/eulas/000000000000000000017704. * - http://typekit.com/eulas/000000000000000000017706. . . 2009-2024 Adobe Systems Incorporated. All Rights Reserved.. */.if(!window.Typekit)window.Typekit={};window.Typekit.config={"a":"19707152","c":[".tk-adobe-clean","\"adobe-clean\",sans-serif",".tk-adobe-clean-condensed","\"adobe-clean-condensed\",sans-serif"],"fi":[7180,7181,7182,7184,7185,22474],"fc":[{"id":7180,"family":"adobe-clean","src":"https://use.typekit.net/af/cb695f/000000

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\d[1]

Download File

Process:	C:\Users\user\Desktop\Reader_Install_Setup.exe
File Type:	Web Open Font Format, CFF, length 40596, version 0.0
Category:	dropped
Size (bytes):	40596
Entropy (8bit):	7.990882155754029
Encrypted:	true
SSDEEP:	768:B2Ws4f6Rc1d7fPlzKC8h7Wy1qmDG8WCecBE6SvNxkCTuLQjlrXPv:B21o6A7fPlh8iPClQNxkC6+1/v
MD5:	590A9EEBC0AC0BA776529CBA1D5B718A
SHA1:	E1AA96B54C162F1DEA3CE203B45CD115051BA351
SHA-256:	28195F698F74D701F5B253495756F7ECD70C50047C1F795952587E6F3E742B19
SHA-512:	387ADC334C00F4083660107D9C4C3FE3461F1BF4D135A2A7DCF475FFC9C04680D0ECEA30591F253DF584F8F063CC430D69162AD1B8BFFB6C01972079BF6447BF
Malicious:	false
Preview:	wOFFOTTO...................................BASE...D...F...Fe.].CFF ...P..w....n..z.DYNA..{.........d...GDYN..\|....#...Q0.exGPOS..~.......7JT...OS/2.......Y...`].z.cmap................gasp................head.......4...6..%}hhea...$...!...$....hmtx............t.).maxp...H.........0P.name................post...x....... ...2..............ideoromn..DFLT..cyrl..grek..latn...................W..............x.c`d```5.R.{fz<..W.f..@.....0....>.....\f.&.(.h...x...n.@.E..IUUB]...D.*e..X.x...T....... l..'(\|D.......t..t...4.T.xd....o.m.o..........W......{nR....=\|.\|.w.-t..YA.5Wy..s....s......\|..{nR...!...#\|h\|.....I.J....L..oK..R\.SS.M.X=....b../l)F......2.I....H.&....!M.H..(._....9......p......E.p;..TJ..c.&..T.{.g.J.{/..$...zJ......v.n.z..rj..fye[..u.]u.'..P..>f0.@....%g....c.h...M\l...R.....c.H.V...v././....\|1...0.RU...@N..17..!...UCG...y...sn\.....K..8...n..o.uNqgA.u..yZA]...(N..._...nJ....s......S.@...9..^....!...+.j..a.].g.....l..x.c`fbeV``e``.b.```...q.F..@QnN

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\d[2]

Download File

Process:	C:\Users\user\Desktop\Reader_Install_Setup.exe
File Type:	Web Open Font Format, CFF, length 40248, version 0.0
Category:	dropped
Size (bytes):	40248
Entropy (8bit):	7.989634769609523
Encrypted:	false
SSDEEP:	768:LDFkEGYLN2ySKC2EspJHit0n4ZHtSxGHRT99rgv8sBe9gUR98RzVuppM+2RX2xQ5:L2E7N6u/its45ExGHR/8v8Dg29OzVu/M
MD5:	C26C1B68EDD07AB0069CF2EFE0886C1F
SHA1:	3579AED1FC9953159F817E57E7899849AC94EA85
SHA-256:	72073CA6C71BCC781491B054C4325A663834082457FD896CB6E1E9931BF6E013
SHA-512:	5459372E0DD2056437217F9668C393111C54E3C31FBDCA997E9D06C1DC3519DBA0AB0AB7B1F28A10AE10009AC828AEA9BFC21A2E58185F79E2403FEEEF424E32
Malicious:	false
Preview:	wOFFOTTO...8...............................BASE...D...F...Fe.].CFF ...@..vs........DYNA..z.........d...GDYN..{...."...QZ].BGPOS..\|....c..7B....OS/2.......Y...`^B{.cmap...0............gasp................head.......4...6..%phhea.......!...$....hmtx...8..........%.maxp...8.........0P.name...............]post........... ...2..............ideoromn..DFLT..cyrl..grek..latn...................U..............x.c`d```5..,....o....P..\|r...........k ....$..Y\.jx...n.0....'E..}..{hZ..8...@29.....~hH....;t.#.......y..@.(.5.!.!....RW.............[x...G....65[.......z~..A.?X...rU......s....#......<{>F...\|..2.;X..<.P..1Z....}eu^..bi.)c.WR..L...Vb.+]..l.W...1..e:...,.#.....z<.:.S.:.....E..........P*...c....T..6..T.. .d..HF.....X...v.~......G........9. .Bq\.FX.`.M.c....s..e....h.3v.....8.fH....4gM..+...X..R....Y..KD....D.......?..=N.<..._.........y......C...U....[.....~.lN.~.....W..{.\^;..?.._..a...T...t.....K.Y....}...2..x.c`f.`na`e``.b.```...q.F..@Qn.f&..&&....v.<#..

C:\Users\user\AppData\Local\Temp\Adobe_ADMLogs\Adobe_ADM.log

Download File

Process:	C:\Users\user\Desktop\Reader_Install_Setup.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (538), with CRLF line terminators
Category:	dropped
Size (bytes):	27074
Entropy (8bit):	3.5932758324359004
Encrypted:	false
SSDEEP:	768:8ofE7sJ8emLsghGJZgt2FJhs4KPgfFBfjaf:8wE7sJ8emLsghGJZgUFJhs4KPQbjaf
MD5:	8CFD3CACE9B67887B7B810F9E4621686
SHA1:	CCF7D15878A0B0516414FDE769F75F01004EFF07
SHA-256:	CDF58A700BE244CE5E7AEE4CB6B75B6887D30182E8ABBED05C45A3D72BF9D643
SHA-512:	C22AF68D8201BB2414E848CC78DCAE8396D47C83166AABB817AC76877B19E8FF68165EEEF68EDA36F8131A1CD8E524886DB31B23B1BC7F8E1C3688D5D960CC9C
Malicious:	false
Preview:	..0.2./.1.2./.2.4. .2.2.:.0.4.:.4.6.:.2.4.0. .\|. .[.I.N.F.O.]. .\|. . .\|. .A.D.M. .\|. . .\|. .A.p.p.l.i.c.a.t.i.o.n.C.o.n.t.e.x.t. .\|. . .\|. . .\|. .7.4.2.4. .\|. ........................ .A.D.M. .W.o.r.k.f.l.o.w. .s.t.a.r.t... .V.e.r.s.i.o.n.:. .2...0...0...7.5.9.s. ..........................*.....0.2./.1.2./.2.4. .2.2.:.0.4.:.4.6.:.2.4.0. .\|. .[.T.R.A.C.E.]. .\|. . .\|. .A.D.M. .\|. . .\|. .A.p.p.l.i.c.a.t.i.o.n.C.o.n.t.e.x.t. .\|. . .\|. . .\|. .7.4.2.4. .\|. .C.o.m.m.a.n.d. .L.i.n.e. .:. .t.e.s.t...e.x.e. .....0.2./.1.2./.2.4. .2.2.:.0.4.:.4.6.:.2.4.0. .\|. .[.I.N.F.O.]. .\|. . .\|. .A.D.M. .\|. . .\|. .A.p.p.l.i.c.a.t.i.o.n.C.o.n.t.e.x.t. .\|. . .\|. . .\|. .7.4.2.4. .\|. .A.d.m.i.n. .a.n.d. .n.o.t. .c.h.i.l.d. .p.r.o.c.e.s.s... .N.o. .n.e.e.d. .f.o.r. .I.P.C.....0.2./.1.2./.2.4. .2.2.:.0.4.:.4.6.:.5.8.4. .\|. .[.I.N.F.O.]. .\|. . .\|. .A.D.M. .\|. . .\|. .A.p.p.l.i.c.a.t.i.o.n.C.o.n.t.e.x.t. .\|. . .\|. . .\|. .7.4.2.4. .\|. .W.h.i.t.e. .l.i.s.t.e.d. .U.R.L.s. .

C:\Users\user\AppData\Local\Temp\Adobe_ADMLogs\Adobe_GDE.log

Download File

Process:	C:\Users\user\Desktop\Reader_Install_Setup.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	390
Entropy (8bit):	3.1291540451651096
Encrypted:	false
SSDEEP:	6:Q9KlZQfhY6qnRarPAADi6Iy3wZQfhY6qnRarPmgNZSY:Q9KlsZqnRaTAAu6WsZqnRaTmuZ3
MD5:	F996CCA3E3BA7267860BDD400F1B4AF1
SHA1:	54DAC1019BF21B7A0CB69E12F56DE5C6D6CE8A29
SHA-256:	D095D32D2054EFDEC3708530A021FC774A38E219D7039B99A48AF5CC6CD5AC6E
SHA-512:	E1E9108220A248C5EFF2CFFDE409D42798D0CF2ED1DE834C9596BED2F1DC07A573FADD8162319F4691191993CBC01B8CDA14BA09FC0995AB0075F398224F9176
Malicious:	false
Preview:	..0.2./.1.2./.2.4. .2.2.:.0.4.:.4.9.:.5.1.7. .\|. .[.I.N.F.O.]. .\|. . .\|. . .\|. . .\|. . .\|. . .\|. . .\|. .7.6.0.8. .\|. ....................s.t.a.r.t. .o.f. .D.o.w.n.l.o.a.d................*.....0.2./.1.2./.2.4. .2.2.:.0.4.:.4.9.:.5.1.7. .\|. .[.I.N.F.O.]. .\|. . .\|. . .\|. . .\|. . .\|. . .\|. . .\|. .7.6.0.8. .\|. .G.D.E. .V.e.r.s.i.o.n. .i.s. .2...0...0...1.....

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.92254026129775
TrID:	Win32 Executable (generic) a (10002005/4) 99.66% UPX compressed Win32 Executable (30571/9) 0.30% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Reader_Install_Setup.exe
File size:	1'445'432 bytes
MD5:	f543b65c504c5d548e6005f2cba5ddb6
SHA1:	b5484f2abd286c49360077ae18fa1f0fcdc77900
SHA256:	9fd5d542f797d9dc630738d7c1b803d34bc0bab593c8d992f9a159ac0a28b276
SHA512:	a84a7069a9b93b1248db9b3e12fe6be532fb613df6131d3cafb13fc438203b13fd4966e47fc53e6e14679328b6037a3ba4f37dd0d812c0f1309f37cf8479f567
SSDEEP:	24576:YVzEoS9oS3wlGdQBBBua6f9Bau+cvKPpafsTZFTWmKKeb0XUf6QGr+e:Yg9SYd0fEBa1PpXTZFeoE8v
TLSH:	79652312410A0F77D82FA8B05AB776745333BD014E9843DA276BFF197B3215AB5E212B
File Content Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........D...%...%...%..LW...%..LW...%..LW..D%..LW...%.. Y...%.. Y...%.. Y..>$...%...%....w..%..LW...%..HX...%...%...&..FX...%..FX...%.

File Icon


Icon Hash:	4d9292f2c88cf60d

Static PE Info

General

Entrypoint:	0x83de50
Entrypoint Section:	UPX1
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x65C0C696 [Mon Feb 5 11:29:26 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	377cbbb5b52e6b71f4c4ec2ff9f040fb

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	03/11/2023 00:00:00 04/11/2025 23:59:59
Subject Chain	CN=Adobe Inc., OU=Acrobat 11, O=Adobe Inc., L=San Jose, S=ca, C=US, SERIALNUMBER=2748129, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US
Version:	3
Thumbprint MD5:	DE33CDD57B201C17BA1D948F9027EA38
Thumbprint SHA-1:	8E5C0EF19E4319A5161B04C5179899335768CCC0
Thumbprint SHA-256:	66048B4FFA7CEC38A851BD978E87BC469612964C9319C94005AC0FA060A6CE65
Serial:	0E6E32FCB0E03A0C0B2BC04B56F2038B

Entrypoint Preview

Instruction
pushad
mov esi, 006E5000h
lea edi, dword ptr [esi-002E4000h]
push edi
or ebp, FFFFFFFFh
jmp 00007F65D4DE6852h
nop
nop
nop
nop
nop
nop
mov al, byte ptr [esi]
inc esi
mov byte ptr [edi], al
inc edi
add ebx, ebx
jne 00007F65D4DE6849h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F65D4DE682Fh
mov eax, 00000001h
add ebx, ebx
jne 00007F65D4DE6849h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
add ebx, ebx
jnc 00007F65D4DE684Dh
jne 00007F65D4DE686Ah
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F65D4DE6861h
dec eax
add ebx, ebx
jne 00007F65D4DE6849h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc eax, eax
jmp 00007F65D4DE6816h
add ebx, ebx
jne 00007F65D4DE6849h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
jmp 00007F65D4DE6894h
xor ecx, ecx
sub eax, 03h
jc 00007F65D4DE6853h
shl eax, 08h
mov al, byte ptr [esi]
inc esi
xor eax, FFFFFFFFh
je 00007F65D4DE68B7h
sar eax, 1
mov ebp, eax
jmp 00007F65D4DE684Dh
add ebx, ebx
jne 00007F65D4DE6849h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F65D4DE680Eh
inc ecx
add ebx, ebx
jne 00007F65D4DE6849h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jc 00007F65D4DE6800h
add ebx, ebx
jne 00007F65D4DE6849h
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jnc 00007F65D4DE6831h
jne 00007F65D4DE684Bh
mov ebx, dword ptr [esi]
sub esi, FFFFFFFCh
adc ebx, ebx
jnc 00007F65D4DE6826h
add ecx, 02h
cmp ebp, FFFFFB00h
adc ecx, 02h
lea edx, dword ptr [eax+eax]

Rich Headers

Programming Language:

[ C ] VS2012 UPD4 build 61030

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x299960	0x6c	UPX0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x443a04	0x214	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x43f000	0x4a04	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x15e400	0x2a38	UPX0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x443c18	0x24	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x43e03c	0x18	UPX1
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x43e05c	0xc0	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x297a40	0x200	UPX0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x2e4000	0x0	d41d8cd98f00b204e9800998ecf8427e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
UPX1	0x2e5000	0x15a000	0x159200	1034b32fe6e75a8e5cdb50c3792de610	False	0.9886137269105396	data	7.935275952671535	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x43f000	0x5000	0x4e00	a7dcfceb9180eac41b5b468e9c8f4989	False	0.22030248397435898	data	3.9114937420207667	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
CONFIG	0x2a99b4	0x39f	empty	English	United States	0
DICTIONARY	0x2a9d54	0x3f44	empty	English	United States	0
DICTIONARY	0x2adc98	0x45e4	empty	English	United States	0
DICTIONARY	0x2b227c	0x44d2	empty	English	United States	0
DICTIONARY	0x2b6750	0x4db6	empty	English	United States	0
DICTIONARY	0x2bb508	0x42e9	empty	English	United States	0
DICTIONARY	0x2bf7f4	0x410e	empty	English	United States	0
DICTIONARY	0x2c3904	0x4311	empty	English	United States	0
DICTIONARY	0x2c7c18	0x42d7	empty	English	United States	0
DICTIONARY	0x2cbef0	0x3a6d	empty	English	United States	0
DICTIONARY	0x2cf960	0x3a61	empty	English	United States	0
DICTIONARY	0x2d33c4	0x41a3	empty	English	United States	0
DICTIONARY	0x2d7568	0x412d	empty	English	United States	0
DICTIONARY	0x2db698	0x43cf	empty	English	United States	0
DICTIONARY	0x2dfa68	0x42be	empty	English	United States	0
DICTIONARY	0x2e3d28	0x545d	empty	English	United States	0
DICTIONARY	0x2e9188	0x4155	data	English	United States	0.9946188340807175
DICTIONARY	0x2ed2e0	0x412d	data	English	United States	0.9967036260113875
DICTIONARY	0x2f1410	0x406d	data	English	United States	0.993148608500576
DICTIONARY	0x2f5480	0x40a8	data	English	United States	0.9945021749637506
DICTIONARY	0x2f9528	0x3e5a	data	English	United States	0.9954892870567598
DICTIONARY	0x2fd384	0x4179	data	English	United States	0.993974106556888
DICTIONARY	0x301500	0x45dc	data	English	United States	0.9957503914113174
DICTIONARY	0x305adc	0x4494	data	English	United States	0.9962975620870358
DICTIONARY	0x309f70	0x4366	data	English	United States	0.9975657818476875
DICTIONARY	0x30e2d8	0x414f	data	English	United States	0.9966505173754411
DICTIONARY	0x312428	0x5515	data	English	United States	0.9975207749873743
GIF	0x317940	0x2b	data	English	United States	1.2093023255813953
PNG	0x31796c	0x6d3	data	English	United States	1.0062965082999427
PNG	0x318040	0xa5d	data	English	United States	1.0041462495288354
PNG	0x318aa0	0x50a	data	English	United States	1.0085271317829458
PNG	0x318fac	0x435f	data	English	United States	0.9968110396010901
PNG	0x31d30c	0x4054	data	English	United States	0.995931503521982
PNG	0x321360	0x694	data	English	United States	1.0065320665083135
PNG	0x3219f4	0x75f	data	English	United States	1.0058293587705351
PNG	0x322154	0x604	data	English	United States	1.0071428571428571
PNG	0x322758	0x7b6	data	English	United States	1.0055724417426546
PNG	0x322f10	0x1f8f	data	English	United States	0.999628666914222
PNG	0x324ea0	0x3d66	data	English	United States	0.9968189337065785
PNG	0x328c08	0x3dec	data	English	United States	0.9966565733030532
PNG	0x32c9f4	0x5a4	data	English	United States	1.007617728531856
PNG	0x32cf98	0x4f1	data	English	United States	1.008695652173913
PNG	0x32d48c	0x5b9	data	English	United States	1.0075085324232083
PNG	0x32da48	0xef1	data	English	United States	1.002875816993464
PNG	0x32e93c	0xfe8	data	English	United States	1.0027013752455796
PNG	0x32f924	0xd20	data	English	United States	1.0032738095238096
PNG	0x330644	0xda7	data	English	United States	1.0031473533619457
PNG	0x3313ec	0xec9	data	English	United States	1.0029062087186262
PNG	0x3322b8	0xf72	data	English	United States	1.0027819929185635
PNG	0x33322c	0x3bca	data	English	United States	0.9968639749117993
PNG	0x336df8	0xfa6	data	English	United States	1.0027458811782326
PNG	0x337da0	0x521	data	English	United States	1.0083777608530085
PNG	0x3382c4	0x3d45	data	English	United States	0.9969397513547976
PNG	0x33c00c	0x55b	data	English	United States	1.0080233406272794
PNG	0x33c568	0xcc6	data	English	United States	1.0033639143730886
PNG	0x33d230	0xd60	data	English	United States	1.00321261682243
PNG	0x33df90	0xe57	data	English	United States	1.002996458730591
PNG	0x33ede8	0xd1c	data	English	United States	1.0032777115613827
PNG	0x33fb04	0xd25	data	English	United States	1.0032689450222882
PNG	0x34082c	0xefe	PGP Secret Sub-key -	English	United States	1.0028660760812924
PNG	0x34172c	0xf66	data	English	United States	1.0027904616945713
PNG	0x342694	0xd24	data	English	United States	1.003269916765755
PNG	0x3433b8	0xdea	data	English	United States	1.0030881527231892
PNG	0x3441a4	0x4486	data	English	United States	0.997377722038536
PNG	0x34862c	0x4a51	data	English	United States	0.9965308804204993
PNG	0x34d080	0x3ba7	DOS executable (COM, 0x8C-variant)	English	United States	0.9973806561456355
SC	0x350c28	0x10b18	OpenPGP Secret Key	English	United States	0.9958757458757459
SC	0x361740	0x8a263	data	English	United States	0.9902360835473147
RT_CURSOR	0x3eb9a4	0x134	data	English	United States	1.0357142857142858
RT_CURSOR	0x3ebad8	0xb4	data	English	United States	1.0611111111111111
RT_CURSOR	0x3ebb8c	0x134	data	English	United States	1.0357142857142858
RT_CURSOR	0x3ebcc0	0x134	data	English	United States	1.0357142857142858
RT_CURSOR	0x3ebdf4	0x134	data	English	United States	1.0357142857142858
RT_CURSOR	0x3ebf28	0x134	data	English	United States	1.0357142857142858
RT_CURSOR	0x3ec05c	0x134	data	English	United States	1.0357142857142858
RT_CURSOR	0x3ec190	0x134	SysEx File - Mesosha	English	United States	1.0357142857142858
RT_CURSOR	0x3ec2c4	0x134	data	English	United States	1.0357142857142858
RT_CURSOR	0x3ec3f8	0x134	data	English	United States	1.0357142857142858
RT_CURSOR	0x3ec52c	0x134	data	English	United States	1.0357142857142858
RT_CURSOR	0x3ec660	0x134	data	English	United States	1.0357142857142858
RT_CURSOR	0x3ec794	0x134	data	English	United States	1.0357142857142858
RT_CURSOR	0x3ec8c8	0x134	data	English	United States	1.0357142857142858
RT_CURSOR	0x3ec9fc	0x134	data	English	United States	1.0357142857142858
RT_CURSOR	0x3ecb30	0x134	data	English	United States	1.0357142857142858
RT_BITMAP	0x3ecc64	0xb8	data	English	United States	1.059782608695652
RT_BITMAP	0x3ecd1c	0x144	OpenPGP Secret Key	English	United States	1.0339506172839505
RT_ICON	0x4409b8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 11811 x 11811 px/m	English	United States	0.10020746887966805
RT_ICON	0x3ef408	0x8a8	data	English	United States	1.0036101083032491
RT_ICON	0x3efcb0	0x568	data	English	United States	1.0079479768786128
RT_ICON	0x3f0218	0x3a1d	data	English	United States	0.9760704443100088
RT_ICON	0x3f3c38	0x25a8	data	English	United States	0.9910788381742739
RT_ICON	0x3f61e0	0x10a8	data	English	United States	0.9826454033771107
RT_ICON	0x3f7288	0x468	data	English	United States	1.0097517730496455
RT_DIALOG	0x3f76f0	0x6c	data	English	United States	1.0833333333333333
RT_DIALOG	0x3f775c	0xe8	data	English	United States	1.0387931034482758
RT_DIALOG	0x3f7844	0x34	data	English	United States	1.1730769230769231
RT_STRING	0x3f7878	0x82	data	English	United States	1.0846153846153845
RT_STRING	0x3f78fc	0x2a	data	English	United States	1.2619047619047619
RT_STRING	0x3f7928	0x184	data	English	United States	1.0283505154639174
RT_STRING	0x3f7aac	0x4ee	data	English	United States	1.008716323296355
RT_STRING	0x3f7f9c	0x264	data	English	United States	1.0179738562091503
RT_STRING	0x3f8200	0x2da	data	English	United States	1.015068493150685
RT_STRING	0x3f84dc	0x8a	data	English	United States	1.0797101449275361
RT_STRING	0x3f8568	0xac	data	English	United States	1.063953488372093
RT_STRING	0x3f8614	0xde	data	English	United States	1.0495495495495495
RT_STRING	0x3f86f4	0x4a8	data	English	United States	1.0092281879194631
RT_STRING	0x3f8b9c	0x228	data	English	United States	1.019927536231884
RT_STRING	0x3f8dc4	0x2c	data	English	United States	1.25
RT_STRING	0x3f8df0	0x53e	data	English	United States	1.0081967213114753
RT_GROUP_CURSOR	0x3f9330	0x22	data	English	United States	1.3235294117647058
RT_GROUP_CURSOR	0x3f9354	0x14	data	English	United States	1.35
RT_GROUP_CURSOR	0x3f9368	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x3f937c	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x3f9390	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x3f93a4	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x3f93b8	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x3f93cc	0x14	data	English	United States	1.4
RT_GROUP_CURSOR	0x3f93e0	0x14	Non-ISO extended-ASCII text, with NEL line terminators	English	United States	1.4
RT_GROUP_CURSOR	0x3f93f4	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x3f9408	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x3f941c	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x3f9430	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x3f9444	0x14	data	English	United States	1.45
RT_GROUP_CURSOR	0x3f9458	0x14	data	English	United States	1.45
RT_GROUP_ICON	0x442f64	0x16	data	English	United States	1.1363636363636365
RT_VERSION	0x442f80	0x358	data	English	United States	0.40654205607476634
RT_HTML	0x3f97dc	0x559	data	English	United States	1.0029218407596785
RT_MANIFEST	0x4432dc	0x727	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.4265428727471327

Imports

DLL	Import
ADVAPI32.dll	FreeSid
COMCTL32.dll	InitCommonControlsEx
GDI32.dll	LPtoDP
gdiplus.dll	GdipFree
KERNEL32.DLL	LoadLibraryA, ExitProcess, GetProcAddress, VirtualProtect
ole32.dll	OleRun
OLEAUT32.dll	SysFreeString
SHELL32.dll	DragFinish
SHLWAPI.dll	UrlIsW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	20:06:54
Start date:	12/02/2024
Path:	C:\Users\user\Desktop\Reader_Install_Setup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\Reader_Install_Setup.exe
Imagebase:	0x2d0000
File size:	1'445'432 bytes
MD5 hash:	F543B65C504C5D548E6005F2CBA5DDB6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	9.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	57

Executed Functions

Function 002E4170 Relevance: 177.4, APIs: 51, Strings: 49, Instructions: 2352COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,?,?,?,CancelPort,0000000A,?,?,?,?), ref: 002E4667
CreateEventW.KERNEL32(00000000,00000000,00000000,00000000), ref: 002E4677
CloseHandle.KERNEL32(?,HTTPSend_03,0000000B,Error_NativeToUTF8,00000012), ref: 002E4822
CloseHandle.KERNEL32(?), ref: 002E482B

Strings

GET, xrefs: 002E57EC
Failed in quering WinHttpHeaders error:%d, xrefs: 002E6231
Failed in making http request, in HttpSend, xrefs: 002E58A8
WinHttpQueryHeaders_01, xrefs: 002E616D
CertificateNotMatching_01, xrefs: 002E6588
WinHttpSetOption, xrefs: 002E4C74
Failed to connect to server, in HttpSend with secure flag, xrefs: 002E4C4D
HTTPConnector::HTTPSend :: After callback : error Type : %d, error code : %d, xrefs: 002E60B0
HTTPConnector::HTTPSend, xrefs: 002E41FE
FileUtils, xrefs: 002E5FB1
`avo, xrefs: 002E4D26, 002E4F7A, 002E520C, 002E5649, 002E599C, 002E5BE7, 002E6669
Failed in setting status callback in HttpSend, xrefs: 002E5552
HTTPSend, xrefs: 002E4C05, 002E6520
HTTPConnector::HTTPSend :: WaitForMultipleObjects returned after timeout, xrefs: 002E5E07
WinHttpSetCredentials_01, xrefs: 002E5B1E
HTTPConnector::HTTPSend :: WinHttpOpen failed : %d, xrefs: 002E4AF6
http://, xrefs: 002E43CA
setting secure protocols to TLS1.2 always, xrefs: 002E4C00
HttpConnector, xrefs: 002E4AFB, 002E4D56, 002E4FAA, 002E522E, 002E566D, 002E59C5, 002E5C15
HTTPSend_03, xrefs: 002E4769
HTTPConnector::HTTPSend :: WinHttpSetCredentials failed : %d, xrefs: 002E5C10
,4, xrefs: 002E57BE
Failed in multibyte to wide conversion, in HttpSend, xrefs: 002E471F
HTTPConnector::HTTPSend :: WinHttpConnect failed : %d, xrefs: 002E4D51, 002E4FA5
Certificate: %s, xrefs: 002E6502
HTTPConnector::HTTPSend :: WinHttpSetStatusCallback failed, xrefs: 002E5668
Failed to connect to server, in HttpSend, xrefs: 002E4EA9
https://, xrefs: 002E4367, 002E438E
WinHttpConnect_01, xrefs: 002E4ED0
Failed to open http request, in HttpSend, xrefs: 002E511B
Error_InvalidArguments, xrefs: 002E6777
AAM, xrefs: 002E4983, 002E49D3
HTTPSend_01, xrefs: 002E67A1
Failed to delete file: '%s' LastError:%d, xrefs: 002E5FA7
Failed to open a WinHttp session, in HttpSend, xrefs: 002E4A06
WinHttpSetStatusCallback_01, xrefs: 002E557F
WinHttpSendRequest_01, xrefs: 002E58D3
WinHttpOpen_01, xrefs: 002E4A2D
WinHttpOpenRequest_01, xrefs: 002E5142
HTTPConnectorError, xrefs: 002E4724, 002E4A0B, 002E4C52, 002E4EAE, 002E5120, 002E5557, 002E58AD, 002E5AF6, 002E6236
HTTPConnector::HTTPSend :: WaitForMultipleObjects returned with cancellation, xrefs: 002E5DCE
CancelPort, xrefs: 002E4607
Error_NativeToUTF8, xrefs: 002E4756
Failed in setting proxycredentials in HttpSend error:%d, xrefs: 002E5AF1
Certificate not matching., xrefs: 002E651B
&, xrefs: 002E66AC
HTTPConnector::HTTPSend :: WinHttpOpenRequest failed : %d, xrefs: 002E5229
HTTPConnector::HTTPSend :: WinHttpSendRequest failed : %d, xrefs: 002E59C0
WinHttpQueryOption_01, xrefs: 002E6322

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CloseCreateEventHandle
String ID: &$,4$AAM$CancelPort$Certificate not matching.$Certificate: %s$CertificateNotMatching_01$Error_InvalidArguments$Error_NativeToUTF8$Failed in making http request, in HttpSend$Failed in multibyte to wide conversion, in HttpSend$Failed in quering WinHttpHeaders error:%d$Failed in setting proxycredentials in HttpSend error:%d$Failed in setting status callback in HttpSend$Failed to connect to server, in HttpSend$Failed to connect to server, in HttpSend with secure flag$Failed to delete file: '%s' LastError:%d$Failed to open a WinHttp session, in HttpSend$Failed to open http request, in HttpSend$FileUtils$GET$HTTPConnector::HTTPSend$HTTPConnector::HTTPSend :: After callback : error Type : %d, error code : %d$HTTPConnector::HTTPSend :: WaitForMultipleObjects returned after timeout$HTTPConnector::HTTPSend :: WaitForMultipleObjects returned with cancellation$HTTPConnector::HTTPSend :: WinHttpConnect failed : %d$HTTPConnector::HTTPSend :: WinHttpOpen failed : %d$HTTPConnector::HTTPSend :: WinHttpOpenRequest failed : %d$HTTPConnector::HTTPSend :: WinHttpSendRequest failed : %d$HTTPConnector::HTTPSend :: WinHttpSetCredentials failed : %d$HTTPConnector::HTTPSend :: WinHttpSetStatusCallback failed$HTTPConnectorError$HTTPSend$HTTPSend_01$HTTPSend_03$HttpConnector$WinHttpConnect_01$WinHttpOpenRequest_01$WinHttpOpen_01$WinHttpQueryHeaders_01$WinHttpQueryOption_01$WinHttpSendRequest_01$WinHttpSetCredentials_01$WinHttpSetOption$WinHttpSetStatusCallback_01$`avo$http://$https://$setting secure protocols to TLS1.2 always
API String ID: 3369476804-4162533411
Opcode ID: e2706c21e6023e9186760a6918ae52049ce90b536f4ca07e92e486cf4d7163a0
Instruction ID: c9e37f35da52b9b5589d02a3b9a33b1a7c1d9d9da12b083226dc6ed9606a2ebd
Opcode Fuzzy Hash: e2706c21e6023e9186760a6918ae52049ce90b536f4ca07e92e486cf4d7163a0
Instruction Fuzzy Hash: 4C338970960269DBDB22DF24CC59BEDBBB4AF25304F5081D9E408A7292DB706F98CF51

Uniqueness

Uniqueness Score: -1.00%

Function 002DEE50 Relevance: 81.4, APIs: 22, Strings: 24, Instructions: 914
libraryloadersynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(0000011C,7D8B83E9), ref: 002DEF4D
GetModuleFileNameW.KERNEL32(00000000,?,00000104,imgutil.dll,0000000B,WinHTTP.dll,0000000B,dnsapi.dll,0000000A,WS2Help.dll,0000000B,WS2_32.dll,0000000A,schannel.dll,0000000C,rsaenh.dll), ref: 002DF3C3
PathRemoveFileSpecW.SHLWAPI(?), ref: 002DF3D4
PathFileExistsW.SHLWAPI(?,?), ref: 002DF470
GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,?,?,00531818,00000001), ref: 002DF4CD
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 002DF4DD
GetSystemWindowsDirectoryW.KERNEL32(?,00000104), ref: 002DF510
SetDllDirectoryW.KERNEL32(0052EE6C), ref: 002DF51B
LoadLibraryW.KERNEL32(?,?,?,?,00000000,00531560,0053155E,C:\Windows\System32\,00000014), ref: 002DF627
PathIsDirectoryW.SHLWAPI(?), ref: 002DF67A
LoadLibraryW.KERNEL32(00531560), ref: 002DF7E6
6F5433E0.COMCTL32(?), ref: 002DF80B
CommandLineToArgvW.SHELL32(?,?,?,?,test.exe ,00000009,Adobe Download Manager), ref: 002DF902
__Init_thread_footer.LIBCMT ref: 002DF970
__Init_thread_footer.LIBCMT ref: 002DF9F4

Part of subcall function 0049F16D: RtlEnterCriticalSection.NTDLL(005767E0), ref: 0049F177
Part of subcall function 0049F16D: RtlLeaveCriticalSection.NTDLL(005767E0), ref: 0049F1AA
Part of subcall function 0049F16D: RtlWakeAllConditionVariable.NTDLL ref: 0049F221

LoadIconW.USER32(?,0000006E), ref: 002DFD63

Part of subcall function 002D8570: __Init_thread_footer.LIBCMT ref: 002D85F8

Part of subcall function 00338D00: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001C,00000000,?), ref: 00338D23

Part of subcall function 00339330: PathAppendW.SHLWAPI(00000000,?,?,?,?,?,?), ref: 00339393

SHCreateDirectoryExW.SHELL32(00000000,?,00000000,?), ref: 002DFADA
GetLastError.KERNEL32 ref: 002DFAFB
WaitForSingleObject.KERNEL32(?,000000FF), ref: 002DFCC0
TerminateThread.KERNEL32(?,000000FF), ref: 002DFCD5
CloseHandle.KERNEL32(?), ref: 002DFCE1

Strings

SetDefaultDllDirectories, xrefs: 002DF4D7
Command Line : %s, xrefs: 002DFC29
WS2_32.dll, xrefs: 002DF2B6
Malicious '%s' found in the same folder, xrefs: 002DF6B3
imgutil.dll, xrefs: 002DF386
dssenh.dll, xrefs: 002DF21A
WinHTTP.dll, xrefs: 002DF352
present in current folder is blocking the installer. Remove the dll or change the location of the installer., xrefs: 002DF6BC
kernel32.dll, xrefs: 002DF4C8
Unable to initialize Elevation Manager. Quitting..., xrefs: 002DFC80
WS2Help.dll, xrefs: 002DF305
Adobe Download Manager, xrefs: 002DF76E, 002DF878
ntmarta.dll, xrefs: 002DF1C0
SamLib.dll, xrefs: 002DF1E6
6.1, xrefs: 002DF53E
Running in IE protected workflow, xrefs: 002DFC50
schannel.dll, xrefs: 002DF282
test.exe , xrefs: 002DF891
Quitting, xrefs: 002DFC85
dnsapi.dll, xrefs: 002DF31E
b-., xrefs: 002DFD42, 002DFDB3
rsaenh.dll, xrefs: 002DF24E
C:\Windows\System32\, xrefs: 002DF574
5.1, xrefs: 002DF11A

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Path$Directory$FileInit_thread_footerLoad$CriticalHandleLibraryModuleSection$AddressAppendArgvCloseCommandConditionCreateEnterErrorExistsF5433FolderIconLastLeaveLineNameObjectProcRemoveSingleSpecSpecialSystemTerminateThreadVariableVersionWaitWakeWindows
String ID: present in current folder is blocking the installer. Remove the dll or change the location of the installer.$5.1$6.1$Adobe Download Manager$C:\Windows\System32\$Command Line : %s$Malicious '%s' found in the same folder$Quitting$Running in IE protected workflow$SamLib.dll$SetDefaultDllDirectories$Unable to initialize Elevation Manager. Quitting...$WS2Help.dll$WS2_32.dll$WinHTTP.dll$b-.$dnsapi.dll$dssenh.dll$imgutil.dll$kernel32.dll$ntmarta.dll$rsaenh.dll$schannel.dll$test.exe
API String ID: 3338445307-1612191400
Opcode ID: b8b52baecb62ccca7efc5ae6bd60c484f13f00d32aba5987162b0bf4e51351ce
Instruction ID: f78af223d6eb7e9bdc47f22874111de53f9fe389c4f95eceda8f081f5a4a7ed7
Opcode Fuzzy Hash: b8b52baecb62ccca7efc5ae6bd60c484f13f00d32aba5987162b0bf4e51351ce
Instruction Fuzzy Hash: DB92DB70D10269DADB21DF24CD59BEDBBB4AF55304F1082EAE409A7292DBB05F88CF54

Uniqueness

Uniqueness Score: -1.00%

Function 002FD240 Relevance: 64.5, Strings: 51, Instructions: 725
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

dlmping.adobe.com, xrefs: 002FD718
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\, xrefs: 002FDC1E
platformdl-stage.corp.adobe.com, xrefs: 002FD5F1
admdownload.stage.adobe.com, xrefs: 002FD368
get3.adobe.com, xrefs: 002FD804
/, xrefs: 002FDDB2
White listed User Registries are, xrefs: 002FDE4D
SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 002FDBE3
rdc-stage.adobe.io, xrefs: 002FDA29
SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\, xrefs: 002FDD54
adobetag.com, xrefs: 002FD87A
White listed Machine Registries are, xrefs: 002FDE0E
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\, xrefs: 002FDBA2
platformdl.adobe.com, xrefs: 002FD5B6
rdc-dev.adobe.io, xrefs: 002FD9EB
dlmping4.adobe.com, xrefs: 002FD7C9
ardownload2-stg.corp.adobe.com, xrefs: 002FD27F
ccmdls.adobe.com, xrefs: 002FD96F
wwwimages.adobe.com, xrefs: 002FD66A
get3.stage.adobe.com, xrefs: 002FD83F
fpdownload2.adobe.com, xrefs: 002FD57B
geo-dc.adobe.com, xrefs: 002FDAE3
SOFTWARE\Microsoft\Windows NT\CurrentVersion\, xrefs: 002FDB64
wwwimages2.adobe.com, xrefs: 002FD62C
airdownload.adobe.com, xrefs: 002FD3DE
promotion.adobe.com, xrefs: 002FD8B5
stats.adobe.com, xrefs: 002FD8F3
fpdownload2.macromedia.com, xrefs: 002FD516
fpdownload.adobe.com, xrefs: 002FD540
dlmping2.adobe.com, xrefs: 002FD753
wwwimages.stage.adobe.com, xrefs: 002FD6A2
admdownload.adobe.com, xrefs: 002FD3A3
geo2.adobe.com, xrefs: 002FDAA5
wwwimages2.stage.adobe.com, xrefs: 002FD6DD
ardownload2.adobe.com, xrefs: 002FD454
SOFTWARE\Adobe\Setup\Reader\, xrefs: 002FDC9A
SOFTWARE\McAfee Safe Connect, xrefs: 002FDCD8
sstats.adobe.com, xrefs: 002FD931
download.macromedia.com, xrefs: 002FD48F
dlmping3.adobe.com, xrefs: 002FD78E
get.adobe.com, xrefs: 002FD2B7
ardownload.adobe.com, xrefs: 002FD419
stage-ffc-files.corp.adobe.com, xrefs: 002FD9AD
aihdownload.adobe.com, xrefs: 002FD32D
rdc.adobe.io, xrefs: 002FDA67
SYSTEM\CurrentControlSet\Control\Session Manager\Environment\, xrefs: 002FDB21
get2.adobe.com, xrefs: 002FD2F2
SOFTWARE\Macromedia\, xrefs: 002FDC5C, 002FDD97
White listed URLs are, xrefs: 002FDDD1
SOFTWARE\Wow6432Node\Adobe\Setup\Reader\, xrefs: 002FDD16
fpdownload.macromedia.com, xrefs: 002FD4CA

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID: /$SOFTWARE\Adobe\Setup\Reader\$SOFTWARE\Macromedia\$SOFTWARE\McAfee Safe Connect$SOFTWARE\Microsoft\Windows NT\CurrentVersion\$SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\$SOFTWARE\Microsoft\Windows\Shell\Associations\UrlAssociations\$SOFTWARE\Wow6432Node\Adobe\Setup\Reader\$SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\$SYSTEM\CurrentControlSet\Control\Session Manager\Environment\$White listed Machine Registries are$White listed URLs are$White listed User Registries are$admdownload.adobe.com$admdownload.stage.adobe.com$adobetag.com$aihdownload.adobe.com$airdownload.adobe.com$ardownload.adobe.com$ardownload2-stg.corp.adobe.com$ardownload2.adobe.com$ccmdls.adobe.com$dlmping.adobe.com$dlmping2.adobe.com$dlmping3.adobe.com$dlmping4.adobe.com$download.macromedia.com$fpdownload.adobe.com$fpdownload.macromedia.com$fpdownload2.adobe.com$fpdownload2.macromedia.com$geo-dc.adobe.com$geo2.adobe.com$get.adobe.com$get2.adobe.com$get3.adobe.com$get3.stage.adobe.com$platformdl-stage.corp.adobe.com$platformdl.adobe.com$promotion.adobe.com$rdc-dev.adobe.io$rdc-stage.adobe.io$rdc.adobe.io$sstats.adobe.com$stage-ffc-files.corp.adobe.com$stats.adobe.com$wwwimages.adobe.com$wwwimages.stage.adobe.com$wwwimages2.adobe.com$wwwimages2.stage.adobe.com
API String ID: 0-3109437854
Opcode ID: 81e1637e87239d761d8fb092f78a839e258fa419b6027a107f3fdc805c6da2c9
Instruction ID: 8bd697e7f2537304f0cc5297c9dcb9fe14cf8b36fadb2c82bbcd07820d7eda1c
Opcode Fuzzy Hash: 81e1637e87239d761d8fb092f78a839e258fa419b6027a107f3fdc805c6da2c9
Instruction Fuzzy Hash: FC722DB0951709ABDB04DF60C9167AABB71BF15718F30838DE0142F2E2D7B19A96DBC1

Uniqueness

Uniqueness Score: -1.00%

Function 002F9910 Relevance: 53.7, APIs: 5, Strings: 25, Instructions: 1152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0033C940: RtlInitializeCriticalSection.NTDLL(00577884), ref: 0033C9BC

GetModuleFileNameW.KERNEL32(00000000,?,00000104,0052EE6C,00000000,0052EC9C,00000002,?,?,00000000,00000000,0000000D), ref: 002FA34C
PathFindFileNameW.SHLWAPI(?,?,?,00000000,00000000,0000000D), ref: 002FA397
GetModuleFileNameW.KERNEL32(00000000,?,00000104,00532100,00000000,?,00000000,-00000002,?,?,00000000,00000000,0000000D), ref: 002FA533
GetModuleHandleW.KERNEL32(tmmon.dll,?,?,?,?,00000000,00000038,?,?,?,?,?,?,?,?,005337DC), ref: 002FAAC2
GetModuleHandleW.KERNEL32(tmmon64.dll,?,?,?,?,00000000,00000038,?,?,?,?,?,?,?,?,005337DC), ref: 002FAACD

Strings

_cra, xrefs: 002FABF0, 002FAC44
ADM, xrefs: 002FA0E6
trackingid, xrefs: 002FA728, 002FA775
04S, xrefs: 002FA5CC, 002FA5E3, 002FA5FD, 002FA603, 002FA620, 002FA634, 002FA680, 002FA69D
true, xrefs: 002FA0AB, 002FA0B7, 002FAEDA
6, xrefs: 002FAF3D
en_US, xrefs: 002F9FEB, 002FA001
false, xrefs: 002FAED5
readerdc64, xrefs: 002FAA71
skuid, xrefs: 002FA862, 002FA8B1
readerdc, xrefs: 002FAB9A
true, xrefs: 002FAD0D
tmmon64.dll, xrefs: 002FAAC8
_acr, xrefs: 002FAA9C, 002FABC5
5.1, xrefs: 002F9DF8, 002F9E15
en_US, xrefs: 002F9D80, 002F9D96
tmmon.dll, xrefs: 002FAABD
live, xrefs: 002F9D40, 002F9D56
dwW, xrefs: 002FA2AD
ApplicationContext, xrefs: 002FA0F2
ADM, xrefs: 002FA0DF
install, xrefs: 002F9D60, 002F9D76
packageListCS, xrefs: 002F9B0F
mcvisid, xrefs: 002FA957, 002FA9A6
_crd, xrefs: 002FADB0, 002FAE04

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Module$FileName$Handle$CriticalFindInitializePathSection
String ID: 04S$5.1$6$ADM$ADM$ApplicationContext$_acr$_cra$_crd$dwW$en_US$en_US$false$install$live$mcvisid$packageListCS$readerdc$readerdc64$skuid$tmmon.dll$tmmon64.dll$trackingid$true$true
API String ID: 1150115235-137263905
Opcode ID: 6d55a28405030ac788e9ef55d48f44f0fa0b5aa15aa79e16862cd48ce05c7fd5
Instruction ID: 15456a8047926cf56b81adbf94a54b7d83f597c4bb381f44d2e1248023f5a4fb
Opcode Fuzzy Hash: 6d55a28405030ac788e9ef55d48f44f0fa0b5aa15aa79e16862cd48ce05c7fd5
Instruction Fuzzy Hash: 35C28E70C1939CCAEB11CF24ED047A9BBB1BB69304F1082D9D54C67291EBB51AD8EF91

Uniqueness

Uniqueness Score: -1.00%

Function 002FC7B0 Relevance: 39.1, APIs: 4, Strings: 18, Instructions: 601
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0033A120: _com_issue_errorex.COMSUPP ref: 0033A196

Part of subcall function 0033BB10: _com_issue_errorex.COMSUPP ref: 0033BC1F

PathAppendW.SHLWAPI(00000000,?), ref: 002FD03E
PathFileExistsW.SHLWAPI(?), ref: 002FD082
PathIsDirectoryW.SHLWAPI(?), ref: 002FD097
SHCreateDirectoryExW.SHELL32(00000000,?,00000000), ref: 002FD0AB

Strings

/config/builtInName, xrefs: 002FC92C
/config/admUrl, xrefs: 002FC85D
/config/validCAs/validCA, xrefs: 002FCC5E
/config/isProd, xrefs: 002FCC19
SHCreateDirectoryEx failed. Error: %d, xrefs: 002FD0B6
Adobe Download Manager, xrefs: 002FC911
/config/defaultRedirectURL, xrefs: 002FCBAF
false, xrefs: 002FCCD3
Actual OS locale:'%s', OS locale for this instance:'%s', ADM locale : %s, xrefs: 002FCF8B
FileUtils, xrefs: 002FD0C0
/config/site, xrefs: 002FCAFD
/config/minOSVersion, xrefs: 002FCAA4
flash, xrefs: 002FCF37
locale, xrefs: 002FCD4F
2.0.0.759s, xrefs: 002FD0D8
/config/applicationName, xrefs: 002FC8B6
true, xrefs: 002FC7F3
/config/type, xrefs: 002FCB56

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Path$Directory_com_issue_errorex$AppendCreateExistsFile
String ID: /config/admUrl$/config/applicationName$/config/builtInName$/config/defaultRedirectURL$/config/isProd$/config/minOSVersion$/config/site$/config/type$/config/validCAs/validCA$2.0.0.759s$Actual OS locale:'%s', OS locale for this instance:'%s', ADM locale : %s$Adobe Download Manager$FileUtils$SHCreateDirectoryEx failed. Error: %d$false$flash$locale$true
API String ID: 3357515059-1450616051
Opcode ID: 4c71967a0f6f1f84478429ddb471b8b79a22cf0b6164e1aa5718154e6d7b9cb7
Instruction ID: 81452c976c56ef9a63e535e047158461b4c47d3c19a40e55f1a6466eb8fca041
Opcode Fuzzy Hash: 4c71967a0f6f1f84478429ddb471b8b79a22cf0b6164e1aa5718154e6d7b9cb7
Instruction Fuzzy Hash: 11529830D1025DDBDB21DF60CD55BEEBBB5BF55304F2042AAE50967281EBB02A98CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00306F90 Relevance: 36.5, Strings: 28, Instructions: 1465COMMON

Download Yara Rule

Strings

Patch, xrefs: 0030773E
validation_error_reason, xrefs: 00307D47
act_o, xrefs: 00307AEE, 00307CC9, 00307EB7
ReaderSAPPCheckBox, xrefs: 00307381, 00307429, 0030745D
false, xrefs: 00308011
DlmPing. ping url empty for package : %s, xrefs: 003082F1
readerDCCheckBox, xrefs: 00307232, 003072DA, 0030730E
pane, xrefs: 003079C5
true, xrefs: 00307F68
reader11CheckBox, xrefs: 003070E5, 0030718D, 003071C1
exitcode, xrefs: 00307BEA
_goca, xrefs: 00308148
cancelled, xrefs: 00307A49
msc, xrefs: 003078C7
validation_binary_fail_reason, xrefs: 00307E2C
DWLD_EXCE_TIME_DIFF, xrefs: 0030862A
install, xrefs: 00307D8F
$, xrefs: 0030873B
abbr, xrefs: 003077DE, 00307872, 00307B51, 00308508, 00308532
initPing, xrefs: 003085B5
_mpn, xrefs: 003077B7
workflow, xrefs: 0030816B, 00308206
Uninstall, xrefs: 0030776B
download, xrefs: 00307DE1
Reader, xrefs: 00307F34
mss, xrefs: 00307830, 00307BA7
AcrobatDCCheckBox, xrefs: 003074D0, 00307582, 003075AC
_gocd, xrefs: 003081F2

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Init_thread_footer
String ID: $$AcrobatDCCheckBox$DWLD_EXCE_TIME_DIFF$DlmPing. ping url empty for package : %s$Patch$Reader$ReaderSAPPCheckBox$Uninstall$_goca$_gocd$_mpn$abbr$act_o$cancelled$download$exitcode$false$initPing$install$msc$mss$pane$reader11CheckBox$readerDCCheckBox$true$validation_binary_fail_reason$validation_error_reason$workflow
API String ID: 1385522511-2984113483
Opcode ID: d5525dabe529f2bea538e496a72ad5b6847611d6e4982cdc6ae264d7e87d62a9
Instruction ID: a3b3280c1fc8d14455db39854c32dcaa54b12bab5793119c7f5531b1a50f96d5
Opcode Fuzzy Hash: d5525dabe529f2bea538e496a72ad5b6847611d6e4982cdc6ae264d7e87d62a9
Instruction Fuzzy Hash: 26E2BA70D15259CBEB21DB60CC69BEEBBB1BF15304F1581DAE04967281EB706E88CF91

Uniqueness

Uniqueness Score: -1.00%

Function 003213D0 Relevance: 34.2, APIs: 5, Strings: 14, Instructions: 940
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002D8570: __Init_thread_footer.LIBCMT ref: 002D85F8

FindResourceW.KERNEL32(?,?,DICTIONARY,0052EE6C,00000000,-000002E4,7D8B83E9,?,?), ref: 0032147A
LoadResource.KERNEL32(?,00000000), ref: 00321484
SizeofResource.KERNEL32(?,00000000), ref: 00321490
LockResource.KERNEL32(00000000), ref: 00321499

Part of subcall function 003320D0: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00577C78,000000FF,00000000,00000000,00000405,?,?,00000000,00000038,?), ref: 003320EB

Part of subcall function 002D8620: __Init_thread_footer.LIBCMT ref: 002D8742

PostMessageW.USER32(?,00000BCB,00000001,00000000), ref: 00321C0D

Part of subcall function 002F6C30: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000101,00000004,00000004,?,00000016,?,00000004,FFFFFFFF), ref: 002F6C76
Part of subcall function 002F6C30: RegQueryValueExW.ADVAPI32(00000000,?,00000000,00000000,00000000,?), ref: 002F6C9B
Part of subcall function 002F6C30: RegCloseKey.ADVAPI32(?), ref: 002F6CA8

Strings

AnotherInstanceRunning, xrefs: 00321DB6
Another application instance is running. Please close it to continue with this installation., xrefs: 00321DB1
initErrorMultipleInstanceRunning, xrefs: 00321E34
type, xrefs: 00321E68
Software\Adobe\AdobeIO, xrefs: 00321CB2
testWorkflow, xrefs: 00321C4F
Application Initialization Error: Unable to initialize GDE, xrefs: 00322074
https://rdc.adobe.io/analytics/events, xrefs: 00321D3E
Showing application window. Header string : %s, xrefs: 00321BC1
//header, xrefs: 00321A53
Application Initialization Error: Multiple Instances Running, xrefs: 00321F56
analytics, xrefs: 00321CE6
DICTIONARY, xrefs: 00321462
{0}, xrefs: 00321AB8

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Resource$Init_thread_footer$ByteCharCloseFindLoadLockMessageMultiOpenPostQuerySizeofValueWide
String ID: //header$Another application instance is running. Please close it to continue with this installation.$AnotherInstanceRunning$Application Initialization Error: Multiple Instances Running$Application Initialization Error: Unable to initialize GDE$DICTIONARY$Showing application window. Header string : %s$Software\Adobe\AdobeIO$analytics$https://rdc.adobe.io/analytics/events$initErrorMultipleInstanceRunning$testWorkflow$type${0}
API String ID: 3510299072-3814240049
Opcode ID: ceb18fbc84f43b3c971e91ab153ac7275aeead3547ee70ca2ecfd9af7606cd14
Instruction ID: 7736f4947d8b66c49675df731dbf640fb62ecead5622468e113dbcbb5ae4e9ce
Opcode Fuzzy Hash: ceb18fbc84f43b3c971e91ab153ac7275aeead3547ee70ca2ecfd9af7606cd14
Instruction Fuzzy Hash: DD92CF30D10258DFDB21DFA4CD55BEEBBB1BF65304F248299E50567282EB706A88CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00322950 Relevance: 31.0, Strings: 24, Instructions: 1010
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

&defaultInstallerName=, xrefs: 00322F47
Failed to convert string to nativestring proxyUserPassword, xrefs: 00323402
GET, xrefs: 00323104
_cta, xrefs: 00322B66, 00322BCA
acrobatdc, xrefs: 00322B17
Software\Adobe\AdobeIO, xrefs: 003229B9
Failed to convert string to nativestring for proxyuserName, xrefs: 003233BD
noNetworkErrorApplicationXMLDownloadContinue, xrefs: 00323696
HTTPConnectorError, xrefs: 003234A5
Error occurred while getting application xml: %d extended error: %d, xrefs: 003234A0
X-API-Key, xrefs: 003231A6
Connecting, xrefs: 003237C3
Application Initialization Error: SendHTTPRequestAsync, xrefs: 00323455
Empty userName while setting proxy credentials for HTTP request, xrefs: 00323381
dc-rdc-adm-client, xrefs: 003231E6
_mdr, xrefs: 00322D44, 00322DA5
environment, xrefs: 003229F0
key, xrefs: 003237EB
Complete ADM URL after encoding: %s, xrefs: 003230DF
windows, xrefs: 00322FF1
&os=, xrefs: 00322FE2
Getting application xml from server., xrefs: 00322991
?installerName=, xrefs: 00322AE6
_en, xrefs: 00322F77

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Init_thread_footer$ByteCharCloseMultiOpenQueryValueWide
String ID: &defaultInstallerName=$&os=$?installerName=$Application Initialization Error: SendHTTPRequestAsync$Complete ADM URL after encoding: %s$Connecting$Empty userName while setting proxy credentials for HTTP request$Error occurred while getting application xml: %d extended error: %d$Failed to convert string to nativestring for proxyuserName$Failed to convert string to nativestring proxyUserPassword$GET$Getting application xml from server.$HTTPConnectorError$Software\Adobe\AdobeIO$X-API-Key$_cta$_en$_mdr$acrobatdc$dc-rdc-adm-client$environment$key$noNetworkErrorApplicationXMLDownloadContinue$windows
API String ID: 3601162075-2774408378
Opcode ID: 8304357557f8e0f8c70fd0bb0eed44373adfaf9378bee6761113caee315f9c4d
Instruction ID: f95d343b2b9ec0c3fcb61998871c2061b4cca01dd32664c748ac7d9304bb5c58
Opcode Fuzzy Hash: 8304357557f8e0f8c70fd0bb0eed44373adfaf9378bee6761113caee315f9c4d
Instruction Fuzzy Hash: 23A27670D10268EBDF21DFA4CC55BEEBBB1AF15304F248199E44977281EB746A88CF91

Uniqueness

Uniqueness Score: -1.00%

Function 003207D0 Relevance: 30.4, APIs: 6, Strings: 11, Instructions: 608
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002D8570: __Init_thread_footer.LIBCMT ref: 002D85F8

GetDesktopWindow.USER32 ref: 00320CAE
GetDC.USER32(00000000), ref: 00320CBB
GetDeviceCaps.GDI32(00000000,00000058), ref: 00320CD4
GetDeviceCaps.GDI32(?,0000005A), ref: 00320CE0
ReleaseDC.USER32(?,?), ref: 00320CEE
wsprintfW.USER32 ref: 00320D8E

Strings

res:/SC/#168, xrefs: 00320EB7
scJsPath, xrefs: 00320ECD
platform, xrefs: 00320990
PROD, xrefs: 00320A86
localizationStringMap, xrefs: 00320F84
appEnvironment, xrefs: 00320ABA, 00320BCF
initialize, xrefs: 0032106A
applicationName, xrefs: 00320889
Initializing application UI., xrefs: 00320805
win, xrefs: 00320966
dpiRatio, xrefs: 00320DCB

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CapsDevice$DesktopInit_thread_footerReleaseWindowwsprintf
String ID: Initializing application UI.$PROD$appEnvironment$applicationName$dpiRatio$initialize$localizationStringMap$platform$res:/SC/#168$scJsPath$win
API String ID: 1227492679-3023342780
Opcode ID: 152260fd1b902ac4179958946e915d37e77547b6daf31935993b8e866e703e80
Instruction ID: 68c29a15022b4dfe6c549763c238d92bf6cefeeb3ee9685685c7ab65a9f8217a
Opcode Fuzzy Hash: 152260fd1b902ac4179958946e915d37e77547b6daf31935993b8e866e703e80
Instruction Fuzzy Hash: FF527B71D10268DBEF25DBA0CC54BEEBBB1BF14304F544299E049A7292EB706E88CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0031F970 Relevance: 21.6, Strings: 17, Instructions: 315
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LocalizedStringXML, xrefs: 0031FA06
Initializing application., xrefs: 0031F997
handleStopScreenNoClick, xrefs: 0031FE27
launchReaderChkBoxClicked, xrefs: 0031FB62
documentReady, xrefs: 0031F9BD
finishClicked, xrefs: 0031FE5F
killConflictingProcess, xrefs: 0031FDB7
continueButtonClicked, xrefs: 0031FAB4
handleStopScreenYesClick, xrefs: 0031FDEF
progressSkipButtonClicked, xrefs: 0031FC67
proxyErrorRetryClicked, xrefs: 0031FA5D
launchReaderSAPPChkBoxClicked, xrefs: 0031FC10
conflictingProcessRetryClicked, xrefs: 0031FD6C
OKButtonClicked, xrefs: 0031FB0B
progressRetryButtonClicked, xrefs: 0031FCBE
launchAcrobatChkBoxClicked, xrefs: 0031FBB9
progressChooseFolderButtonClicked, xrefs: 0031FD15

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Init_thread_footer
String ID: Initializing application.$LocalizedStringXML$OKButtonClicked$conflictingProcessRetryClicked$continueButtonClicked$documentReady$finishClicked$handleStopScreenNoClick$handleStopScreenYesClick$killConflictingProcess$launchAcrobatChkBoxClicked$launchReaderChkBoxClicked$launchReaderSAPPChkBoxClicked$progressChooseFolderButtonClicked$progressRetryButtonClicked$progressSkipButtonClicked$proxyErrorRetryClicked
API String ID: 1385522511-2344549946
Opcode ID: c2ec72732a71c4cbbb9bca159a24bb9ee9850a0b238e2945967b6bafbdef89a8
Instruction ID: 36f5e6d519eb8065384819de1678876ec75a22cdeb813287653df71e9ab535aa
Opcode Fuzzy Hash: c2ec72732a71c4cbbb9bca159a24bb9ee9850a0b238e2945967b6bafbdef89a8
Instruction Fuzzy Hash: FDE11C70C5020CDEDB19EFA0D966BEDB7B0AF19314F618259E021372E1DB742A98CF95

Uniqueness

Uniqueness Score: -1.00%

Function 00312410 Relevance: 20.5, Strings: 16, Instructions: 455COMMON

Download Yara Rule

Strings

initErrorScreen, xrefs: 003127D2
conflictingProcessScreen, xrefs: 00312854
finishScreen, xrefs: 00312871
Showing screen: %s, xrefs: 0031296E
screen, xrefs: 003128B6
Adobe Acrobat Reader, xrefs: 00312632
preferenceScreen, xrefs: 00312821
lR, xrefs: 00312740
Adobe Acrobat, xrefs: 0031250F
preCheckScreen, xrefs: 00312810
Adobe Acrobat Reader APP, xrefs: 00312522, 00312645
cancelConfirmationScreen, xrefs: 00312865
initScreen, xrefs: 003127BE, 0031287D
proxyScreen, xrefs: 00312843
showScreen, xrefs: 003129A0
progressScreen, xrefs: 00312832

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Init_thread_footer
String ID: Adobe Acrobat$Adobe Acrobat Reader$Adobe Acrobat Reader APP$Showing screen: %s$cancelConfirmationScreen$conflictingProcessScreen$finishScreen$initErrorScreen$initScreen$lR$preCheckScreen$preferenceScreen$progressScreen$proxyScreen$screen$showScreen
API String ID: 1385522511-126329790
Opcode ID: 1714af5e8484fdeb8ec50c66abb14f226cccd0913f94615004d59b65c476a65a
Instruction ID: cc95b59d5e958cde4748119c9786eaaefa3a98be6d32c8146fceff459dde3b98
Opcode Fuzzy Hash: 1714af5e8484fdeb8ec50c66abb14f226cccd0913f94615004d59b65c476a65a
Instruction Fuzzy Hash: B712CD31D00218DBDB25DFA4C855BEEBBB1BF18304F6581A9E40477292EB706E99CF90

Uniqueness

Uniqueness Score: -1.00%

Function 003393E0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 160filestringCOMMON

Download Yara Rule

APIs

PathIsDirectoryW.SHLWAPI(?), ref: 0033941D
RemoveDirectoryW.KERNEL32(?), ref: 003395CC

Part of subcall function 00339330: PathAppendW.SHLWAPI(00000000,?,?,?,?,?,?), ref: 00339393

FindFirstFileW.KERNEL32(?,?), ref: 003394AB
lstrcmpW.KERNEL32(?,00531818), ref: 003394DC
lstrcmpW.KERNEL32(?,0053DD64), ref: 003394F2
FindNextFileW.KERNEL32(?,?), ref: 003395A1
FindClose.KERNEL32(?), ref: 003395B5

Strings

FileUtils, xrefs: 0033943A
Directory to delete not present at location '%s', xrefs: 00339430

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Find$DirectoryFilePathlstrcmp$AppendCloseFirstNextRemove
String ID: Directory to delete not present at location '%s'$FileUtils
API String ID: 1870840554-2368301486
Opcode ID: 82adffe2bb4928a1de49d35864e211ca4c39aa666c91b69fb4b538a3f4c4a663
Instruction ID: a68e7f488981c6465d5cc9eefec07756fd087e4cf5dd4a1df106b826e2267fce
Opcode Fuzzy Hash: 82adffe2bb4928a1de49d35864e211ca4c39aa666c91b69fb4b538a3f4c4a663
Instruction Fuzzy Hash: 0B51A371910218DBDF12DFA4DC99BDDBBB8FF09314F44056AE805A3291EB70AE59CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0036D567 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 42libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00357F16,#r5,00000003,?,00000004,#r5), ref: 0036D579
GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 0036D589
RtlEncodePointer.NTDLL(00000000), ref: 0036D592
RtlDecodePointer.NTDLL(8AB6A2CF), ref: 0036D5A0
GetLocaleInfoEx.KERNEL32(?,00357F16,#r5,00000003,?,00000004,#r5), ref: 0036D5C0
GetLocaleInfoW.KERNEL32(00000000,00000004,?,00000003,?,00357F16,#r5,00000003,?,00000004,#r5), ref: 0036D5D7

Strings

GetLocaleInfoEx, xrefs: 0036D583
kernel32.dll, xrefs: 0036D574

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: InfoLocalePointer$AddressDecodeEncodeHandleModuleProc
String ID: GetLocaleInfoEx$kernel32.dll
API String ID: 3226634038-1547310189
Opcode ID: 0cb9730066c53c1e81184d10c9a03a19ed2a5648802ab7f1f4cdc69a27ed724e
Instruction ID: 85b6405856e23048fd8e596fd96eaf8792bb82ea79c5a4af0970f9e3404d2421
Opcode Fuzzy Hash: 0cb9730066c53c1e81184d10c9a03a19ed2a5648802ab7f1f4cdc69a27ed724e
Instruction Fuzzy Hash: AC018B31A01219BFCF025FA0EC088AA3F28AB493557048024FE0A92624CB318D20EBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00325120 Relevance: 11.6, Strings: 9, Instructions: 395COMMON

Download Yara Rule

Strings

invalidSKU, xrefs: 0032534F
Application Initialization Error: Parsing, xrefs: 00325236
ApplicationXml, xrefs: 00325210, 003252D1
type, xrefs: 00325377
installerName, xrefs: 0032542C
Error occurred while parsing application xml, xrefs: 0032520B
Invalid Sku Name, xrefs: 003252CC
Error occurred while getting application xml: %d extended error: %d, xrefs: 00325170
HTTPConnectorError, xrefs: 00325175

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Init_thread_footer
String ID: Application Initialization Error: Parsing$ApplicationXml$Error occurred while getting application xml: %d extended error: %d$Error occurred while parsing application xml$HTTPConnectorError$Invalid Sku Name$installerName$invalidSKU$type
API String ID: 1385522511-137315162
Opcode ID: a4cd99831266a95fd771e2b6f7243871e51e211bbe9b15853e0bc987e94a88ba
Instruction ID: 087b640c8402fa5477f2688f77919c47e6f65df946ebb7ec8cc7c8e92dfc26c7
Opcode Fuzzy Hash: a4cd99831266a95fd771e2b6f7243871e51e211bbe9b15853e0bc987e94a88ba
Instruction Fuzzy Hash: 15028E70D10248DFDB05EFA4D955BEDBBB4BF19304F24826AE405BB291EB74AA44CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00323F00 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 300COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00324F0B

Strings

5, xrefs: 00324FDF
Error occurred while getting application xml: %d extended error: %d, xrefs: 00325170
Application Initialization Error: CallBack_03_, xrefs: 00324F68
HTTPConnectorError, xrefs: 00325175

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: wsprintf
String ID: 5$Application Initialization Error: CallBack_03_$Error occurred while getting application xml: %d extended error: %d$HTTPConnectorError
API String ID: 2111968516-2664039161
Opcode ID: 114a95398e8404458442f7c1e15ab8301fd913e0f382b2632f07d48d9afe2643
Instruction ID: 2e20b6fc0c30613ab27090c60d06e3360f6884c3b466c013db8f24211f37481f
Opcode Fuzzy Hash: 114a95398e8404458442f7c1e15ab8301fd913e0f382b2632f07d48d9afe2643
Instruction Fuzzy Hash: 2E81B0319042989FCB11DF64CC91BEDBBB4FF1A310F14469AE405AB281DB746A94CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0070DE50 Relevance: 7.7, APIs: 5, Instructions: 207librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 0070DF92
GetProcAddress.KERNEL32(?,006F5FF9), ref: 0070DFB0
ExitProcess.KERNEL32(?,006F5FF9), ref: 0070DFC1
VirtualProtect.KERNEL32(002D0000,00001000,00000004,?,00000000), ref: 0070E00F
VirtualProtect.KERNEL32(002D0000,00001000), ref: 0070E024

Memory Dump Source

Source File: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ProtectVirtual$AddressExitLibraryLoadProcProcess
String ID:
API String ID: 1996367037-0
Opcode ID: d18fab308fb1ed4f53800a2dc015190224ec41744ebccb5befc2af52d25d2fc5
Instruction ID: d9e5149f0152c98760472a348a85c013ebae6e9eeb6f1b818d65701e6de7941f
Opcode Fuzzy Hash: d18fab308fb1ed4f53800a2dc015190224ec41744ebccb5befc2af52d25d2fc5
Instruction Fuzzy Hash: CF51F572A50753CAD7309AF8CCC0664B7D4EB663247680738D5F2CB3C6E7A86C068764

Uniqueness

Uniqueness Score: -1.00%

Function 002E12E0 Relevance: 7.5, APIs: 1, Strings: 3, Instructions: 527windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000BCE,00000000,00000000), ref: 002E17C5

Part of subcall function 002E2BB0: Concurrency::cancel_current_task.LIBCPMT ref: 002E2D00

Strings

", ", xrefs: 002E169E
messageFromNative(", xrefs: 002E141F
CloseButton, xrefs: 002E18D3

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Concurrency::cancel_current_taskMessageSend
String ID: ", "$CloseButton$messageFromNative("
API String ID: 2857186249-1103917013
Opcode ID: d81ae49c544000dc7a081299535bb7238c2ea5ce46a0bd2358e4c41f9331e00b
Instruction ID: 8a49c4910310876a34faed12a299098e3f8d9a7dee406070dddafd5b6477d3d2
Opcode Fuzzy Hash: d81ae49c544000dc7a081299535bb7238c2ea5ce46a0bd2358e4c41f9331e00b
Instruction Fuzzy Hash: 5C32B030D10288DFDB10CFA9C995BDEBBB5AF54304F64826DE415A7282EB706A59CF90

Uniqueness

Uniqueness Score: -1.00%

Function 004C51D9 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 408timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,004C561E,00000000,00000000,00000000), ref: 004C54DD

Strings

&VL, xrefs: 004C54B3, 004C54B6
W. Europe Standard Time, xrefs: 004C5576
W. Europe Summer Time, xrefs: 004C558A

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: InformationTimeZone
String ID: &VL$W. Europe Standard Time$W. Europe Summer Time
API String ID: 565725191-2490263050
Opcode ID: 48da2871d1934a55d45cb7bcde0d885826d2957709dc8c691c5008e3ff251594
Instruction ID: a6d843c0c27383c9a8a8c1e113f34628ff428667dd483433cae904bb752beba1
Opcode Fuzzy Hash: 48da2871d1934a55d45cb7bcde0d885826d2957709dc8c691c5008e3ff251594
Instruction Fuzzy Hash: A0C15779A00515ABCB10AF65EC02FBF7BA9EF14354F54406FF80497290E778AE80DB98

Uniqueness

Uniqueness Score: -1.00%

Function 002E03E0 Relevance: 6.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,00000006), ref: 002E03F8
LoadResource.KERNEL32(?,00000000), ref: 002E040C

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Resource$FindLoad
String ID:
API String ID: 2619053042-0
Opcode ID: 51be784087739aba9fed7952dc33cab2b1ed702f3ab0d2029393b8f7c2af6785
Instruction ID: 63075b5511c690ddd32a7f3b58b78a8ccfc45f871fc67bf31959a604e0247080
Opcode Fuzzy Hash: 51be784087739aba9fed7952dc33cab2b1ed702f3ab0d2029393b8f7c2af6785
Instruction Fuzzy Hash: 4701F973B5023A5BDB201F6AAD8447BB39CEB843667414437FF49E7141D571DC6286B0

Uniqueness

Uniqueness Score: -1.00%

Function 00358331 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

OutputDebugStringA.KERNEL32(IsolationAware function called after IsolationAwareCleanup,00000105,?,00366212,00000000,00559478,00000010,00360B0A,?,?,?,00000000), ref: 00358345
GetLastError.KERNEL32(00360B0A,00000105,?,00366212,00000000,00559478,00000010,00360B0A,?,?,?,00000000), ref: 0035837C

Part of subcall function 00358450: GetModuleFileNameW.KERNEL32(?,?,00000105,?,00366212,00000000,00559478,00000010,00360B0A,?,?,?,00000000), ref: 00358500
Part of subcall function 00358450: SetLastError.KERNEL32(0000006F,?,00366212,00000000,00559478,00000010,00360B0A,?,?,?,00000000), ref: 00358514

Strings

IsolationAware function called after IsolationAwareCleanup, xrefs: 00358340

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ErrorLast$DebugFileModuleNameOutputString
String ID: IsolationAware function called after IsolationAwareCleanup
API String ID: 3265401609-2690750368
Opcode ID: 41360beb821cbd2dfa02606cf06fc1ae5b38755e565820ce1aa73f0eae4b52ca
Instruction ID: 07379adf4eeac28171a58209b2b9c9274e443062585c59642e9df60d615fbef9
Opcode Fuzzy Hash: 41360beb821cbd2dfa02606cf06fc1ae5b38755e565820ce1aa73f0eae4b52ca
Instruction Fuzzy Hash: FEF0AF3D6052108B4B3B6FA9EC42D3E77A49A14F43B264426EE04F1530DE30CC9DAA91

Uniqueness

Uniqueness Score: -1.00%

Function 003A5F39 Relevance: 68.6, APIs: 34, Strings: 5, Instructions: 366
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 003A5F43

Part of subcall function 0036773E: __EH_prolog3.LIBCMT ref: 00367745
Part of subcall function 0036773E: GetWindowDC.USER32(00000000,00000004,003A64D0,00000000), ref: 00367771

GetDeviceCaps.GDI32(?,00000058), ref: 003A5F63
DeleteObject.GDI32(00000000), ref: 003A5FCD
DeleteObject.GDI32(00000000), ref: 003A5FEB
DeleteObject.GDI32(00000000), ref: 003A6009
DeleteObject.GDI32(00000000), ref: 003A6027
DeleteObject.GDI32(00000000), ref: 003A6045
DeleteObject.GDI32(00000000), ref: 003A6063
DeleteObject.GDI32(00000000), ref: 003A6081
DeleteObject.GDI32(00000000), ref: 003A609F
DeleteObject.GDI32(00000000), ref: 003A60BD
DeleteObject.GDI32(00000000), ref: 003A60DB
GetTextCharsetInfo.GDI32(?,00000000,00000000), ref: 003A6113
lstrcpyW.KERNEL32(?,?), ref: 003A6163
EnumFontFamiliesW.GDI32(?,00000000,003A5A67,Segoe UI), ref: 003A618A
lstrcpyW.KERNEL32(?,Segoe UI), ref: 003A619D
EnumFontFamiliesW.GDI32(?,00000000,003A5A67,Tahoma), ref: 003A61BB
lstrcpyW.KERNEL32(?,MS Sans Serif), ref: 003A61D5
CreateFontIndirectW.GDI32(?), ref: 003A61DF
CreateFontIndirectW.GDI32(?), ref: 003A6230
CreateFontIndirectW.GDI32(?), ref: 003A626F
CreateFontIndirectW.GDI32(?), ref: 003A629B
CreateFontIndirectW.GDI32(?), ref: 003A62BC
GetSystemMetrics.USER32(00000048), ref: 003A62DB
lstrcpyW.KERNEL32(?,Marlett), ref: 003A62EE
CreateFontIndirectW.GDI32(?), ref: 003A62F8
GetStockObject.GDI32(00000011), ref: 003A6324
GetObjectW.GDI32(00000000,0000005C,?), ref: 003A633F
lstrcpyW.KERNEL32(?,Arial), ref: 003A6380
CreateFontIndirectW.GDI32(?), ref: 003A638A
CreateFontIndirectW.GDI32(?), ref: 003A63A3
GetObjectW.GDI32(00000000,0000005C,?), ref: 003A63C1
CreateFontIndirectW.GDI32(?), ref: 003A63CF
CreateFontIndirectW.GDI32(?), ref: 003A63F0

Part of subcall function 003A6888: __EH_prolog3_GS.LIBCMT ref: 003A688F
Part of subcall function 003A6888: GetTextMetricsW.GDI32(?,?), ref: 003A68C4
Part of subcall function 003A6888: GetTextMetricsW.GDI32(?,?), ref: 003A6905

Strings

Segoe UI, xrefs: 003A6178, 003A6194
Tahoma, xrefs: 003A61A9, 003A61C8
Marlett, xrefs: 003A62E8
MS Sans Serif, xrefs: 003A61CF
Arial, xrefs: 003A6370

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Object$Font$CreateDeleteIndirect$lstrcpy$MetricsText$EnumFamiliesH_prolog3_$CapsCharsetDeviceH_prolog3InfoStockSystemWindow
String ID: Arial$MS Sans Serif$Marlett$Segoe UI$Tahoma
API String ID: 2837096512-1395034203
Opcode ID: 83ff97bc23aa30ae21466da4083a3d6ef8205f3ee41f93a35e485aa6b555b0cd
Instruction ID: b42bb7704749550914cb79aeed4d7f4ec8c08a69a5ef159d713c4f2f158f4563
Opcode Fuzzy Hash: 83ff97bc23aa30ae21466da4083a3d6ef8205f3ee41f93a35e485aa6b555b0cd
Instruction Fuzzy Hash: 58E17D709007099FDB129BB0CD4ABEEBBB8EF45301F148569E54AAB192DB749988CF14

Uniqueness

Uniqueness Score: -1.00%

Function 003A646A Relevance: 64.8, APIs: 43, Instructions: 298
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 003A6471
GetSysColor.USER32(00000016), ref: 003A647A
GetSysColor.USER32(0000000F), ref: 003A648D
GetSysColor.USER32(00000015), ref: 003A64A4
GetSysColor.USER32(0000000F), ref: 003A64B0
GetDeviceCaps.GDI32(00000014,0000000C), ref: 003A64D8
GetSysColor.USER32(0000000F), ref: 003A64E6
GetSysColor.USER32(00000010), ref: 003A64F4
GetSysColor.USER32(00000015), ref: 003A6502
GetSysColor.USER32(00000016), ref: 003A6510
GetSysColor.USER32(00000014), ref: 003A651E
GetSysColor.USER32(00000012), ref: 003A652C
GetSysColor.USER32(00000011), ref: 003A653A
GetSysColor.USER32(00000006), ref: 003A6545
GetSysColor.USER32(0000000D), ref: 003A6550
GetSysColor.USER32(0000000E), ref: 003A655B
GetSysColor.USER32(00000005), ref: 003A6566
GetSysColor.USER32(00000008), ref: 003A6574
GetSysColor.USER32(00000009), ref: 003A657F
GetSysColor.USER32(00000007), ref: 003A658A
GetSysColor.USER32(00000002), ref: 003A6595
GetSysColor.USER32(00000003), ref: 003A65A0
GetSysColor.USER32(0000001B), ref: 003A65AE
GetSysColor.USER32(0000001C), ref: 003A65BC
GetSysColor.USER32(0000000A), ref: 003A65CA
GetSysColor.USER32(0000000B), ref: 003A65D8
GetSysColor.USER32(00000013), ref: 003A65E6
GetSysColor.USER32(0000001A), ref: 003A660F
GetSysColorBrush.USER32(00000010), ref: 003A6620
GetSysColorBrush.USER32(00000014), ref: 003A6633
GetSysColorBrush.USER32(00000005), ref: 003A6646
CreateSolidBrush.GDI32(?), ref: 003A6667
CreateSolidBrush.GDI32(00000010), ref: 003A6685
CreateSolidBrush.GDI32(?), ref: 003A66A3
CreateSolidBrush.GDI32(?), ref: 003A66C4
CreateSolidBrush.GDI32(?), ref: 003A66E2
CreateSolidBrush.GDI32(?), ref: 003A6700
CreateSolidBrush.GDI32(?), ref: 003A671E
CreatePen.GDI32(00000000,00000001,00000000), ref: 003A6744
CreatePen.GDI32(00000000,00000001,00000000), ref: 003A6768
CreatePen.GDI32(00000000,00000001,00000000), ref: 003A678C
CreateSolidBrush.GDI32(?), ref: 003A680A
CreatePatternBrush.GDI32(00000000), ref: 003A6848

Part of subcall function 0036838F: DeleteObject.GDI32(00000000), ref: 0036839E

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Color$BrushCreate$Solid$CapsDeleteDeviceH_prolog3ObjectPattern
String ID:
API String ID: 3754413814-0
Opcode ID: af215fcc8cd14b67745b0791f5461fbbe3b6637b6372cf7a031c3ef6d6113683
Instruction ID: 1b2c3208054809adf65cf027159cfd835a8aef066b25fd3303f008b07a185d0f
Opcode Fuzzy Hash: af215fcc8cd14b67745b0791f5461fbbe3b6637b6372cf7a031c3ef6d6113683
Instruction Fuzzy Hash: 45C1D170A00A02AFDB06AF709C197ADBB60BF08701F048629F649DB2D1DF74A564EB94

Uniqueness

Uniqueness Score: -1.00%

Function 002E3230 Relevance: 36.3, APIs: 12, Strings: 12, Instructions: 303
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLastError.KERNEL32 ref: 002E3280
GlobalFree.KERNEL32(?), ref: 002E337A
GlobalFree.KERNEL32(?), ref: 002E3385
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,000000FF,00000000,00000000), ref: 002E33F5
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,?), ref: 002E3437
GetLastError.KERNEL32 ref: 002E34DA
GlobalFree.KERNEL32(?), ref: 002E355B
GlobalFree.KERNEL32(?), ref: 002E3566
GlobalFree.KERNEL32(?), ref: 002E3571
GlobalFree.KERNEL32(?), ref: 002E358D
GlobalFree.KERNEL32(?), ref: 002E3598
GlobalFree.KERNEL32(?), ref: 002E3390

Part of subcall function 002D8570: __Init_thread_footer.LIBCMT ref: 002D85F8

Strings

GetIEProxyInfo - Failed to get proxy for the url, error:%d, xrefs: 002E34E1
GetIEProxyInfo - No default proxy present on the user machine, xrefs: 002E33B7
GetIEProxyInfo - Failed to get proxy setting for current user :%d, xrefs: 002E3287
GetIEProxyInfo - invalid arguments, xrefs: 002E35CE
://, xrefs: 002E32FD
`avo, xrefs: 002E35A3
GetIEProxyInfo - proxy Url is %s, xrefs: 002E353B
HTTPConnectorError, xrefs: 002E35D3
https=, xrefs: 002E32C3
WinHTTP AutoProxy, xrefs: 002E3442
GetIEProxyInfo - autoconfig url on the machine is :%s, xrefs: 002E3476
GetIEProxyInfo - proxy fetched is :%s, xrefs: 002E32BA

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: FreeGlobal$ByteCharErrorLastMultiWide$Init_thread_footer
String ID: ://$GetIEProxyInfo - Failed to get proxy for the url, error:%d$GetIEProxyInfo - Failed to get proxy setting for current user :%d$GetIEProxyInfo - No default proxy present on the user machine$GetIEProxyInfo - autoconfig url on the machine is :%s$GetIEProxyInfo - invalid arguments$GetIEProxyInfo - proxy Url is %s$GetIEProxyInfo - proxy fetched is :%s$HTTPConnectorError$WinHTTP AutoProxy$`avo$https=
API String ID: 1541574466-872444659
Opcode ID: dac314cd339c9a926e575abc8e08851232ee51bdda8d395979facdeb594d0827
Instruction ID: 6efdfaf6a6617e58d72822ff79f65e2b872cca43d7de1e4c1bdef2618d7aec17
Opcode Fuzzy Hash: dac314cd339c9a926e575abc8e08851232ee51bdda8d395979facdeb594d0827
Instruction Fuzzy Hash: E6A102316543429BCB24DF26CC09B6B7BE8AFC8705F48056DF84593251EB75DE11CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 002FB670 Relevance: 33.7, APIs: 12, Strings: 7, Instructions: 408
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNEL32(00000000,00000000,7D8B83E9,?,00000000), ref: 002FB6D1
GetTempPathW.KERNEL32(00000000,00000000), ref: 002FB6F5
PathAppendW.SHLWAPI(00000000,0000000D,?,?,?,0000000D), ref: 002FB7A7
PathFileExistsW.SHLWAPI(?,Adobe_ADMLogs,0000000D), ref: 002FB805
PathIsDirectoryW.SHLWAPI(?), ref: 002FB81B
GetFileAttributesW.KERNEL32(?), ref: 002FB84B
GetFileAttributesW.KERNEL32(?,?), ref: 002FB88C
PathAppendW.SHLWAPI(00000000,?,?,?,?,?), ref: 002FB957
PathAppendW.SHLWAPI(00000000,?,?,?,?,?), ref: 002FBA08
PathFileExistsW.SHLWAPI(?,Adobe_ADMLogs,0000000D), ref: 002FBA89
PathIsDirectoryW.SHLWAPI(?), ref: 002FBA9B
SHCreateDirectoryExW.SHELL32(00000000,?,00000000), ref: 002FBACA

Strings

FileUtils, xrefs: 002FBADF
Adobe_ADMLogs, xrefs: 002FB732
Adobe_GDE.log, xrefs: 002FB99F
Adobe_ADM.log, xrefs: 002FB8DB, 002FBB40
2.0.0.759s, xrefs: 002FBB7B
SHCreateDirectoryEx failed. Error: %d, xrefs: 002FBAD5
*********************** ADM Workflow start. Version: %s **************************, xrefs: 002FBB80

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Path$File$AppendDirectory$AttributesExistsTemp$Create
String ID: *********************** ADM Workflow start. Version: %s **************************$2.0.0.759s$Adobe_ADM.log$Adobe_ADMLogs$Adobe_GDE.log$FileUtils$SHCreateDirectoryEx failed. Error: %d
API String ID: 1104237607-2701745630
Opcode ID: 0b41c278597051e171c43902937e12c33b0d468dcf391b236b47b614421e71c6
Instruction ID: 0f7b2c90b9f7f32426b386ab5c84b8269435a9da0c2adeefce5fe37d12a2f36f
Opcode Fuzzy Hash: 0b41c278597051e171c43902937e12c33b0d468dcf391b236b47b614421e71c6
Instruction Fuzzy Hash: 61F1DC71910209DBDF15EFA0CC55BFEB7B8AF14304F580169E901B7281EB70AA59CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00360BE8 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 189
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00366A15: GetWindowLongW.USER32(?,000000F0), ref: 00366A22

GetParent.USER32(?), ref: 00360C29
SendMessageW.USER32(00000000,0000036B,00000000,00000000), ref: 00360C4B
GetWindowRect.USER32(?,00000000), ref: 00360C78
GetWindowLongW.USER32(00000000,000000F0), ref: 00360CA7
MonitorFromWindow.USER32(00000000,00000001), ref: 00360CE0
GetMonitorInfoW.USER32(00000000), ref: 00360CE7
CopyRect.USER32(?,?), ref: 00360CF5
GetWindowRect.USER32(00000000,?), ref: 00360D02
MonitorFromWindow.USER32(00000000,00000002), ref: 00360D0F
GetMonitorInfoW.USER32(00000000), ref: 00360D16
CopyRect.USER32(?,?), ref: 00360D24
GetParent.USER32(?), ref: 00360D2E
GetClientRect.USER32(00000000,?), ref: 00360D3B
GetClientRect.USER32(00000000,?), ref: 00360D46

Strings

(, xrefs: 00360CC2

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: RectWindow$Monitor$ClientCopyFromInfoLongParent$MessageSend
String ID: (
API String ID: 788132146-3887548279
Opcode ID: 1a5073ab036b74ae9e34f06babe4d6003fe277383576c14c9222689ebc49931e
Instruction ID: c3d4e4c46492f2a48429176d4b388b007daae6dd29945088b1569addc8922b7d
Opcode Fuzzy Hash: 1a5073ab036b74ae9e34f06babe4d6003fe277383576c14c9222689ebc49931e
Instruction Fuzzy Hash: 6E616B71900209AFCB05CFA8DD89BAEBBB9FF48314F154225E505FB254DB70A949DB60

Uniqueness

Uniqueness Score: -1.00%

Function 002E0EA0 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 233
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0035EF31: GetClientRect.USER32(?,?), ref: 0035EF5C

SendMessageW.USER32(?,00000080,00000001,?), ref: 002E0EEA
SendMessageW.USER32(?,00000080,00000000,?), ref: 002E0EFC
GetDesktopWindow.USER32 ref: 002E0FA4
GetDC.USER32(00000000), ref: 002E0FAE
GetDeviceCaps.GDI32(00000000,00000058), ref: 002E0FC4
GetDeviceCaps.GDI32(?,0000005A), ref: 002E0FCD
ReleaseDC.USER32(?,?), ref: 002E0FD5
SetForegroundWindow.USER32(?), ref: 002E1079
SetActiveWindow.USER32(?,?,?,00000002), ref: 002E1089
FindResourceW.KERNEL32(?,000000A1,CONFIG,00000000,?,?,00000002), ref: 002E10D7
LoadResource.KERNEL32(?,00000000,?,?,00000002), ref: 002E10E1
SizeofResource.KERNEL32(?,00000000,?,?,00000002), ref: 002E10ED
LockResource.KERNEL32(00000000,?,?,00000002), ref: 002E10F6
PostMessageW.USER32(?,00000BCB,00000000,00000000), ref: 002E1160

Strings

CONFIG, xrefs: 002E10C6

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Resource$MessageWindow$CapsDeviceSend$ActiveClientDesktopFindForegroundLoadLockPostRectReleaseSizeof
String ID: CONFIG
API String ID: 3597144591-611510522
Opcode ID: cec5c8ba5e1d40c82b409b6e3d5e65a01ddb14b75c43e34847c9689f560f69ec
Instruction ID: 1836f6260303c58b3238a2c0418b1e5fbdd8e7b971a14e4a455fdff426dbd2bf
Opcode Fuzzy Hash: cec5c8ba5e1d40c82b409b6e3d5e65a01ddb14b75c43e34847c9689f560f69ec
Instruction Fuzzy Hash: 53810471E10205AFDB14DFA4CC49FAEBBB9FF88300F148229F505AB2A1DB74A955CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0036C0D1 Relevance: 21.2, APIs: 14, Instructions: 197
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEnterCriticalSection.NTDLL(00574C80), ref: 0036C0DF
GlobalAlloc.KERNEL32(00000002,00000000,?,?,?,00574C64,00574C64,?,0036C44E,00000004,00369CB2,00356155,00367584,002E1FC2,00000001,?), ref: 0036C14E
GlobalHandle.KERNEL32(00574C74), ref: 0036C158
GlobalUnWire.KERNEL32(00000000), ref: 0036C16A
GlobalReAlloc.KERNEL32(00000000,00000000,00002002), ref: 0036C185
GlobalFix.KERNEL32(00000000), ref: 0036C190
RtlLeaveCriticalSection.NTDLL(00574C80), ref: 0036C1DC
GlobalHandle.KERNEL32(00574C74), ref: 0036C1F0
GlobalFix.KERNEL32(00000000), ref: 0036C1FB
RtlLeaveCriticalSection.NTDLL(00574C80), ref: 0036C205
RtlEnterCriticalSection.NTDLL(00000000), ref: 0036C28E
RtlLeaveCriticalSection.NTDLL(00000000), ref: 0036C2A1
LocalFree.KERNEL32(?), ref: 0036C2AA
TlsSetValue.KERNEL32(00000000,00000000), ref: 0036C2C9

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Global$CriticalSection$Leave$AllocEnterHandle$FreeLocalValueWire
String ID:
API String ID: 490842090-0
Opcode ID: 3c76d71e0deff56137a9d5f8ebb300f56fb23597c23a0e938205d1d0ff212c4e
Instruction ID: bf9de3334d1dae4822f78419995290f4c2caf2402c553d99d6df5d1b64a3f4b6
Opcode Fuzzy Hash: 3c76d71e0deff56137a9d5f8ebb300f56fb23597c23a0e938205d1d0ff212c4e
Instruction Fuzzy Hash: 1761B031A00205EFCB15DFA8C899AA9BBB8FF45304F11C469ED41DB266DB30ED51CB60

Uniqueness

Uniqueness Score: -1.00%

Function 002E6EE0 Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 297threadCOMMON

Download Yara Rule

APIs

Part of subcall function 002D8570: __Init_thread_footer.LIBCMT ref: 002D85F8

CreateThread.KERNEL32(00000000,00000000,Function_000169D0,?,00000000,00000000), ref: 002E7117

Strings

Failed in thread creation, in SendHTTPRequestAsync, xrefs: 002E7135
Invalid arguments to SendHTTPRequest, xrefs: 002E7230
sendHTTPRequestAsync_01, xrefs: 002E727D
Error_InvalidArguments, xrefs: 002E7267
URL is not whitelisted: '%s', xrefs: 002E6F6C
sendHTTPRequestAsync_02, xrefs: 002E6FAD
Error_HTTP_INVALID_URL, xrefs: 002E6F97
HTTPConnectorError, xrefs: 002E6F71, 002E713A, 002E7235
Error_CreateThread, xrefs: 002E7160
sendHTTPRequestAsync_03, xrefs: 002E7176

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CreateInit_thread_footerThread
String ID: Error_CreateThread$Error_HTTP_INVALID_URL$Error_InvalidArguments$Failed in thread creation, in SendHTTPRequestAsync$HTTPConnectorError$Invalid arguments to SendHTTPRequest$URL is not whitelisted: '%s'$sendHTTPRequestAsync_01$sendHTTPRequestAsync_02$sendHTTPRequestAsync_03
API String ID: 3512583935-3715464230
Opcode ID: 2ba31e19d9d9ddae9b5d3c11c43e0d45f9612d85c8f761323556af7d67ac4687
Instruction ID: cfe48056e566b799fba7dbe5bdcfd1929874972feba29b71f949b9a83fb1cc6f
Opcode Fuzzy Hash: 2ba31e19d9d9ddae9b5d3c11c43e0d45f9612d85c8f761323556af7d67ac4687
Instruction Fuzzy Hash: 16D1A23096034ADFCB20DFA4C855BDEBBB5BF15304FA0425EE445A7281DB70AAA5CF91

Uniqueness

Uniqueness Score: -1.00%

Function 002E3CF0 Relevance: 19.5, APIs: 2, Strings: 9, Instructions: 296COMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(00000000), ref: 002E3E91
SetEvent.KERNEL32(?), ref: 002E4078

Part of subcall function 002D8570: __Init_thread_footer.LIBCMT ref: 002D85F8

Strings

WINHTTP_CALLBACK_STATUS_REQUEST_ERROR..., xrefs: 002E401D
HttpConnector, xrefs: 002E403A
WINHTTP_CALLBACK_STATUS_HEADERS_AVAILABLE : Successful header(s): %d, xrefs: 002E3F4E
HTTPConnectorError, xrefs: 002E3E25
WINHTTP_CALLBACK_STATUS_REQUEST_ERROR : error : %d, xrefs: 002E4035
WINHTTP_CALLBACK_STATUS_HEADERS_AVAILABLE : error : %d, xrefs: 002E3F17
WINHTTP_CALLBACK_STATUS_HEADERS_AVAILABLE..., xrefs: 002E3DCE
HTTP Request Status code:407. The proxy requires authentication., xrefs: 002E3E20
WINHTTP_CALLBACK_STATUS_READ_COMPLETE : complete, xrefs: 002E3FCF

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Event$Init_thread_footer
String ID: HTTP Request Status code:407. The proxy requires authentication.$HTTPConnectorError$HttpConnector$WINHTTP_CALLBACK_STATUS_HEADERS_AVAILABLE : Successful header(s): %d$WINHTTP_CALLBACK_STATUS_HEADERS_AVAILABLE : error : %d$WINHTTP_CALLBACK_STATUS_HEADERS_AVAILABLE...$WINHTTP_CALLBACK_STATUS_READ_COMPLETE : complete$WINHTTP_CALLBACK_STATUS_REQUEST_ERROR : error : %d$WINHTTP_CALLBACK_STATUS_REQUEST_ERROR...
API String ID: 1146775995-3466066548
Opcode ID: 57582d1247db62a98e088c3bc5c863cc573be71b5162493e7e64b25ebb3dd3d1
Instruction ID: 2177b87044f1c5ced29a5025e74984d5556ca05b2477a9c243c1531b51e1b9ff
Opcode Fuzzy Hash: 57582d1247db62a98e088c3bc5c863cc573be71b5162493e7e64b25ebb3dd3d1
Instruction Fuzzy Hash: BDB14230A507469FCB24DF69DC89B7AB7B4FF40315F54016EE9029B291DB71AE24CB90

Uniqueness

Uniqueness Score: -1.00%

Function 002E1C80 Relevance: 16.6, APIs: 11, Instructions: 107threadCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,7D8B83E9), ref: 002E1D04
GetWindowThreadProcessId.USER32(?,00000000), ref: 002E1D15
GetCurrentThreadId.KERNEL32 ref: 002E1D1D
AttachThreadInput.USER32(00000000,00000000,00000001), ref: 002E1D34
BringWindowToTop.USER32(?), ref: 002E1D39
SetForegroundWindow.USER32(?), ref: 002E1D4B
SetActiveWindow.USER32(?), ref: 002E1D5B
AttachThreadInput.USER32(00000000,?,00000000,00000000), ref: 002E1D6D

Part of subcall function 00367044: ShowWindow.USER32(?,?,?,?,00363F97,00000001,?,00000000,?,00000000), ref: 00367055

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInput$ActiveBringCurrentProcessShow
String ID:
API String ID: 1091635231-0
Opcode ID: 2786681bf86d396f009086e40ea63dd1712dd34ebddd05aa5988d15a06b0a746
Instruction ID: c4bf0bf76ea9c9ce4165a2848a70c55565d7681cfeee71e5e2508adfc34ad1a8
Opcode Fuzzy Hash: 2786681bf86d396f009086e40ea63dd1712dd34ebddd05aa5988d15a06b0a746
Instruction Fuzzy Hash: 6C312831A00204EFCF05AFB1DC05BADBBB9FF58310F044126F606A72A1DB359964EB60

Uniqueness

Uniqueness Score: -1.00%

Function 0033FDF0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 162COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,7D8B83E9,75B05EE0,?), ref: 0033FE5B
PathFileExistsW.SHLWAPI(?,.trace,?,?,?), ref: 0033FF22
PathFileExistsW.SHLWAPI(?,?,?,.debug), ref: 0033FF85
PathFileExistsW.SHLWAPI(?,adm.trace,?,?,.debug), ref: 0033FFFF

Part of subcall function 003407B0: PathRemoveFileSpecW.SHLWAPI(?,?,?,?), ref: 003407EC

Part of subcall function 003405D0: PathAppendW.SHLWAPI(?,?,?,00000000,0000004C), ref: 00340618

PathFileExistsW.SHLWAPI(?,adm.debug,?,?,.debug), ref: 00340072

Strings

.trace, xrefs: 0033FEA3
adm.debug, xrefs: 0034001E
.debug, xrefs: 0033FF2D
adm.trace, xrefs: 0033FFA3

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Path$File$Exists$AppendRemoveSpecTemp
String ID: .debug$.trace$adm.debug$adm.trace
API String ID: 2866433873-2690191726
Opcode ID: e693fd8f1fda8a8a7d3e9362d473eee05b29e2adb8d98c30b26a199ac21d39fb
Instruction ID: 0fa08e46f376e2f647964be7869d7d556f1e73c393d0daedb5663a9b7dc439bd
Opcode Fuzzy Hash: e693fd8f1fda8a8a7d3e9362d473eee05b29e2adb8d98c30b26a199ac21d39fb
Instruction Fuzzy Hash: 36717E3092425CCACB26DB64CCA8BEDB7B4BF21304F4505DAD509A7291DB746F88CF61

Uniqueness

Uniqueness Score: -1.00%

Function 00374A08 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 217comCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00374A0F
__EH_prolog3_GS.LIBCMT ref: 00374B8D
GetStockObject.GDI32(00000011), ref: 00374BB1
GetStockObject.GDI32(0000000D), ref: 00374BC0
GetObjectW.GDI32(0036900D,0000005C,?), ref: 00374BE1
GetDeviceCaps.GDI32(?,0000005A), ref: 00374C5B
OleCreateFontIndirect.OLEAUT32(00000020,0052366C), ref: 00374C8E

Strings

, xrefs: 00374BEA

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Object$Stock$CapsCreateDeviceFontH_prolog3_H_prolog3_catchIndirect
String ID:
API String ID: 3843465532-3916222277
Opcode ID: 36acdb737ba101fe64c2ee00e39b7a3d566c39f44bca3dabb067143fdee4c48b
Instruction ID: ccceb9a2a040af3d4f6c991a35fb7a97fb39118366b8e7f8be119d4500c63878
Opcode Fuzzy Hash: 36acdb737ba101fe64c2ee00e39b7a3d566c39f44bca3dabb067143fdee4c48b
Instruction Fuzzy Hash: 9C917E74A0021ADFCF22DFA4C955AADBBB5FF48304F158069E909AB291DB34EE10DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00358450 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 118libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 003583FE: QueryActCtxW.KERNEL32(?,0035849D,80000010,0056C34C,00000000,00000001,?,00000008,00000000,00558920,00000268,00358366,00000105,?,00366212,00000000), ref: 00358449

LoadLibraryW.KERNEL32(Comctl32.dll,00000000,00000000,00000002,Comctl32.dll,00000040), ref: 003585E6

Part of subcall function 003583AC: DeactivateActCtx.KERNEL32(?,00358210,004F7A78,00572F2C,DeactivateActCtx,00000000,?,00366285,00000000,00000000,0036623B,?,?,00000000), ref: 003583CD
Part of subcall function 003583AC: GetProcAddress.KERNEL32(00000000,00366285), ref: 003583DA

GetModuleFileNameW.KERNEL32(?,?,00000105,?,00366212,00000000,00559478,00000010,00360B0A,?,?,?,00000000), ref: 00358500
SetLastError.KERNEL32(0000006F,?,00366212,00000000,00559478,00000010,00360B0A,?,?,?,00000000), ref: 00358514
GetLastError.KERNEL32(00000020), ref: 0035856B

Strings

Comctl32.dll, xrefs: 003585D2, 003585D7, 003585E5
, xrefs: 0035851F
@, xrefs: 003585C1
GetModuleHandleExW, xrefs: 003584B3

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ErrorLast$AddressDeactivateFileLibraryLoadModuleNameProcQuery
String ID: $@$Comctl32.dll$GetModuleHandleExW
API String ID: 1356011737-4183358198
Opcode ID: f3702553f2a55c2241cd6e1ce7bbb6a6b27f7f66b77e5a886de162f643f1a57c
Instruction ID: 07b414c96136a92de0b04e6f5ea1b67dcf6e9855702b429defcf1dda7f691f0e
Opcode Fuzzy Hash: f3702553f2a55c2241cd6e1ce7bbb6a6b27f7f66b77e5a886de162f643f1a57c
Instruction Fuzzy Hash: D941E8B09002149ADB329B68DC89FAD76B8EB45712F1106A6ED05F61E0EF748E8DCF15

Uniqueness

Uniqueness Score: -1.00%

Function 004CC94D Relevance: 13.8, APIs: 9, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004CC694: CreateFileW.KERNEL32(00000000,00000000,?,004CC9F6,?,?,00000000,?,004CC9F6,00000000,0000000C), ref: 004CC6B1

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,74DF0900), ref: 004CCA61
__dosmaperr.LIBCMT ref: 004CCA68
GetFileType.KERNEL32(00000000), ref: 004CCA74
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,74DF0900), ref: 004CCA7E
__dosmaperr.LIBCMT ref: 004CCA87
CloseHandle.KERNEL32(00000000), ref: 004CCAA7
CloseHandle.KERNEL32(00000000), ref: 004CCBF4
GetLastError.KERNEL32 ref: 004CCC26
__dosmaperr.LIBCMT ref: 004CCC2D

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: c687b38761ebdb9ade864cb9382594671d6ccaecf60de292863af35e9df92a4a
Instruction ID: 22038839ab1cc2e972bdfac090927cb9c37a29640565c05024f539a09bc89220
Opcode Fuzzy Hash: c687b38761ebdb9ade864cb9382594671d6ccaecf60de292863af35e9df92a4a
Instruction Fuzzy Hash: 87A16B369041089FCF18DF68EC85BAE7BA1EB06314F18015EF815AB392DB399C16DB59

Uniqueness

Uniqueness Score: -1.00%

Function 0033E290 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123fileCOMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 0033E2DD
CloseHandle.KERNEL32(?), ref: 0033E30A
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000003,00000080,00000000), ref: 0033E33D
CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000001,00000080,00000000), ref: 0033E365
WriteFile.KERNEL32(00000000,0000FEFF,00000002,?,00000000), ref: 0033E39A
WriteFile.KERNEL32(00000000,0000BBEF,00000003,?,00000000), ref: 0033E3C0

Strings

rb, ccs=UTF-8, xrefs: 0033E2BB

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: File$CreateWrite$CloseHandle__fread_nolock
String ID: rb, ccs=UTF-8
API String ID: 3303977354-1143172267
Opcode ID: e20fff83ef0e4cf359b5818b8e63ed018bc7abedd684a619b39d8f2523b939d4
Instruction ID: 2583017aa432ad210ff69637b5a9ef97de92c00a7732d9dac710ff002d01733c
Opcode Fuzzy Hash: e20fff83ef0e4cf359b5818b8e63ed018bc7abedd684a619b39d8f2523b939d4
Instruction Fuzzy Hash: 76411634A00204FBDF219F68DC89FEAB3B8BB05721F10026AF650E71C0D7706A51CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0035ECB9 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0035ECC0
VariantClear.OLEAUT32(?), ref: 0035ED6D
VariantClear.OLEAUT32(?), ref: 0035ED77
VariantClear.OLEAUT32(?), ref: 0035ED81
VariantClear.OLEAUT32(?), ref: 0035ED8B
SysFreeString.OLEAUT32(002E0ED4), ref: 0035ED94

Strings

`<u, xrefs: 0035ED94

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ClearVariant$FreeH_prolog3String
String ID: `<u
API String ID: 3032559777-3367579956
Opcode ID: 3f8278dec74bee121e1bcc3972bfd8777ebdede90eb18b6e177c7d7a75f0dd39
Instruction ID: a93e8b45a9a489542047fd7af1b3c11699d59501df7b34d1be8d600fdc79c1dd
Opcode Fuzzy Hash: 3f8278dec74bee121e1bcc3972bfd8777ebdede90eb18b6e177c7d7a75f0dd39
Instruction Fuzzy Hash: 41316B7490021AAFDF11DFA0CD59FEE7BB8AF18305F004065F905AB251DA74AE19CF21

Uniqueness

Uniqueness Score: -1.00%

Function 0036D8C3 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 33registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00357D11,?,?), ref: 0036D8D5
GetProcAddress.KERNEL32(00000000,RegisterApplicationRestart), ref: 0036D8E5
RtlEncodePointer.NTDLL(00000000), ref: 0036D8EE
RtlDecodePointer.NTDLL(C2B6A2C4), ref: 0036D8FC
RegisterApplicationRestart.KERNEL32(?,?,00357D11,?,?), ref: 0036D916

Strings

kernel32.dll, xrefs: 0036D8D0
RegisterApplicationRestart, xrefs: 0036D8DF

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Pointer$AddressApplicationDecodeEncodeHandleModuleProcRegisterRestart
String ID: RegisterApplicationRestart$kernel32.dll
API String ID: 2334171955-1259503209
Opcode ID: 65c79c1a2155f2e1ff837a23263b4d3ca4edddb7564dd20e9319fca49c950146
Instruction ID: 4471a51deed6d29f142fd740557492fb446b00b98ccb1a04c0f9aeab0d4568b1
Opcode Fuzzy Hash: 65c79c1a2155f2e1ff837a23263b4d3ca4edddb7564dd20e9319fca49c950146
Instruction Fuzzy Hash: 6FF08235B42315AB8B121F64AC0C97A7F9CAB947563024031BD0AE7235DB309C60DEA8

Uniqueness

Uniqueness Score: -1.00%

Function 0033E3E0 Relevance: 12.2, APIs: 8, Instructions: 201COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,?,7D8B83E9), ref: 0033E463
PathFileExistsW.SHLWAPI(?), ref: 0033E470
SHCreateDirectoryExW.SHELL32(00000000,?,00000000,?), ref: 0033E4AB

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Path$CreateDirectoryExistsFileTemp
String ID:
API String ID: 2786188043-0
Opcode ID: 33fad6c3055ca6b94291c43ff8270110be333a49b44e4049f825194f276d1a08
Instruction ID: d8ca625e9ff7942edd0a0c15cc9d4987c88927e3090eca2d3ffddf371e1c7508
Opcode Fuzzy Hash: 33fad6c3055ca6b94291c43ff8270110be333a49b44e4049f825194f276d1a08
Instruction Fuzzy Hash: CB81AF70914218DFDB61DF64CC98BE9B7F8BF25304F5005A9E449A3291EB74AE88CF61

Uniqueness

Uniqueness Score: -1.00%

Function 003409F0 Relevance: 12.2, APIs: 8, Instructions: 192fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000,7D8B83E9,00000000), ref: 00340A45
GetFileSizeEx.KERNEL32(00000000,?), ref: 00340A64
FindCloseChangeNotification.KERNEL32(?), ref: 00340A8A
CloseHandle.KERNEL32(00000001), ref: 00340ABC
PathRemoveExtensionW.SHLWAPI(?,?,?), ref: 00340B1B

Part of subcall function 00340670: PathAddExtensionW.SHLWAPI(?,?,?,?,?), ref: 003406B8

Part of subcall function 003408E0: CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000,?,?,?,?,00340C6F,?,?,00000000,?), ref: 00340925
Part of subcall function 003408E0: CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000004,00000080,00000000,?,C0000000,00000003,00000000,00000003,00000080,00000000,?,?), ref: 00340944
Part of subcall function 003408E0: CloseHandle.KERNEL32(00000000,?,40000000,00000000,00000000,00000004,00000080,00000000,?,C0000000,00000003,00000000,00000003,00000080,00000000,?), ref: 0034094E

CreateFileW.KERNEL32(?,40000000,00000003,00000000,00000005,00000080,00000000,?,?,00000000,?,?,?,?), ref: 00340C8E
CloseHandle.KERNEL32(00000000,?,?,?), ref: 00340C9B
CloseHandle.KERNEL32(00000000), ref: 00340CCE

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CloseFile$CreateHandle$ExtensionPath$ChangeFindNotificationRemoveSize
String ID:
API String ID: 1112151327-0
Opcode ID: f7de111667286f8ba2ed111c0b4d4f24ba4df983e9cfed08e5b7f16f54932383
Instruction ID: 3208ecec148c0144105044491e3a69411ea5677786fd0881f3b4149ab9657b0d
Opcode Fuzzy Hash: f7de111667286f8ba2ed111c0b4d4f24ba4df983e9cfed08e5b7f16f54932383
Instruction Fuzzy Hash: D2816A30920218DBCB25DB24CC99BE9B3B8BF55304F1002DAE549AB291EB746F94CF50

Uniqueness

Uniqueness Score: -1.00%

Function 003400C0 Relevance: 10.7, APIs: 7, Instructions: 200COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,7D8B83E9,75B05EE0), ref: 0034015E
PathIsDirectoryW.SHLWAPI(?), ref: 003401C2
SHCreateDirectoryExW.SHELL32(00000000,?,00000000,0000004C), ref: 0034020D
PathIsFileSpecW.SHLWAPI(?,00000034), ref: 00340259
CloseHandle.KERNEL32(?,00000034), ref: 003402DA
PathFindFileNameW.SHLWAPI(0000004C), ref: 003402F9
FindCloseChangeNotification.KERNEL32(00000000), ref: 0034034E

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Path$CloseDirectoryFileFind$ChangeCreateHandleNameNotificationSpecTemp
String ID:
API String ID: 94008183-0
Opcode ID: 4c780e98fdd98ebc9d785e77a381ce92eb327eff88ac79f35de4f268cc548303
Instruction ID: 936c91c52f4352fd4570d755daba4cbbeb51ff72e658e9705cb514aad0362a36
Opcode Fuzzy Hash: 4c780e98fdd98ebc9d785e77a381ce92eb327eff88ac79f35de4f268cc548303
Instruction Fuzzy Hash: 9881A034A102199FCF2ADF64CC98BE9B7B5FF54304F040199D9459B281DB746E99CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0033A120 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 139COMMON

Download Yara Rule

APIs

Part of subcall function 0033BEB0: MultiByteToWideChar.KERNEL32(00000000,00000000,MSXML2.DOMDocument.3.0,00000017,00000000,00000000,7D8B83E9,00000000,?,?,?,?,004DDCA0,000000FF,?,0033A169), ref: 0033BEEC
Part of subcall function 0033BEB0: MultiByteToWideChar.KERNEL32(00000000,00000000,MSXML2.DOMDocument.3.0,00000017,-00000008,00000000,?,?,?,?,004DDCA0,000000FF,?,0033A169,?,?), ref: 0033BF59
Part of subcall function 0033BEB0: GetLastError.KERNEL32(?,?,?,004DDCA0,000000FF,?,0033A169,?,?), ref: 0033BF77

_com_issue_errorex.COMSUPP ref: 0033A196

Part of subcall function 004A15E0: GetErrorInfo.OLEAUT32(00000000,?), ref: 004A1646

GetLastError.KERNEL32(?,?), ref: 0033A23C
_com_issue_error.COMSUPP ref: 0033A2FC

Strings

Failed in MSXML create instance error:%d, xrefs: 0033A243
`<u, xrefs: 0033A626, 0033A692
XMLParser, xrefs: 0033A24D

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Error$ByteCharLastMultiWide$Info_com_issue_error_com_issue_errorex
String ID: Failed in MSXML create instance error:%d$XMLParser$`<u
API String ID: 597769415-3387166761
Opcode ID: a833556eaf57c54a9c1370833e5ee1922fd8b41abe5a77c76cbed7ad49bbb5bd
Instruction ID: 29483f7fcc95cca3655c93bfbf31e083b8ef3ea9aa7f5833132756b035cf0e81
Opcode Fuzzy Hash: a833556eaf57c54a9c1370833e5ee1922fd8b41abe5a77c76cbed7ad49bbb5bd
Instruction Fuzzy Hash: 5141C471A05608EFDB15DFA8C989BAEBBF8EF05304F104459E805EB381D7759E00CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 002E8FE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 130registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000000,http\shell\open\command,00000000,00020019,?,0052EE6C,00000000,7D8B83E9,00000004,?), ref: 002E906A
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 002E908A
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 002E90D3
RegCloseKey.ADVAPI32(00000000), ref: 002E9144

Strings

Default browser : %s, xrefs: 002E9161
http\shell\open\command, xrefs: 002E9052

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Default browser : %s$http\shell\open\command
API String ID: 1586453840-569077617
Opcode ID: fca4a59577a0c1de0a7c3332fc6bff37c9a49216c6210f76605c9acb1585ca28
Instruction ID: 9744556a4d4ec18dacefceb1d7501fce174cb721a66d72087f844dc154388727
Opcode Fuzzy Hash: fca4a59577a0c1de0a7c3332fc6bff37c9a49216c6210f76605c9acb1585ca28
Instruction Fuzzy Hash: 0141B471E50246ABDB11DF64DC06BAFBBB4FF44704F20422EF405AB281EB75AA54CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00363EA8 Relevance: 10.6, APIs: 7, Instructions: 125windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00363ED5
PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000000), ref: 00363EF7
KiUserCallbackDispatcher.NTDLL(?), ref: 00363F11
SendMessageW.USER32(?,00000121,00000001,?), ref: 00363F37
SendMessageW.USER32(?,0000036A,00000000,00000000), ref: 00363F4F
UpdateWindow.USER32(?), ref: 00363F9A
PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000000), ref: 00363FDC

Part of subcall function 00366A15: GetWindowLongW.USER32(?,000000F0), ref: 00366A22

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Message$PeekSendWindow$CallbackDispatcherLongParentUpdateUser
String ID:
API String ID: 3153985260-0
Opcode ID: a2e81bd6a30c794fafb6f0bdf9666e4be85189f239cfe2d9b1f32732197c7d16
Instruction ID: 60b9a3a13765d4e2598c8c9e1858440786006ea1e0569fecd39c1bc16a86115b
Opcode Fuzzy Hash: a2e81bd6a30c794fafb6f0bdf9666e4be85189f239cfe2d9b1f32732197c7d16
Instruction Fuzzy Hash: BD41D171E00214BBEB169F64C849B6EBBB8BF00715F15C158F901AB1D4DBB4DE54DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0035FEB2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 78libraryloaderthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 0036C407: __EH_prolog3.LIBCMT ref: 0036C40E

GetCurrentThreadId.KERNEL32 ref: 0035FEDA
SetWindowsHookExW.USER32(00000005,00364936,00000000,00000000), ref: 0035FEEA
GetProcAddress.KERNEL32(00000000,HtmlHelpW), ref: 0035FF4D
FreeLibrary.KERNEL32(?,?,Function_00086155,?,00000000,?,0035A613,?,00000000,?,?,?,0035A050,00000024,002DFD91), ref: 0035FF5D

Strings

hhctrl.ocx, xrefs: 0035FF31
HtmlHelpW, xrefs: 0035FF47

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: AddressCurrentFreeH_prolog3HookLibraryProcThreadWindows
String ID: HtmlHelpW$hhctrl.ocx
API String ID: 3379832378-3773518134
Opcode ID: f477d1e56c504a1754a1da8106f686b87d675cbf450cd4f5243a2533fc57e3e8
Instruction ID: 48da2821382f923b9eef3bf38c4bf62cbb4460a9eaabb47101855336eee6f8fa
Opcode Fuzzy Hash: f477d1e56c504a1754a1da8106f686b87d675cbf450cd4f5243a2533fc57e3e8
Instruction Fuzzy Hash: CA21CB35600B059FD7336FA1DC06F267B94EB41762F108435FD469A961DB70D854CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 004C3750 Relevance: 9.3, APIs: 6, Instructions: 298COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5620b822ae3cb207af39624d7125ab62ca347de82c099bb5dec475c3fdee26ae
Instruction ID: 8246abde5699a74660a3f1f83416a87f4be74cbf7699b11c0bc89f7ac7d3292a
Opcode Fuzzy Hash: 5620b822ae3cb207af39624d7125ab62ca347de82c099bb5dec475c3fdee26ae
Instruction Fuzzy Hash: 5AB149B8A04209AFDB10DF99DC40FAEBBB1AF99305F04815EF44467392C7799A41CF69

Uniqueness

Uniqueness Score: -1.00%

Function 002EB890 Relevance: 9.2, APIs: 6, Instructions: 155COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 002EB8DD
std::_Lockit::_Lockit.LIBCPMT ref: 002EB8FF
std::_Lockit::~_Lockit.LIBCPMT ref: 002EB927
__Getctype.LIBCPMT ref: 002EBA07
std::_Facet_Register.LIBCPMT ref: 002EBA49
std::_Lockit::~_Lockit.LIBCPMT ref: 002EBA73

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 3c8876a7fc8feca7ebd6654c26301c69ba591c12bd991fc6ca03823560562379
Instruction ID: 8c5db619d5d8826f2cc56544ff584f982d76948633eb6b76840467ee8ef504e1
Opcode Fuzzy Hash: 3c8876a7fc8feca7ebd6654c26301c69ba591c12bd991fc6ca03823560562379
Instruction Fuzzy Hash: 7B61BBB0D10249CFDB12CF69D5407AEBBF8EB14314F24416ED885AB391EB74AE44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00359FCE Relevance: 9.1, APIs: 6, Instructions: 137COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00359FD5
FindResourceW.KERNEL32(?,00000000,00000005,00000024,002DFD91), ref: 0035A016
LoadResource.KERNEL32(?,00000000), ref: 0035A022
LockResource.KERNEL32(?,00000024,002DFD91), ref: 0035A032
GetDesktopWindow.USER32 ref: 0035A069
SetActiveWindow.USER32(00000000,?,00000024,002DFD91), ref: 0035A17A

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Resource$Window$ActiveDesktopFindH_prolog3_catchLoadLock
String ID:
API String ID: 444376616-0
Opcode ID: 924f0c06f22e1ef0be34cbacbaeb447b92940a126bdee7996c5317e44e1dd4e5
Instruction ID: 3d4eb76f38927f692239f3477560b1d800692f9cec8f5522e194a1e13124d403
Opcode Fuzzy Hash: 924f0c06f22e1ef0be34cbacbaeb447b92940a126bdee7996c5317e44e1dd4e5
Instruction Fuzzy Hash: 3451A570A00A159FCF129F70CC45FADB7B4BF48312F054115ED06A72A1DB749D44EBA5

Uniqueness

Uniqueness Score: -1.00%

Function 003579F2 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 271COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00357A99
SysFreeString.OLEAUT32(?), ref: 00357CD8

Strings

%08lX-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X, xrefs: 00357B49
`<u, xrefs: 00357CD8
RestartByRestartManager, xrefs: 00357B82, 00357B87, 00357B8F

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: FreeH_prolog3_String
String ID: %08lX-%04X-%04x-%02X%02X-%02X%02X%02X%02X%02X%02X$RestartByRestartManager$`<u
API String ID: 1868347590-4201609942
Opcode ID: 83eabb38e0c48fa4eeed08e78857ffb2dbe578249569564736fe35e73633ae2c
Instruction ID: 2f8cc62c7b39320e4f11a3f9acc49c2d44314c17b7641d7f10fa7667f8d8678f
Opcode Fuzzy Hash: 83eabb38e0c48fa4eeed08e78857ffb2dbe578249569564736fe35e73633ae2c
Instruction Fuzzy Hash: 03A1D6319041099FCF06EBA4DC95EFEB7B9AF98315F154069F901B72A2DB34AD05CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0030F1D0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 137COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,7D8B83E9,00000000), ref: 0030F285

Part of subcall function 002D8570: __Init_thread_footer.LIBCMT ref: 002D85F8

Strings

Failed to start listening to IPC Packets, xrefs: 0030F31A, 0030F389
InitElevationHandler, xrefs: 0030F226, 0030F31F, 0030F38E
Not admin and child process. Error case., xrefs: 0030F221
Admin and not child process. No need for IPC, xrefs: 0030F3B2

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: FileInit_thread_footerModuleName
String ID: Admin and not child process. No need for IPC$Failed to start listening to IPC Packets$InitElevationHandler$Not admin and child process. Error case.
API String ID: 3404962059-3610088692
Opcode ID: 9dea9cd9c04510c014f03843609838edc7d1a99de4ba8f62aef8e591759d9068
Instruction ID: 3e9288effcc8748d7af0a33bb7bf128681f859ed70bdda51488a97b7afb69fb8
Opcode Fuzzy Hash: 9dea9cd9c04510c014f03843609838edc7d1a99de4ba8f62aef8e591759d9068
Instruction Fuzzy Hash: A051E4749513059BCF35AB24CC6ABFE7BA4AF11308F0406EAE805576C2EF355A55CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0033F490 Relevance: 7.7, APIs: 5, Instructions: 247filesynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,7D8B83E9,?,?,?,004DE35D,000000FF), ref: 0033F52C
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 0033F7F3
WriteFile.KERNEL32(?,?,00000001,?,?,?,?,?,?,00000000), ref: 0033F81C
WriteFile.KERNEL32(?,0053F4A4,00000002,00000000,00000000,?,?,?,?,?,00000000), ref: 0033F83B
ReleaseMutex.KERNEL32(?), ref: 0033F872

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: File$Write$MutexObjectPointerReleaseSingleWait
String ID:
API String ID: 3384908094-0
Opcode ID: ba72f5f670bc92ef0ef3d5a1b5be83980f3c7d6653d0ddc9c628409d213eff3d
Instruction ID: 0db282269d31a5b29146015f3a5bbca7010b40190e8061e3aebe3f59734eb768
Opcode Fuzzy Hash: ba72f5f670bc92ef0ef3d5a1b5be83980f3c7d6653d0ddc9c628409d213eff3d
Instruction Fuzzy Hash: 40C11534D142A8DFDB25CF24CD85BE9B7B5BF18304F4041EAE588A6291DBB46AD8CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0033EEC0 Relevance: 7.7, APIs: 5, Instructions: 174filesynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF,7D8B83E9,?,?,?,004DE21B,000000FF), ref: 0033EF5C
SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 0033F0D2
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0033F0FB
WriteFile.KERNEL32(?,0053F4A4,00000002,?,00000000), ref: 0033F11A
ReleaseMutex.KERNEL32(?), ref: 0033F151

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: File$Write$MutexObjectPointerReleaseSingleWait
String ID:
API String ID: 3384908094-0
Opcode ID: 5e4ac59ef62ebf823abd8895f7e54e7ac343902cf7bf93c30eb4158a7fa57d93
Instruction ID: 556db520da161f7af6d561770a312a768f3b8854820291137bd69174d5eae764
Opcode Fuzzy Hash: 5e4ac59ef62ebf823abd8895f7e54e7ac343902cf7bf93c30eb4158a7fa57d93
Instruction Fuzzy Hash: 33711D75900359EFDF25DF64CC48B99B7B5FF08310F0181AAE918A72A2D774AA94CF50

Uniqueness

Uniqueness Score: -1.00%

Function 004C546B Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 156timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004BF8F8: RtlFreeHeap.NTDLL(00000000,00000000,?,004C8309,?,00000000,?,?,004C85AA,?,00000007,?,?,004C8B05,?,?), ref: 004BF90E
Part of subcall function 004BF8F8: GetLastError.KERNEL32(?,?,004C8309,?,00000000,?,?,004C85AA,?,00000007,?,?,004C8B05,?,?), ref: 004BF919

GetTimeZoneInformation.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,004C561E,00000000,00000000,00000000), ref: 004C54DD

Strings

&VL, xrefs: 004C54B3, 004C54B6
W. Europe Standard Time, xrefs: 004C5576
W. Europe Summer Time, xrefs: 004C558A

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone
String ID: &VL$W. Europe Standard Time$W. Europe Summer Time
API String ID: 3335090040-2490263050
Opcode ID: 7971c9b24038a325a4157ad5072448e4c4c7a80f778c4e538852643fca109460
Instruction ID: 8ae56c1f06aa09fa54bb9981952535e55f77d9a613c9e345608bb6e041610fa5
Opcode Fuzzy Hash: 7971c9b24038a325a4157ad5072448e4c4c7a80f778c4e538852643fca109460
Instruction Fuzzy Hash: A141D475900614ABCB10AF6AEC05F9E7B78EF45324B10416FF418A71A1EB38AD85DB98

Uniqueness

Uniqueness Score: -1.00%

Function 002E1C00 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

Strings

Edit, xrefs: 0035A66F

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID: Edit
API String ID: 0-554135844
Opcode ID: bf2dd61b8cbc5b9c4ce0c0c611176b6e9b6fc590bbab38d5a66801388d7c4fd6
Instruction ID: 16aef78bcbe4f1b6d74e831165eb3ef848a132929a77131409ee90d8e3419667
Opcode Fuzzy Hash: bf2dd61b8cbc5b9c4ce0c0c611176b6e9b6fc590bbab38d5a66801388d7c4fd6
Instruction Fuzzy Hash: 8D11E431300709AADB321F24DC09F657BE8AF10342F198135FD05975B1CBB1D888F656

Uniqueness

Uniqueness Score: -1.00%

Function 0035809D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,004F7DE0,00000000,00000001,00000000), ref: 003580E2
RegQueryValueExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000004), ref: 00358103
RegCloseKey.ADVAPI32(00000000), ref: 00358147

Strings

}O, xrefs: 003580BA, 003580C6

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: }O
API String ID: 3677997916-2562969382
Opcode ID: 2ca1a2155e2a63d9ad9ea0c0bd57c99364199761f49923a5c50786cf89df0c29
Instruction ID: b99959b63b0ffd26fa32aa243664af7e848086c4f00387d235aefc8d6a1663e1
Opcode Fuzzy Hash: 2ca1a2155e2a63d9ad9ea0c0bd57c99364199761f49923a5c50786cf89df0c29
Instruction Fuzzy Hash: B4219F72A10605FFEB11CF91DC45BBEB7B8FB1031BF118459E915B6191EBB4AA48CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00344550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SHCreateDirectoryExW.SHELL32(00000000,005343B0,00000000,?,003414F9,?,?,Adobe_ADMLogs,0000000D,005343B0,00000001,?,?,?,00340F19,?), ref: 0034455A
GetLastError.KERNEL32(?,00000000,?,003414F9,?,?,Adobe_ADMLogs,0000000D,005343B0,00000001,?,?,?,00340F19,?), ref: 00344572
GetLastError.KERNEL32(?,00000000,?,003414F9,?,?,Adobe_ADMLogs,0000000D,005343B0,00000001,?,?,?,00340F19,?), ref: 00344586

Strings

failed to create dir. Error - %d, xrefs: 0034458D

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ErrorLast$CreateDirectory
String ID: failed to create dir. Error - %d
API String ID: 1306683694-3765757136
Opcode ID: 5c486b1d86169dfbff52db9ad0adc9d0deb607e18e8d8167ec9bfa1803d73353
Instruction ID: ac05441f446e8fcd162754c5a25b5e0fba24002b16adf32c1d56e9af92d1411d
Opcode Fuzzy Hash: 5c486b1d86169dfbff52db9ad0adc9d0deb607e18e8d8167ec9bfa1803d73353
Instruction Fuzzy Hash: AEF0A735140204BBDF116FA8DC0ABBE7BD8EF87751F140071FA0DDA592C671A455C795

Uniqueness

Uniqueness Score: -1.00%

Function 00359CDE Relevance: 6.2, APIs: 4, Instructions: 159COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00359CE5
GlobalFix.KERNEL32(00000000), ref: 00359DE7
GlobalUnWire.KERNEL32(00000000), ref: 00359EDD
GlobalFree.KERNEL32(00000000), ref: 00359EE4

Part of subcall function 00372D70: GetStockObject.GDI32(00000011), ref: 00372D92
Part of subcall function 00372D70: GetStockObject.GDI32(0000000D), ref: 00372D9E
Part of subcall function 00372D70: GetObjectW.GDI32(00000000,0000005C,?), ref: 00372DAF
Part of subcall function 00372D70: GetDC.USER32(00000000), ref: 00372DBE
Part of subcall function 00372D70: GetDeviceCaps.GDI32(00000000,0000005A), ref: 00372DD5
Part of subcall function 00372D70: MulDiv.KERNEL32(?,00000048,00000000), ref: 00372DE1
Part of subcall function 00372D70: ReleaseDC.USER32(00000000,00000000), ref: 00372DED

Part of subcall function 00372A4F: GlobalFree.KERNEL32 ref: 00372A56

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Global$Object$FreeStock$CapsDeviceH_prolog3_catchReleaseWire
String ID:
API String ID: 2902530950-0
Opcode ID: c12bffd75d9353ceb704212b926721c36ee488aaba92ec2d54936f1dbe41b45f
Instruction ID: 7436da33c56824f6133d3ef0ffe4495cca19ba36110855a6286c18b7391a6a9d
Opcode Fuzzy Hash: c12bffd75d9353ceb704212b926721c36ee488aaba92ec2d54936f1dbe41b45f
Instruction Fuzzy Hash: FB51803090021ADFCF12DFA4C946FAEBBB4AF58311F15406AEC01BB2A1DB749E15CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0033D780 Relevance: 6.2, APIs: 4, Instructions: 157COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(?), ref: 0033D853
RtlLeaveCriticalSection.NTDLL(?), ref: 0033D85D

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: b85886990fcf6329a3564a3a9de709a8cb7b6aea9d5c330075181a3114b1800d
Instruction ID: 1f992f660f87c90e1d0c4b18787b3c47a48181cb76d77db7f735856ae69a30f8
Opcode Fuzzy Hash: b85886990fcf6329a3564a3a9de709a8cb7b6aea9d5c330075181a3114b1800d
Instruction Fuzzy Hash: CE51D072A00614AFCB16DF94E8C4BAEF7B9FF44310F144559E916AB681D730BD15CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0033BEB0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,MSXML2.DOMDocument.3.0,00000017,00000000,00000000,7D8B83E9,00000000,?,?,?,?,004DDCA0,000000FF,?,0033A169), ref: 0033BEEC
MultiByteToWideChar.KERNEL32(00000000,00000000,MSXML2.DOMDocument.3.0,00000017,-00000008,00000000,?,?,?,?,004DDCA0,000000FF,?,0033A169,?,?), ref: 0033BF59
GetLastError.KERNEL32(?,?,?,004DDCA0,000000FF,?,0033A169,?,?), ref: 0033BF77

Strings

MSXML2.DOMDocument.3.0, xrefs: 0033BEE3, 0033BF50

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: MSXML2.DOMDocument.3.0
API String ID: 1717984340-537116526
Opcode ID: 23879a3d7c87a60e2375de7b32d870ba08cac5b4553172bcf09b5664d5085d3d
Instruction ID: 9a454178e088073597b809b26e0218b4c4d615eb2e560f96322c8627358f77ce
Opcode Fuzzy Hash: 23879a3d7c87a60e2375de7b32d870ba08cac5b4553172bcf09b5664d5085d3d
Instruction Fuzzy Hash: CE313E32D442059BD7229B64CC46BAAF7A4EB40764F15013EFE05E73C0E7749D00CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0036758A Relevance: 6.1, APIs: 4, Instructions: 95COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003675F9
CreateSolidBrush.GDI32(?), ref: 00367614
__EH_prolog3.LIBCMT ref: 0036763D
GetDC.USER32(00000000), ref: 00367669

Part of subcall function 002E03E0: FindResourceW.KERNEL32(?,?,00000006), ref: 002E03F8

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: H_prolog3$BrushCreateFindResourceSolid
String ID:
API String ID: 3647720930-0
Opcode ID: 1bb96eeeeaa3d78ca421e2b383161f60d209f05cecf12c10b436be54af6b9f64
Instruction ID: 56c7930d2171423580b737c74ff3d13ed4aa366c2851070bb69d12861517bce7
Opcode Fuzzy Hash: 1bb96eeeeaa3d78ca421e2b383161f60d209f05cecf12c10b436be54af6b9f64
Instruction Fuzzy Hash: 203106B16006119FCB25EF69D805B6F77E8EF08715B50C52EF609CB206EB74E900CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 003A5C74 Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

VerSetConditionMask.NTDLL(00000000,00000000,00000002,00000003), ref: 003A5CD1
VerSetConditionMask.NTDLL(00000000), ref: 003A5CD9
VerifyVersionInfoW.KERNEL32(0000011C,00000003,00000000), ref: 003A5CEA
GetSystemMetrics.USER32(00001000), ref: 003A5CFB

Part of subcall function 003A646A: __EH_prolog3.LIBCMT ref: 003A6471
Part of subcall function 003A646A: GetSysColor.USER32(00000016), ref: 003A647A
Part of subcall function 003A646A: GetSysColor.USER32(0000000F), ref: 003A648D
Part of subcall function 003A646A: GetSysColor.USER32(00000015), ref: 003A64A4
Part of subcall function 003A646A: GetSysColor.USER32(0000000F), ref: 003A64B0
Part of subcall function 003A646A: GetDeviceCaps.GDI32(00000014,0000000C), ref: 003A64D8
Part of subcall function 003A646A: GetSysColor.USER32(0000000F), ref: 003A64E6
Part of subcall function 003A646A: GetSysColor.USER32(00000010), ref: 003A64F4
Part of subcall function 003A646A: GetSysColor.USER32(00000015), ref: 003A6502
Part of subcall function 003A646A: GetSysColor.USER32(00000016), ref: 003A6510
Part of subcall function 003A646A: GetSysColor.USER32(00000014), ref: 003A651E
Part of subcall function 003A646A: GetSysColor.USER32(00000012), ref: 003A652C
Part of subcall function 003A646A: GetSysColor.USER32(00000011), ref: 003A653A
Part of subcall function 003A646A: GetSysColor.USER32(00000006), ref: 003A6545
Part of subcall function 003A646A: GetSysColor.USER32(0000000D), ref: 003A6550
Part of subcall function 003A646A: GetSysColor.USER32(0000000E), ref: 003A655B
Part of subcall function 003A646A: GetSysColor.USER32(00000005), ref: 003A6566
Part of subcall function 003A646A: GetSysColor.USER32(00000008), ref: 003A6574
Part of subcall function 003A646A: GetSysColor.USER32(00000009), ref: 003A657F
Part of subcall function 003A646A: GetSysColor.USER32(00000007), ref: 003A658A
Part of subcall function 003A646A: GetSysColor.USER32(00000002), ref: 003A6595
Part of subcall function 003A646A: GetSysColor.USER32(00000003), ref: 003A65A0
Part of subcall function 003A646A: GetSysColor.USER32(0000001B), ref: 003A65AE
Part of subcall function 003A646A: GetSysColor.USER32(0000001C), ref: 003A65BC
Part of subcall function 003A646A: GetSysColor.USER32(0000000A), ref: 003A65CA

Part of subcall function 003A5F39: __EH_prolog3_GS.LIBCMT ref: 003A5F43
Part of subcall function 003A5F39: GetDeviceCaps.GDI32(?,00000058), ref: 003A5F63
Part of subcall function 003A5F39: DeleteObject.GDI32(00000000), ref: 003A5FCD
Part of subcall function 003A5F39: DeleteObject.GDI32(00000000), ref: 003A5FEB
Part of subcall function 003A5F39: DeleteObject.GDI32(00000000), ref: 003A6009
Part of subcall function 003A5F39: DeleteObject.GDI32(00000000), ref: 003A6027
Part of subcall function 003A5F39: DeleteObject.GDI32(00000000), ref: 003A6045
Part of subcall function 003A5F39: DeleteObject.GDI32(00000000), ref: 003A6063
Part of subcall function 003A5F39: DeleteObject.GDI32(00000000), ref: 003A6081

Part of subcall function 003A5D59: GetSystemMetrics.USER32(00000031), ref: 003A5D67
Part of subcall function 003A5D59: GetSystemMetrics.USER32(00000032), ref: 003A5D75
Part of subcall function 003A5D59: SetRectEmpty.USER32(005750FC), ref: 003A5D88
Part of subcall function 003A5D59: EnumDisplayMonitors.USER32(00000000,00000000,003A5BF1,005750FC), ref: 003A5D98
Part of subcall function 003A5D59: SystemParametersInfoW.USER32(00000030,00000000,005750FC,00000000), ref: 003A5DA7
Part of subcall function 003A5D59: SystemParametersInfoW.USER32(00001002,00000000,00575120,00000000), ref: 003A5DD4
Part of subcall function 003A5D59: SystemParametersInfoW.USER32(00001012,00000000,00575124,00000000), ref: 003A5DE8
Part of subcall function 003A5D59: SystemParametersInfoW.USER32(0000100A,00000000,00575134,00000000), ref: 003A5E0E

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Color$DeleteObjectSystem$Info$Parameters$Metrics$CapsConditionDeviceMask$DisplayEmptyEnumH_prolog3H_prolog3_MonitorsRectVerifyVersion
String ID:
API String ID: 551326122-0
Opcode ID: c8809e789e1611962f6a05b82c9f23b53e9b118ae4f35202a9eb336cd8866cb7
Instruction ID: a1017ca100cd1021a87dff8e49fd5975638e5fd10fb98c064429cd116c30e0ea
Opcode Fuzzy Hash: c8809e789e1611962f6a05b82c9f23b53e9b118ae4f35202a9eb336cd8866cb7
Instruction Fuzzy Hash: 0111A7B1A00218ABD7159F71AC4AFEA76BCEB89704F00446EB645D6181DAB44A448B90

Uniqueness

Uniqueness Score: -1.00%

Function 0033A000 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 0033A05D
SysFreeString.OLEAUT32(-00000001), ref: 0033A08A

Strings

`<u, xrefs: 0033A08A

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: FreeString_com_issue_errorex
String ID: `<u
API String ID: 3379521860-3367579956
Opcode ID: e8629e757973bc32ee9a621c81ca53dbda3d7a0a693118bce1fd7957e8a8d599
Instruction ID: c6ad81d28d8819a166fd213510688c97cd777e242353c8f4d678629ed33c5dbf
Opcode Fuzzy Hash: e8629e757973bc32ee9a621c81ca53dbda3d7a0a693118bce1fd7957e8a8d599
Instruction Fuzzy Hash: 2021D4B1A00A14ABDB25DF25CC84B6BB7E8EF04724F01462EF865D7290E774E804CA95

Uniqueness

Uniqueness Score: -1.00%

Function 00357EED Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

Part of subcall function 0036D567: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,00357F16,#r5,00000003,?,00000004,#r5), ref: 0036D579
Part of subcall function 0036D567: GetProcAddress.KERNEL32(00000000,GetLocaleInfoEx), ref: 0036D589
Part of subcall function 0036D567: RtlEncodePointer.NTDLL(00000000), ref: 0036D592
Part of subcall function 0036D567: GetLocaleInfoEx.KERNEL32(?,00357F16,#r5,00000003,?,00000004,#r5), ref: 0036D5C0

__snprintf_s.LIBCMT ref: 00357F4B

Strings

#r5, xrefs: 00357F00, 00357F10
#r5, xrefs: 00357F07

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: AddressEncodeHandleInfoLocaleModulePointerProc__snprintf_s
String ID: #r5$#r5
API String ID: 2832596985-317946052
Opcode ID: 9692f6196bb8d2baba20b9f8991f7cadfb9990b0c8f77ef0f64454a7ec104470
Instruction ID: 6ed72050571d1b6d6bf6550e8e51fb39e9af1dc8dff9845b7cf3791455d7b120
Opcode Fuzzy Hash: 9692f6196bb8d2baba20b9f8991f7cadfb9990b0c8f77ef0f64454a7ec104470
Instruction Fuzzy Hash: A0118B72D04118AEDF12BFA5DC46FA9736CAF15715F0004A5FE01AB0A1E6749A188BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00357FEF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

__snprintf_s.LIBCMT ref: 00358032

Strings

Cr5, xrefs: 00358004, 00358019
LOC, xrefs: 00358014

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: __snprintf_s
String ID: Cr5$LOC
API String ID: 3587532853-155198603
Opcode ID: f4f0587e7aeb8d3143e80fc5532d027615b95f718c20f3abe0268e1e67643b67
Instruction ID: db0b0c207371b715dd148a46af98e6fd772f316c175201a0393414e7e0087855
Opcode Fuzzy Hash: f4f0587e7aeb8d3143e80fc5532d027615b95f718c20f3abe0268e1e67643b67
Instruction Fuzzy Hash: 8B11C67290010CBACB227BE5DC46EE937A89B15325F0109A6FA01BF0E1ED74DD4C5B95

Uniqueness

Uniqueness Score: -1.00%

Function 0035EB16 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0035EB1D
GetModuleFileNameW.KERNEL32(?,00000000,00000208,00000008,0035F055,?,00000066), ref: 0035EB51

Part of subcall function 0035ECB9: __EH_prolog3.LIBCMT ref: 0035ECC0
Part of subcall function 0035ECB9: VariantClear.OLEAUT32(?), ref: 0035ED6D
Part of subcall function 0035ECB9: VariantClear.OLEAUT32(?), ref: 0035ED77
Part of subcall function 0035ECB9: VariantClear.OLEAUT32(?), ref: 0035ED81
Part of subcall function 0035ECB9: VariantClear.OLEAUT32(?), ref: 0035ED8B
Part of subcall function 0035ECB9: SysFreeString.OLEAUT32(002E0ED4), ref: 0035ED94

Strings

res://%Ts/%d, xrefs: 0035EB62

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ClearVariant$H_prolog3$FileFreeModuleNameString
String ID: res://%Ts/%d
API String ID: 2962255879-1604331681
Opcode ID: 87defa7f6b1d27cf258864709291f82a03eaf0b1ff8b29e0da2002c60e495675
Instruction ID: 949b1485e03441989da4429600290f88823c5e23198c75c13d91035f812eb47f
Opcode Fuzzy Hash: 87defa7f6b1d27cf258864709291f82a03eaf0b1ff8b29e0da2002c60e495675
Instruction Fuzzy Hash: C50184716012189FDB01EB608C56EBF7674EF40315F15442DF951AF152DB749E098B61

Uniqueness

Uniqueness Score: -1.00%

Function 003578B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104), ref: 003578DD
PathFindExtensionW.SHLWAPI(?), ref: 003578F3

Part of subcall function 0035718F: __EH_prolog3_GS.LIBCMT ref: 00357199

Strings

%Ts%Ts.dll, xrefs: 00357900

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ExtensionFileFindH_prolog3_ModuleNamePath
String ID: %Ts%Ts.dll
API String ID: 3433622546-1896370695
Opcode ID: 6d9827e34e76d8b576b7d0405c988b0f004369b49006331fcd45a98feaf7cc52
Instruction ID: 1a661ee3804081ab1bfae8080dfd2a4280fa57b1f54ad33d72dfdaa5e9c30253
Opcode Fuzzy Hash: 6d9827e34e76d8b576b7d0405c988b0f004369b49006331fcd45a98feaf7cc52
Instruction Fuzzy Hash: 2F016231900119ABCB12EBA4EC45EEF77FCEF48301F0100B6E506D7051E774AA09CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0033FD80 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

Part of subcall function 0033FDF0: GetTempPathW.KERNEL32(00000104,?,7D8B83E9,75B05EE0,?), ref: 0033FE5B
Part of subcall function 0033FDF0: PathFileExistsW.SHLWAPI(?,.trace,?,?,?), ref: 0033FF22
Part of subcall function 0033FDF0: PathFileExistsW.SHLWAPI(?,?,?,.debug), ref: 0033FF85

RtlInitializeCriticalSection.NTDLL(00000074), ref: 0033FDDD

Strings

| , xrefs: 0033FD85
OOBE.log, xrefs: 0033FD94

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Path$ExistsFile$CriticalInitializeSectionTemp
String ID: | $OOBE.log
API String ID: 2430562486-2809318793
Opcode ID: 76645c3893045c4f5bcc1991877dbf56f7b3daaba516ef0dfda7a880d2fe4b7e
Instruction ID: be04c09a7a81131fccb47889bb6c09dec8ed810cd2a35c8fe1927e19079af3cf
Opcode Fuzzy Hash: 76645c3893045c4f5bcc1991877dbf56f7b3daaba516ef0dfda7a880d2fe4b7e
Instruction Fuzzy Hash: 41F05E30190B109EE321DB64E82ABD67BE46F10705F41481DA1C2577D2CBF07808CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00356618 Relevance: 4.5, APIs: 3, Instructions: 46windowCOMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(00000030,00000000,00000000,00000000), ref: 00356551
TranslateMessage.USER32(00000030), ref: 00356570
DispatchMessageW.USER32(00000030), ref: 00356577

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Message$CallbackDispatchDispatcherTranslateUser
String ID:
API String ID: 2960505505-0
Opcode ID: 4a773b01f98816e6ca59f579994fe04c7291e476debb9bfff6f80fa77d1f660a
Instruction ID: 8f3ca35512af7daeef330ef8f9e5e0b4d6d7af23a5b3a7ed1ef306c00af08031
Opcode Fuzzy Hash: 4a773b01f98816e6ca59f579994fe04c7291e476debb9bfff6f80fa77d1f660a
Instruction Fuzzy Hash: 27F0A4323014105B87136B34BD05DBF77ADFF823523464026FC01D7524EB249A4AABA1

Uniqueness

Uniqueness Score: -1.00%

Function 0033E740 Relevance: 4.5, APIs: 3, Instructions: 43fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000002), ref: 0033E768
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 0033E78A
WriteFile.KERNEL32(?,0053249C,00000004,00000000,00000000), ref: 0033E7A3

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: File$Write$Pointer
String ID:
API String ID: 2567243663-0
Opcode ID: 646b8c3bfe4902d6031ac1ba5ee580438793fcae0cbe429b868a6a780d606fc1
Instruction ID: f22823b41f2daa2763742001e27ca28e421a57908152f1ad8361f9c996001125
Opcode Fuzzy Hash: 646b8c3bfe4902d6031ac1ba5ee580438793fcae0cbe429b868a6a780d606fc1
Instruction Fuzzy Hash: 8A013176940218BBDB209F80CC46FAA7F6CEB04750F1141A5BE0477291D6B16E50DBE4

Uniqueness

Uniqueness Score: -1.00%

Function 0035718F Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00357199

Part of subcall function 002E21E0: FindResourceW.KERNEL32(00000000,002DFE4B,00000006,002DFE4A), ref: 002E2264
Part of subcall function 002E21E0: LoadResource.KERNEL32(00000000,00000000), ref: 002E2277
Part of subcall function 002E21E0: LockResource.KERNEL32(00000000), ref: 002E2286
Part of subcall function 002E21E0: SizeofResource.KERNEL32(?,?), ref: 002E229C

Part of subcall function 0036D5E0: GetModuleHandleW.KERNEL32(kernel32.dll,?,?,?,?,?,00000108,0035791D,?,?), ref: 0036D613
Part of subcall function 0036D5E0: GetProcAddress.KERNEL32(00000000,GetThreadPreferredUILanguages), ref: 0036D623
Part of subcall function 0036D5E0: RtlEncodePointer.NTDLL(00000000), ref: 0036D62C

Strings

y, xrefs: 003571EB

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Resource$AddressEncodeFindH_prolog3_HandleLoadLockModulePointerProcSizeof
String ID: y
API String ID: 3122441387-4225443349
Opcode ID: 071fa1d30951ac97c2e1092f0bb3c46acdeca964821c553bee40f5d041237372
Instruction ID: 61af31d8b2d939123774e528144ca30f31315bbf97b6e11af43c5bdc1f7fb549
Opcode Fuzzy Hash: 071fa1d30951ac97c2e1092f0bb3c46acdeca964821c553bee40f5d041237372
Instruction Fuzzy Hash: 98215E72C041289BDF22EB54DC42BDD7778AF24314F0042D5FA88A6191DBB45FC88F91

Uniqueness

Uniqueness Score: -1.00%

Function 00338D00 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001C,00000000,?), ref: 00338D23

Strings

\Adobe, xrefs: 00338D3E

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: FolderPathSpecial
String ID: \Adobe
API String ID: 994120019-851535981
Opcode ID: 76cb5512e5dfd50003a75981699215d73a9b366557dbca44845d6c8bb1063e3a
Instruction ID: 042c63f85ba4b149c473f901d6d511756764adfe484ad3af11afb5e12c4e29c8
Opcode Fuzzy Hash: 76cb5512e5dfd50003a75981699215d73a9b366557dbca44845d6c8bb1063e3a
Instruction Fuzzy Hash: 2301D870A0020C6BCB10EF649C4ABEA73BCDF44744F4041EAE805D72C2FAB09E088A84

Uniqueness

Uniqueness Score: -1.00%

Function 0036C407 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0036C40E

Part of subcall function 0036BEF5: TlsAlloc.KERNEL32(?,0036C43A,00000004,00369CB2,00356155,00367584,002E1FC2,00000001,?,?,?,?,?,00000001,?,?), ref: 0036BF14
Part of subcall function 0036BEF5: RtlInitializeCriticalSection.NTDLL(00574C80), ref: 0036BF25

Strings

dLW, xrefs: 0036C421, 0036C43E, 0036C454, 0036C472

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: AllocCriticalH_prolog3InitializeSection
String ID: dLW
API String ID: 2369468792-425492144
Opcode ID: 8a2050e0ff0271ea3aa3635fa22ed18eb3298a469ce5294cecefb8ec47ff92d5
Instruction ID: 840e98257ae4985fd30b1566abd40a4fc50d1b6c0527a699907f29b655f468a0
Opcode Fuzzy Hash: 8a2050e0ff0271ea3aa3635fa22ed18eb3298a469ce5294cecefb8ec47ff92d5
Instruction Fuzzy Hash: 3101B1706212029BDF13EF7AD82967D3A64AF50354B11D138A848CF296DF34CD80DB94

Uniqueness

Uniqueness Score: -1.00%

Function 003581A9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CreateActCtxWWorker.KERNEL32(?,00358560,00000020), ref: 003581E7

Part of subcall function 003583AC: DeactivateActCtx.KERNEL32(?,00358210,004F7A78,00572F2C,DeactivateActCtx,00000000,?,00366285,00000000,00000000,0036623B,?,?,00000000), ref: 003583CD
Part of subcall function 003583AC: GetProcAddress.KERNEL32(00000000,00366285), ref: 003583DA

Strings

CreateActCtxW, xrefs: 003581B7

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: AddressCreateDeactivateProcWorker
String ID: CreateActCtxW
API String ID: 1192707186-1163823230
Opcode ID: 7c4637a223a56bc513d9a52f7e5fafffb41a70a56fc9e15e9b63324eb460fc5b
Instruction ID: 30e10a4707f6c4bed886365addf834edceda98b6b8ac082d2eee50a0747f4d97
Opcode Fuzzy Hash: 7c4637a223a56bc513d9a52f7e5fafffb41a70a56fc9e15e9b63324eb460fc5b
Instruction Fuzzy Hash: 7FE02631A45A346706232B65AC02D2F3E249A51BB2B020212FD04772F1CE604E15ABCA

Uniqueness

Uniqueness Score: -1.00%

Function 002E8580 Relevance: 3.1, APIs: 2, Instructions: 77COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 002E85B1
std::_Lockit::~_Lockit.LIBCPMT ref: 002E8664

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: std::_$Locinfo::_Locinfo_dtorLockitLockit::~_
String ID:
API String ID: 3286764726-0
Opcode ID: 4458abcfe9b3b15a0e3da16406853fdaf4904a9663ac1f3e90d3c9b7dfcec76a
Instruction ID: 5e7da86f4641ece3679c81049ed8457743aa78cabaee929c3890b42809a4e179
Opcode Fuzzy Hash: 4458abcfe9b3b15a0e3da16406853fdaf4904a9663ac1f3e90d3c9b7dfcec76a
Instruction Fuzzy Hash: A621E6F1E007819BEB21DF66C90974BB7ECAB12718F04455DE44997380EB79EA04CB96

Uniqueness

Uniqueness Score: -1.00%

Function 004C13C0 Relevance: 3.1, APIs: 2, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

FindCloseChangeNotification.KERNEL32(00000000,?,00000000,?,004C13AF,004CCB40,?,00000000,00000000), ref: 004C1416
GetLastError.KERNEL32(?,00000000,?,004C13AF,004CCB40,?,00000000,00000000), ref: 004C1420

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: 7dbe679e63546cfc15c95a25d3858c1c2ae71e37350f6380ceae19c4288642bb
Instruction ID: 8e7e0b8aca5618cb96be7af331558a0848d0a8605adfa1ac68195eb63432a0ab
Opcode Fuzzy Hash: 7dbe679e63546cfc15c95a25d3858c1c2ae71e37350f6380ceae19c4288642bb
Instruction Fuzzy Hash: A311593761811016D66826756885F7E27499B83738F28025FFC18962F3DE69D882826D

Uniqueness

Uniqueness Score: -1.00%

Function 00364D27 Relevance: 3.1, APIs: 2, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 00366A15: GetWindowLongW.USER32(?,000000F0), ref: 00366A22

GetWindowRect.USER32(?,?), ref: 00364D68
GetWindow.USER32(?,00000004), ref: 00364D85

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Window$LongRect
String ID:
API String ID: 463821813-0
Opcode ID: cad711b30bf1055361a5868422145a57512cb6d9f35fe386f5b750081777882f
Instruction ID: d4a4e48c815556490dc15043a42b884405fb79371a97e09984fe012f9abba7d6
Opcode Fuzzy Hash: cad711b30bf1055361a5868422145a57512cb6d9f35fe386f5b750081777882f
Instruction Fuzzy Hash: 81119070F002099BCF06EFA9C881ABEB7B9BF59354F51C569E806E7245DB70ED009B50

Uniqueness

Uniqueness Score: -1.00%

Function 004C3C15 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,?,00008000,004C120D,00008000,004C120D,?,?,?,004C3D1F,004C120D,74DF0900,00000000,004C120D,?), ref: 004C3C51
GetLastError.KERNEL32(00000000,?,?,?,004C3D1F,004C120D,74DF0900,00000000,004C120D,?,00000000,00008000,004C120D,?,?,004CC96A), ref: 004C3C5E

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 254c89b5b638bea4002a03d629fa670d696dc66a10b16c331a7ecd2d7cb34ae8
Instruction ID: a94d5b844045a7407526870bb7bb469389388c6d1f7f71bdde1de6be9b509624
Opcode Fuzzy Hash: 254c89b5b638bea4002a03d629fa670d696dc66a10b16c331a7ecd2d7cb34ae8
Instruction Fuzzy Hash: 49018E37614208AFCB048F59DC09DAE3B29DB80324B24410EF811A72D1EA75DE51CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0035BE20 Relevance: 3.0, APIs: 2, Instructions: 44comCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0035BE27
OleInitialize.OLE32(00000000), ref: 0035BE4A

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: H_prolog3Initialize
String ID:
API String ID: 3221705332-0
Opcode ID: fd11fe1ac35bb4fb75a47caf406bb07a482ca3e6f0268bfba04b9fc0ca06f986
Instruction ID: 3bf6ba0aed7489de7e894a8ed7b5f3fcb3fefa8fe2c3af7e5eaf01315edd52f8
Opcode Fuzzy Hash: fd11fe1ac35bb4fb75a47caf406bb07a482ca3e6f0268bfba04b9fc0ca06f986
Instruction Fuzzy Hash: 7A01D470A007119BCB27BB74980BB9FB9A8BF40721F040236EA15CB1B2DB399509C795

Uniqueness

Uniqueness Score: -1.00%

Function 00366FF0 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00366FFF
SetWindowTextW.USER32(?,?), ref: 0036701B

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Window$Text
String ID:
API String ID: 848690642-0
Opcode ID: addc53409d9d2aa3bb7a4c4d38411d8cc5e33be81a7d8aeefdc75a92ca1c5f84
Instruction ID: 2385b4402a87d06ca798b6285293738b55b5d945d36f27a65a0e391fff7de6b8
Opcode Fuzzy Hash: addc53409d9d2aa3bb7a4c4d38411d8cc5e33be81a7d8aeefdc75a92ca1c5f84
Instruction Fuzzy Hash: E4F0E236204906AFCB125F21DC88929BB79FFA43697518136E50983A35DB729C64EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 004BF8F8 Relevance: 3.0, APIs: 2, Instructions: 22memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(00000000,00000000,?,004C8309,?,00000000,?,?,004C85AA,?,00000007,?,?,004C8B05,?,?), ref: 004BF90E
GetLastError.KERNEL32(?,?,004C8309,?,00000000,?,?,004C85AA,?,00000007,?,?,004C8B05,?,?), ref: 004BF919

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ErrorFreeHeapLast
String ID:
API String ID: 485612231-0
Opcode ID: 1d3b6edd7dc19552b840ee71685e12547f3ea2dd73be4db4531dbd68cb4a9972
Instruction ID: be745a988bc197a1422a09c7c2cd31f329d3638762a2db6fcd3b6513ca57a9a5
Opcode Fuzzy Hash: 1d3b6edd7dc19552b840ee71685e12547f3ea2dd73be4db4531dbd68cb4a9972
Instruction Fuzzy Hash: 09E0CD32104214BBDB112FE5FC0C7953B59AB54359F004035F70CD6171D638D855CB9C

Uniqueness

Uniqueness Score: -1.00%

Function 0970A0F4 Relevance: 3.0, Instructions: 2977COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907130948.0000000009707000.00000010.00000800.00020000.00000000.sdmp, Offset: 09707000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9707000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84a7bc5419860c94a321f7706a20cb58aa85b8352ba73d3f9a956dfd8071777f
Instruction ID: 08dfa15f6c500dc4611e0b9ba58fa71d75d9040518abb9183aea1cf420f4ede2
Opcode Fuzzy Hash: 84a7bc5419860c94a321f7706a20cb58aa85b8352ba73d3f9a956dfd8071777f
Instruction Fuzzy Hash: A833CD72E04304DFDB24CE64C8A2BAAB7E4AFC4758F19455DE84AAB3C1D7B49D40CB91

Uniqueness

Uniqueness Score: -1.00%

Function 097036D0 Relevance: 2.9, Instructions: 2936COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2442659405.0000000009703000.00000004.00000800.00020000.00000000.sdmp, Offset: 09703000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_9703000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed35c599786c922159c7d741964a553f1a3311c3d954c701492f41d90af68da6
Instruction ID: 2ab585f815aa05e46f670d29da91fdb060284d80d81df594a26a5cf51e467261
Opcode Fuzzy Hash: ed35c599786c922159c7d741964a553f1a3311c3d954c701492f41d90af68da6
Instruction Fuzzy Hash: EB330F72E04304DBDB20CF65C8A2BAAB3E1ABC4758F14455DF946AB3C1E7B4AC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 004AD5B0 Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5759b38852dd3b13d65e4348250d0163e0d2d7b4cb78ed43d894f85614cd4cc4
Instruction ID: 10f9e2d6ec9158dc45f60f9f69014136be51202d765201754096ca55acc53d03
Opcode Fuzzy Hash: 5759b38852dd3b13d65e4348250d0163e0d2d7b4cb78ed43d894f85614cd4cc4
Instruction Fuzzy Hash: 8151D574E00108AFDF15CF58CC85AAA7BB1EFAA314F248159F80A9B352D335DE41CB94

Uniqueness

Uniqueness Score: -1.00%

Function 002E2BB0 Relevance: 1.6, APIs: 1, Instructions: 136COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 002E2D00

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 3379d8afca76cd0a44bcd3cfd33cea7392d95cabee6995a879a79856c43fa8f6
Instruction ID: 78a1772f0deab1f58a6fdc14a2f0e4953ac6330794042c80b5766e2647e1545e
Opcode Fuzzy Hash: 3379d8afca76cd0a44bcd3cfd33cea7392d95cabee6995a879a79856c43fa8f6
Instruction Fuzzy Hash: BB412772A10155EBCB05DF6DCC80AAEB7AAFF49300F65026AF806D7301D730DE269B95

Uniqueness

Uniqueness Score: -1.00%

Function 0035EF31 Relevance: 1.6, APIs: 1, Instructions: 128COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 0035EF5C

Part of subcall function 00366FF0: IsWindow.USER32(?), ref: 00366FFF
Part of subcall function 00366FF0: SetWindowTextW.USER32(?,?), ref: 0036701B

Part of subcall function 0035EB16: __EH_prolog3.LIBCMT ref: 0035EB1D
Part of subcall function 0035EB16: GetModuleFileNameW.KERNEL32(?,00000000,00000208,00000008,0035F055,?,00000066), ref: 0035EB51

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Window$ClientFileH_prolog3ModuleNameRectText
String ID:
API String ID: 563636132-0
Opcode ID: 51c22e0b6e9aa97f9924a5a827e38bfad142b304a6576596045fb2adde27ac6b
Instruction ID: 81fbf1e7c4f83eba2609d0ae6ab15377385cb407b07a4af577874a3bd8538934
Opcode Fuzzy Hash: 51c22e0b6e9aa97f9924a5a827e38bfad142b304a6576596045fb2adde27ac6b
Instruction Fuzzy Hash: C3419170300615AFDB0AEB30DC51F7E7769BF88305F040169E906DB2E2DF64AE199BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0035FA18 Relevance: 1.6, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0035FA1F

Part of subcall function 0036C407: __EH_prolog3.LIBCMT ref: 0036C40E

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: H_prolog3H_prolog3_catch_
String ID:
API String ID: 863784098-0
Opcode ID: 1b6075b545930da65fab12952c5d65c1bff848dacc71709810cf7f3a6f280378
Instruction ID: b02f06e26e4cce011d3fcb2a8ab0cd385379206e0efb845996148e4aae8b8985
Opcode Fuzzy Hash: 1b6075b545930da65fab12952c5d65c1bff848dacc71709810cf7f3a6f280378
Instruction Fuzzy Hash: 47312475E0020EDFCF05DFA4C8919EEBBB5BF88315F14406AE901AB361C774A954CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0033D030 Relevance: 1.6, APIs: 1, Instructions: 67threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0006D0C0,00000000,00000000,00000000), ref: 0033D07A

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: ba81ef55e941c919f2587171e4b9438f2584902858d6bbfa899cc785e5d1066c
Instruction ID: c980babdc22e14a56d95fc195888ec95c4ec7a0bf786e0fcea49d09e8a4d0b4a
Opcode Fuzzy Hash: ba81ef55e941c919f2587171e4b9438f2584902858d6bbfa899cc785e5d1066c
Instruction Fuzzy Hash: 8811C672A82314ABD7358F65AC41B9AFBD8EF51F60F11416FEC489B340D5729816C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 00357750 Relevance: 1.6, APIs: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,0000036A,00000000,00000000), ref: 00357771

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 4927d3fd4732f30c9503fe467698a62badc9467ba6ddb728fd11add20bf3cd5d
Instruction ID: f8aa86777fe0228dec107656febee1b8b8740652eee56739d3d938f0fcf5922c
Opcode Fuzzy Hash: 4927d3fd4732f30c9503fe467698a62badc9467ba6ddb728fd11add20bf3cd5d
Instruction Fuzzy Hash: A91181792041149FCB169F58E84487D7BB5FF9872171580BAED09C7361DB309C15DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0033C000 Relevance: 1.6, APIs: 1, Instructions: 61comCOMMON

Download Yara Rule

APIs

OleRun.OLE32(?), ref: 0033C060

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50675133e37f8eac57553d9995ca0c3f04b9c6f53978c9d1fb2cc0635739204d
Instruction ID: bfb0d61b1539015bfdedb3baa29d4dc23e3dbf982aeda53f46f0cb1079bea2c7
Opcode Fuzzy Hash: 50675133e37f8eac57553d9995ca0c3f04b9c6f53978c9d1fb2cc0635739204d
Instruction Fuzzy Hash: 12113A71A44655EFD715CF58CC44F6ABBB8FB49B20F104269E811E7390DB71AC10CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 004C1251 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 004C1208

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 67cc45aa37e2c2bb0d755e59ccb63087d6c710fa92bfbb301f60830ccb28b5c6
Instruction ID: 207caf851fa2376838e5dbec2da1214c9a0ebee38d7b0ae075736cf8c5800afc
Opcode Fuzzy Hash: 67cc45aa37e2c2bb0d755e59ccb63087d6c710fa92bfbb301f60830ccb28b5c6
Instruction Fuzzy Hash: A2116D75A0420AAFCB05DF58E941E9B7BF8EF49304F14405AF808E7311D630ED11CB65

Uniqueness

Uniqueness Score: -1.00%

Function 003577F8 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003577FF

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 40717dcd828f6186c3ff6bd8d0927ae6cc6fc659e39bca601404f27b2075aada
Instruction ID: 37f56af2ae3ac6646310f046b43b5cedb54a635ce1b6db145ec4bde56306d89d
Opcode Fuzzy Hash: 40717dcd828f6186c3ff6bd8d0927ae6cc6fc659e39bca601404f27b2075aada
Instruction Fuzzy Hash: DA114A347001208FCB05EB64C8A8B7C37A5AF98705F0940BAE906DB3A6CF746C09CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00374935 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

CopyRect.USER32(?,?), ref: 00374968

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CopyRect
String ID:
API String ID: 1989077687-0
Opcode ID: 56b9849680a5f8df3258436788235af13eab60b13e6d0b8b1d5486b805c0f3b7
Instruction ID: 2efa751fddf5a6d0ef9bcc3b83d45a3043a721aa5da7ad42f43ff0bacf748178
Opcode Fuzzy Hash: 56b9849680a5f8df3258436788235af13eab60b13e6d0b8b1d5486b805c0f3b7
Instruction Fuzzy Hash: 74118D76A0020DAF8F05CFA9D9858EEBBF9FB4C314B10412AE919E3210D734A915DFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00364653 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 0036468D

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Parent
String ID:
API String ID: 975332729-0
Opcode ID: 9460771140e216bd04c7ea94ca5c002ecc80ac9b22e725b57bb9b4ca8b469395
Instruction ID: ae9fafb518c59ddd0c0cdd5e2c13f27badb914250f3d5f4daf67ddbbcdc19db4
Opcode Fuzzy Hash: 9460771140e216bd04c7ea94ca5c002ecc80ac9b22e725b57bb9b4ca8b469395
Instruction Fuzzy Hash: C0F0E936700106AB8B029B65DC4497EB76DEFE7765716C036EC0AC7304DBB0EC0196A0

Uniqueness

Uniqueness Score: -1.00%

Function 0035A6D1 Relevance: 1.5, APIs: 1, Instructions: 38COMMON

Download Yara Rule

APIs

CreateDialogIndirectParamW.USER32(?,00000000,?,00000000,00359ADF), ref: 0035A71E

Part of subcall function 00358331: OutputDebugStringA.KERNEL32(IsolationAware function called after IsolationAwareCleanup,00000105,?,00366212,00000000,00559478,00000010,00360B0A,?,?,?,00000000), ref: 00358345

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CreateDebugDialogIndirectOutputParamString
String ID:
API String ID: 3066322445-0
Opcode ID: 79ef00c7397ae6b41d8b943c375072627b146d657f139082f055ecab29519af5
Instruction ID: edf3fd1b79d27c09041f9ce90a75390d55f7dd54e32dde46b82090e83fe8651a
Opcode Fuzzy Hash: 79ef00c7397ae6b41d8b943c375072627b146d657f139082f055ecab29519af5
Instruction Fuzzy Hash: 6A0169329007099FDF229FE5DC05BAD7BB0FB18366F01852AE911A11A0C779C958FF61

Uniqueness

Uniqueness Score: -1.00%

Function 0035827D Relevance: 1.5, APIs: 1, Instructions: 36libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(?,?,00000000,00558900,00000010,00360AA8,?,00000000,00000800,?,00000000), ref: 003582C4

Part of subcall function 00358331: OutputDebugStringA.KERNEL32(IsolationAware function called after IsolationAwareCleanup,00000105,?,00366212,00000000,00559478,00000010,00360B0A,?,?,?,00000000), ref: 00358345

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: DebugLibraryLoadOutputString
String ID:
API String ID: 137895185-0
Opcode ID: 1372bf12aa5e682891b74a273685fe089f35062bc2dadae5e0d5cf203341a945
Instruction ID: e6267cc1f6b1c0c2aba378e400db362c129c5d0e1ae79ee5b205b4a971ba4dde
Opcode Fuzzy Hash: 1372bf12aa5e682891b74a273685fe089f35062bc2dadae5e0d5cf203341a945
Instruction Fuzzy Hash: EA018C72A00609DFDF229FA8D805BAD7BB4FB14367F01882AE811A12A0DB788548DF11

Uniqueness

Uniqueness Score: -1.00%

Function 004BFFC4 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000001,?), ref: 004BFFF6

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 74a50977b6a4c917182f23d8cc028b0df6bc73595f99b00f24d742667e836904
Instruction ID: 94bbb5f8d16ca4b66bf06c159242f6210e68d64a36f33c3619320bde975f8442
Opcode Fuzzy Hash: 74a50977b6a4c917182f23d8cc028b0df6bc73595f99b00f24d742667e836904
Instruction Fuzzy Hash: 61E0E539204224A6D6702663BC05FBB3748AF527A8F02012BBD0D966C2CA28CC0196BD

Uniqueness

Uniqueness Score: -1.00%

Function 00366B01 Relevance: 1.5, APIs: 1, Instructions: 27windowCOMMON

Download Yara Rule

APIs

IsDialogMessageW.USER32(?,?), ref: 00366B39

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: DialogMessage
String ID:
API String ID: 547518314-0
Opcode ID: b015f9aa9e9f11629d8874a28069243108bbf5db841274394e8a1241ab1df1d6
Instruction ID: 49c7eb2eeeee9019b025fc6482d82946703ab406f74f4c4583626633aa27dc70
Opcode Fuzzy Hash: b015f9aa9e9f11629d8874a28069243108bbf5db841274394e8a1241ab1df1d6
Instruction Fuzzy Hash: BEE06D3A201114AFCB025F4AE884CAABB69FF9C3607018061F90897266C7B19920EA90

Uniqueness

Uniqueness Score: -1.00%

Function 00367044 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?,?,?,00363F97,00000001,?,00000000,?,00000000), ref: 00367055

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: aecd3698f6aa8e37aeb1d3d96d6aca5ff6795a5b5c321107ed3c6f6dd4828e8f
Instruction ID: 6e3f05c3dc420d72a5d3ba67758d35dae70d4b78eb7599e6e3603fd9a384ea1b
Opcode Fuzzy Hash: aecd3698f6aa8e37aeb1d3d96d6aca5ff6795a5b5c321107ed3c6f6dd4828e8f
Instruction Fuzzy Hash: 81E04F36300114ABCA025F45D808DA97F7AEFD53A5B118066E94987271D7329822EB90

Uniqueness

Uniqueness Score: -1.00%

Function 002F3130 Relevance: 1.5, APIs: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 002F3147

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: AllocString
String ID:
API String ID: 2525500382-0
Opcode ID: e61c2b1da5a5925548b3cb264c44248cf59a32282603606f015bd6f6ab07c784
Instruction ID: fc6f405b3b75037292739f907c35af56001a4164243b9aaa3bc60640b976fd95
Opcode Fuzzy Hash: e61c2b1da5a5925548b3cb264c44248cf59a32282603606f015bd6f6ab07c784
Instruction Fuzzy Hash: 27D0127521421F5BC7249EA89804566B7DC9B246A4B100436A748D7600F570D8608B95

Uniqueness

Uniqueness Score: -1.00%

Function 0035A78B Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(00000004), ref: 0035A7AB

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Malloc
String ID:
API String ID: 2696272793-0
Opcode ID: 59bb935c8cf06d0e80ca7b17b8b1fda30cdf07ed762ca2b62fc186044fcb7a31
Instruction ID: 61eeaee69ae40cffcc5e4f6fddcc985b61664e496c13a1a878b760b9747593d5
Opcode Fuzzy Hash: 59bb935c8cf06d0e80ca7b17b8b1fda30cdf07ed762ca2b62fc186044fcb7a31
Instruction Fuzzy Hash: 21E05B706147258FC720DF55F84975176F89B04766F10441EE954C3162E778A4CC9B44

Uniqueness

Uniqueness Score: -1.00%

Function 004CC694 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,004CC9F6,?,?,00000000,?,004CC9F6,00000000,0000000C), ref: 004CC6B1

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b742909afb6853ba1357d20970c9376506afb7b05028f0d9d64977bafe32a03f
Instruction ID: 9b1d245d5ecf4a98061b0858b70b298506779a75c43097ffc4be99c83aa09fec
Opcode Fuzzy Hash: b742909afb6853ba1357d20970c9376506afb7b05028f0d9d64977bafe32a03f
Instruction Fuzzy Hash: 89D06C3200010DBBDF028F84DD06EDA3BAAFB88714F014010BA5866021C732E872EB94

Uniqueness

Uniqueness Score: -1.00%

Function 003A5BCB Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000029,?,?,00000000), ref: 003A5BE7

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: InfoParametersSystem
String ID:
API String ID: 3098949447-0
Opcode ID: 6613adaabca34b377bca01cd1a0ee5feb17f19b3c574aea9e94ccacf1c9a8ec7
Instruction ID: 6157f9159fbe8c2617d3c40fa0bc37c22d7ba84d42de4294ded356aede94ff7c
Opcode Fuzzy Hash: 6613adaabca34b377bca01cd1a0ee5feb17f19b3c574aea9e94ccacf1c9a8ec7
Instruction Fuzzy Hash: 0AD01270184608EFE7015F40DC09FE237A8EB15716F444074F60C4E1A0C7B66891DFB4

Uniqueness

Uniqueness Score: -1.00%

Function 0036838F Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 0036839E

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: DeleteObject
String ID:
API String ID: 1531683806-0
Opcode ID: 5d9aac39031d268eba7a702c198b2f5ab22c280b1cca2a097b317f6ed9829fb4
Instruction ID: e9c35e35c4f9b4995dd709b3db993c597f88fb95070b81567c4c60b93cfbd4bf
Opcode Fuzzy Hash: 5d9aac39031d268eba7a702c198b2f5ab22c280b1cca2a097b317f6ed9829fb4
Instruction Fuzzy Hash: 92B09268811201AFDE4167308A4C72626545B88706F70CAA4B000C510AEE3A8442C500

Uniqueness

Uniqueness Score: -1.00%

Function 002E7350 Relevance: 1.4, APIs: 1, Instructions: 143COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 002E750A

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 7ab252533ac212f112773a71b4e7547cda7a9dd0b978fd8a863c9fc6cc221584
Instruction ID: 6fce1d42b97ad2168df6e1fb3f548a023a2d639fe69575657c7cfcd8011ad4af
Opcode Fuzzy Hash: 7ab252533ac212f112773a71b4e7547cda7a9dd0b978fd8a863c9fc6cc221584
Instruction Fuzzy Hash: EA519BB090074AEFEB10DFA4C859B9ABBF5FF04308F10821DE419AB291E775A558CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0807D000 Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

!, xrefs: 0807D092

Memory Dump Source

Source File: 00000000.00000002.2905876870.0000000008060000.00000010.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID: !
API String ID: 0-3030040504
Opcode ID: c09fb3df672a6701aff3331158c5ed6c896c17f30013da9461343f622f4a9bb6
Instruction ID: 079e6b590464f386582c33325ebef5e5bec9122cf645b505ecce68590f2a64f7
Opcode Fuzzy Hash: c09fb3df672a6701aff3331158c5ed6c896c17f30013da9461343f622f4a9bb6
Instruction Fuzzy Hash: 17510330D04704EFDB20CF59C981BAAB7F6FF45325F04424DE95AAB284D7B5A882CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00312330 Relevance: 1.3, APIs: 1, Instructions: 78COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0031235D

Part of subcall function 002D8620: __Init_thread_footer.LIBCMT ref: 002D8742

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Init_thread_footerInitialize
String ID:
API String ID: 1027553183-0
Opcode ID: 2821706a3e1a320c0d8c9385b78962f2e25b60072db32aa5436b38dee8eb7b41
Instruction ID: 45ed2b61af2a3e3c94f34f124e88a5e1634ef8238ed8856c8be7ec7484efa59d
Opcode Fuzzy Hash: 2821706a3e1a320c0d8c9385b78962f2e25b60072db32aa5436b38dee8eb7b41
Instruction Fuzzy Hash: 2B21B131A10604ABCB15DF54C841B9FB7B9FF44710F014A2AE81597681D734B964CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 003221F0 Relevance: 1.3, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 003221F5

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 4f3113811415061243fe53572171097809f0a724e878dc1fd340a3a00470feb3
Instruction ID: f204786184ffda6b1a2a2934f74d9f7c793023a16f1482da5d354b1933ee0c18
Opcode Fuzzy Hash: 4f3113811415061243fe53572171097809f0a724e878dc1fd340a3a00470feb3
Instruction Fuzzy Hash: D9E0127150070DDFDF01AF68EC056A93BB1FF84310F104169F9088A251DB32E871CB95

Uniqueness

Uniqueness Score: -1.00%

Function 09708A56 Relevance: 1.2, Instructions: 1173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907130948.0000000009707000.00000010.00000800.00020000.00000000.sdmp, Offset: 09707000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9707000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22637b698fb369da249dc690f4c4ab4e11b734b5bdaefb46f7f118b7f3a1e473
Instruction ID: b92de768db1dde4b6e3d734f1c6d39b68dd94df617d9a8f2b124fc4f9537c6a4
Opcode Fuzzy Hash: 22637b698fb369da249dc690f4c4ab4e11b734b5bdaefb46f7f118b7f3a1e473
Instruction Fuzzy Hash: 4D615976E00215DBDB14CF59C4A1BAEB7E5EB89350F008169EA55AB3C2D374EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0970A6C2 Relevance: 1.1, Instructions: 1110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907130948.0000000009707000.00000010.00000800.00020000.00000000.sdmp, Offset: 09707000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9707000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 421113f948fb183dc83e072e574e7bf1f8559351fe62e58fd95d218875db5db8
Instruction ID: 306f749c9c5550491d2b92beaa1bae1824c246e1d752457db1842c88cc2dfe5c
Opcode Fuzzy Hash: 421113f948fb183dc83e072e574e7bf1f8559351fe62e58fd95d218875db5db8
Instruction Fuzzy Hash: 27A29972E04314CFDB28CF68C8A5BA9B7F1BBC8354F158199E849AB391D770AD41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0807E000 Relevance: .7, Instructions: 740COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905876870.0000000008060000.00000010.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0d894a4763dbfc5903ee9e2b0d9616006dcd1f5aec1c27ee9e6f129a2516629b
Instruction ID: ea409c297b8b7e0e999e7c4eed51bafdafe4d756afada2e713603451e2f60bd3
Opcode Fuzzy Hash: 0d894a4763dbfc5903ee9e2b0d9616006dcd1f5aec1c27ee9e6f129a2516629b
Instruction Fuzzy Hash: 99420971F02254DFEB20CB58C8C1ABDB7E6EB45B16F1841DCE8056B385D7B4AC4287A9

Uniqueness

Uniqueness Score: -1.00%

Function 09709000 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907130948.0000000009707000.00000010.00000800.00020000.00000000.sdmp, Offset: 09707000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9707000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e74a178a1222c74ed2b7a53e97316c66d793e5875fa338a228559ff24edea30
Instruction ID: e5ea9648ca3b5019202a3457b7a1095c93d658dc9f9ca38c49f2e344b3b36408
Opcode Fuzzy Hash: 3e74a178a1222c74ed2b7a53e97316c66d793e5875fa338a228559ff24edea30
Instruction Fuzzy Hash: 3042AF72E04205DFDB10CF95C8E1AAEB7F1ABC8354F148459EA56AB3C2D375AC41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0970A502 Relevance: .6, Instructions: 650COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907130948.0000000009707000.00000010.00000800.00020000.00000000.sdmp, Offset: 09707000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9707000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53fb9de90026b36e5266d81945dfeb47de7b206b44c08211562baa39ff751d3b
Instruction ID: e61b6449ceb6638b5107c68ab83cb24b8e262fd72ae4e0495f2c70e758427c7c
Opcode Fuzzy Hash: 53fb9de90026b36e5266d81945dfeb47de7b206b44c08211562baa39ff751d3b
Instruction Fuzzy Hash: B4428C72E04314CBDB28CF68C8A5BA9B7E1BBC8314F25859DE859AB391D771DD41CB80

Uniqueness

Uniqueness Score: -1.00%

Function 09703C62 Relevance: .6, Instructions: 632COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2442659405.0000000009703000.00000004.00000800.00020000.00000000.sdmp, Offset: 09703000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_9703000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08657ae680cb621e0bff1f55bbc2806c36cf3b867180a2f9093d65ac6c70cded
Instruction ID: b3661eebc182638cabd62d18be30fb19dcdadfbe939d1e823815272353f4617f
Opcode Fuzzy Hash: 08657ae680cb621e0bff1f55bbc2806c36cf3b867180a2f9093d65ac6c70cded
Instruction Fuzzy Hash: 5232BF72E04214CBDB24CF18C8A1BAAB7F1AFC8714F25865DE959AB391D771EC41CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0970F9A8 Relevance: .3, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907130948.0000000009707000.00000010.00000800.00020000.00000000.sdmp, Offset: 09707000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9707000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed40b347aad3e24bb958edff1afa49104970d5324ceb399c51fd72610362c3d0
Instruction ID: 028fc0591ffbe679ea3defbf0137a1dd77258b2160699bf897bf464099eb355a
Opcode Fuzzy Hash: ed40b347aad3e24bb958edff1afa49104970d5324ceb399c51fd72610362c3d0
Instruction Fuzzy Hash: E5C1B072A00204DFDB34CF24C8A2B7AB7E5AFC9754F148599E846AB381D775EC42CB91

Uniqueness

Uniqueness Score: -1.00%

Function 097036E4 Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.2442659405.0000000009703000.00000004.00000800.00020000.00000000.sdmp, Offset: 09703000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_9703000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37fcd924510778f56b69662106ddfba4d01056639d32b9b020d25b3ba78fc6cf
Instruction ID: 06d87bf4c9d1646d0d7086100ed0b7dd6166f676cfad8b2750f486a32fd982ea
Opcode Fuzzy Hash: 37fcd924510778f56b69662106ddfba4d01056639d32b9b020d25b3ba78fc6cf
Instruction Fuzzy Hash: 11617672E04218DBDB20CF09C9A1BACF7F6BFC4314F158589E999A7391D770A991CB81

Uniqueness

Uniqueness Score: -1.00%

Function 09700C8E Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907072015.0000000009700000.00000010.00000800.00020000.00000000.sdmp, Offset: 09700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9700000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6879fdcf67a9e82911406b33a99ce9159483679bdc8cdb0ce134763aefc33248
Instruction ID: de1fea00b0ee6bc508b3d449fdbb197c84b08a5de5daad9154ffa8b5d810a9aa
Opcode Fuzzy Hash: 6879fdcf67a9e82911406b33a99ce9159483679bdc8cdb0ce134763aefc33248
Instruction Fuzzy Hash: 5C41D533B41304DBDB24AA2588E6B7677D5AFC5BA5F040169F906AB3C1D7B89C40C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 0806E800 Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905876870.0000000008060000.00000010.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f56debecb1fe799acb286100ce72d838e98979483f2fe759028d2806830bac29
Instruction ID: 9171fa9d1a7988462df437717ac13f5f666f5f4b2d1fe5b9ea26ea8111675f2f
Opcode Fuzzy Hash: f56debecb1fe799acb286100ce72d838e98979483f2fe759028d2806830bac29
Instruction Fuzzy Hash: 1241BB79904305DFDB14CF55C881AAAF7E6FF89321F24825DE999A7340D330A961CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0806E600 Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905876870.0000000008060000.00000010.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1613f9c9d6af6ae9c6d24de3fc8c045d3aed32642f279f2af641e6a7e6fb8dac
Instruction ID: 4022e2b359e5f280146e62dd85be6199ac605c6d19e1acf3a1feba3ec5c8bfbd
Opcode Fuzzy Hash: 1613f9c9d6af6ae9c6d24de3fc8c045d3aed32642f279f2af641e6a7e6fb8dac
Instruction Fuzzy Hash: 4141F574A08308DFD720CF59D980B99BBE1FB05339F24424CE554AB3C1D7B56862CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0807F800 Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905876870.0000000008060000.00000010.00000800.00020000.00000000.sdmp, Offset: 08060000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_8060000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f4de8a58556985ddcaec18ae0dd1d4510d3ed7910f396d25af455cbdbeb3f9
Instruction ID: c9eb68044ebcab12694ae67ed8efb3d03c2071d1703def470d8b4e105bf78901
Opcode Fuzzy Hash: 13f4de8a58556985ddcaec18ae0dd1d4510d3ed7910f396d25af455cbdbeb3f9
Instruction Fuzzy Hash: 9B214571E4530AAFDB50CF698881FADB3A9EF48715F05019EE904E7350DBB4AC40C6E9

Uniqueness

Uniqueness Score: -1.00%

Function 09700974 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907072015.0000000009700000.00000010.00000800.00020000.00000000.sdmp, Offset: 09700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9700000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fe8afe699bc98f24e58641c0a125d790f2f0a101bbbe42941d364bd64b43996
Instruction ID: 744205dde665afec43a19f2ac0e9a80be900e6a6ec08590754c71dbead24efdd
Opcode Fuzzy Hash: 3fe8afe699bc98f24e58641c0a125d790f2f0a101bbbe42941d364bd64b43996
Instruction Fuzzy Hash: A011E672E08209DFE714CE54D8A2BBEF3A1FFC4334F14861EE84593280E7758851CA92

Uniqueness

Uniqueness Score: -1.00%

Function 09700518 Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907072015.0000000009700000.00000010.00000800.00020000.00000000.sdmp, Offset: 09700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9700000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf93d79cf489c402166ccd0fb44c501a0a49622b50c7277e7fd28ec50f973aaf
Instruction ID: e7a177217dbacb630192563096a6776e23aae82df7343d3fe61622741457d553
Opcode Fuzzy Hash: cf93d79cf489c402166ccd0fb44c501a0a49622b50c7277e7fd28ec50f973aaf
Instruction Fuzzy Hash: 0AE0ED76E04204EBDB109F94C891B89B7B5AF84764F05445DE591A7240D3B4A654DB82

Uniqueness

Uniqueness Score: -1.00%

Function 09700627 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907072015.0000000009700000.00000010.00000800.00020000.00000000.sdmp, Offset: 09700000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9700000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e1d923fb108dfea0424675d37c65b5ac7212278196c2bb59bc6ab80c3358e03
Instruction ID: fd642262586c2c38849c64087d155446f307a63121224ea790d3b88ff59ce652
Opcode Fuzzy Hash: 2e1d923fb108dfea0424675d37c65b5ac7212278196c2bb59bc6ab80c3358e03
Instruction Fuzzy Hash: 69D01736904291DFDB41CF5889A0AC9FBF4FE86620B948094E0989B2A1C330A912CB81

Uniqueness

Uniqueness Score: -1.00%

Function 097025CA Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2907101105.0000000009702000.00000010.00000800.00020000.00000000.sdmp, Offset: 09702000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_9702000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8413ab7cc4aa3f6e2721c9f08a2a28f0d9e08e07c10296d6a1b6a74a215c74a0
Instruction ID: 1eafee780f74213644d121739c407e1144b06c7d759b3b2be3679f4c0bfd83b6
Opcode Fuzzy Hash: 8413ab7cc4aa3f6e2721c9f08a2a28f0d9e08e07c10296d6a1b6a74a215c74a0
Instruction Fuzzy Hash: DBD0223370C1880FC300CB8DBCC00C6FB80EED603070902EBDC8CC7211E51188228782

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0BFF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0BF7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0FE7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE07CF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE03BF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE079F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0F87 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0F7F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE077F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0F77 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0B77 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0F6F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0B67 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE075F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0F57 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0757 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0B57 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0F47 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0F27 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0F1F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0F17 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0F0F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE02FF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE02C7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE02BF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE02B7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0EA7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0E97 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0E8F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0287 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0A87 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0A7F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0E7F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0A6F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0E6F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0257 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0A3F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0A37 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0E2F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0A2F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0E1F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE01FF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE09F7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE01F7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE05F7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE05EF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE01EF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE01E7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0DDF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE01DF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE09DF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE09D7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE01D7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE05D7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0DB7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0DAF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0597 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE058F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0D87 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE057F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0D7F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE017F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0177 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0577 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0D5F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0147 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE053F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE052F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0D27 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE051F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0D0F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE04F7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE04EF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE04E7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE04DF Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE04D7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE08A7 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0897 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE048F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE088F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0487 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0887 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0477 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE046F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0467 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0857 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE044F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE084F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0847 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE043F Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 07FE0817 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2905596306.0000000007FE0000.00000010.00000800.00020000.00000000.sdmp, Offset: 07FE0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction ID: 8cc1afaf4c04b65418c32775470f937d2f58bef37107e68d5df2dd3fafa769e3
Opcode Fuzzy Hash: 7881a9f9acea30cb5f7ef1f92e3979d3a979e84609bfc97840d270d2cae7f467
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0031B360 Relevance: 64.3, APIs: 1, Strings: 35, Instructions: 1294COMMON

Download Yara Rule

Strings

actions, xrefs: 0031C02B, 0031C062, 0031C0FC, 0031C35A, 0031C3A7, 0031C46A, 0031C526, 0031C584, 0031C5BA
icons, xrefs: 0031B9E3, 0031B9F7
T, xrefs: 0031C618
download, xrefs: 0031C4CB
preInstallCode, xrefs: 0031B9A9, 0031B9C0
url, xrefs: 0031BC9D, 0031BCCC
downloadUrl, xrefs: 0031B845, 0031B856
ping, xrefs: 0031BC01, 0031BC38, 0031BCD1, 0031BD0B, 0031BD9D
skipInstall, xrefs: 0031B7BE, 0031B7CF
No wait for Installation for package: '%s', xrefs: 0031B98B
Download action not specified for package: '%s', xrefs: 0031C6F3
name, xrefs: 0031BE4D, 0031BE80
false, xrefs: 0031B950
, xrefs: 0031B6DF
parameters, xrefs: 0031BD6C, 0031BD98
size, xrefs: 0031B598, 0031B5C2
version, xrefs: 0031B74D, 0031B75C
Install action not specified for package: '%s', xrefs: 0031C6C1
true, xrefs: 0031B4EF, 0031B56D, 0031B7F8
downloadZipUrl, xrefs: 0031B87F, 0031B890
isPriority, xrefs: 0031B519, 0031B544
preferencesPane, xrefs: 0031C408
sequenceNumber, xrefs: 0031B77C, 0031B78D
preCheck, xrefs: 0031C0C7, 0031C14C, 0031C34D
title, xrefs: 0031B5FB, 0031B6A2, 0031C1BE, 0031C1F6
PackageInitError, xrefs: 0031B63A, 0031C6C6, 0031C6F8
patchName, xrefs: 0031B805, 0031B816
siteCatalystCode, xrefs: 0031B8CA, 0031B8E1
conflictingProcess, xrefs: 0031C57A, 0031C5B0
dpiRatio, xrefs: 0031BA98
isPrimary, xrefs: 0031B49B, 0031B4C6
waitForComplete, xrefs: 0031B904, 0031B92A
Title not specified for package', xrefs: 0031B635
text, xrefs: 0031BB0E, 0031BF08, 0031BF44
install, xrefs: 0031C521, 0031C57F, 0031C5B5

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ByteCharMultiWide
String ID: $Download action not specified for package: '%s'$Install action not specified for package: '%s'$No wait for Installation for package: '%s'$PackageInitError$T$Title not specified for package'$actions$conflictingProcess$download$downloadUrl$downloadZipUrl$dpiRatio$false$icons$install$isPrimary$isPriority$name$parameters$patchName$ping$preCheck$preInstallCode$preferencesPane$sequenceNumber$siteCatalystCode$size$skipInstall$text$title$true$url$version$waitForComplete
API String ID: 626452242-3679869553
Opcode ID: 3cb97ce7f1beff42fffc2c1a085102ead3de589988ca75d406bb40f6f2a65354
Instruction ID: f3c4858cc39cb57736e71482e2cf22bda063271c7e104a8dc5a310e4561a4b74
Opcode Fuzzy Hash: 3cb97ce7f1beff42fffc2c1a085102ead3de589988ca75d406bb40f6f2a65354
Instruction Fuzzy Hash: D3C2BB70D10258CBDF16DBA0C8447EEFBB6AF58304F1541A9E109B7291EB746E85CF92

Uniqueness

Uniqueness Score: -1.00%

Function 0030F3E0 Relevance: 47.9, APIs: 14, Strings: 13, Instructions: 635libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 002D8570: __Init_thread_footer.LIBCMT ref: 002D85F8

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0030F4E1
GetCurrentProcessId.KERNEL32 ref: 0030F590
OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 0030F5A8
LoadLibraryW.KERNEL32(NTDLL.DLL), ref: 0030F5B9
CloseHandle.KERNEL32(00000000), ref: 0030F5C6
GetProcAddress.KERNEL32(00000000,NtQueryInformationProcess), ref: 0030F5E1
CloseHandle.KERNEL32(00000000), ref: 0030F5EC
FreeLibrary.KERNEL32(00000000), ref: 0030F5F3
FreeLibrary.KERNEL32(00000000), ref: 0030F62B
CloseHandle.KERNEL32(00000000), ref: 0030F632
PathAppendW.SHLWAPI(00000000,?,?,?,?,0000000D), ref: 0030F881
PathFileExistsW.SHLWAPI(?,pathValid.txt,0000000D), ref: 0030F8D9
PathIsDirectoryW.SHLWAPI(?), ref: 0030F8F8
GetVersionExW.KERNEL32(0000011C), ref: 0030F9D0

Part of subcall function 002F6090: PathAppendW.SHLWAPI(00000000,?,?,?,?,?), ref: 002F616E
Part of subcall function 002F6090: PathFileExistsW.SHLWAPI(?,pathValid.txt,0000000D,7D8B83E9,?,?), ref: 002F61BA
Part of subcall function 002F6090: PathIsDirectoryW.SHLWAPI(?), ref: 002F61D4

Strings

Unable to obtain the parent process info., xrefs: 0030F6AA
adobe systems incorporated, xrefs: 0030FE68
adobe inc, xrefs: 0030FEC0
Parent process signature validation failed., xrefs: 0030FEEB
6.0, xrefs: 0030FC1D
adobe systems inc, xrefs: 0030FE94
NTDLL.DLL, xrefs: 0030F5B4
Unable to obtain the parent process id., xrefs: 0030F65B
Validating parent process, xrefs: 0030F42D
NtQueryInformationProcess, xrefs: 0030F5DB
Parent process path is different. Current path: '%s'. Parent path: '%s'., xrefs: 0030FA55
pathValid.txt, xrefs: 0030F7EF
ElevationManagerError, xrefs: 0030F660, 0030F6AF, 0030FA5A, 0030FEF0

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Path$CloseFileHandleLibrary$AppendDirectoryExistsFreeProcess$AddressCurrentInit_thread_footerLoadModuleNameOpenProcVersion
String ID: 6.0$ElevationManagerError$NTDLL.DLL$NtQueryInformationProcess$Parent process path is different. Current path: '%s'. Parent path: '%s'.$Parent process signature validation failed.$Unable to obtain the parent process id.$Unable to obtain the parent process info.$Validating parent process$adobe inc$adobe systems inc$adobe systems incorporated$pathValid.txt
API String ID: 2124924842-54784906
Opcode ID: d86684b370b193e23606b81f9402c9af1f13f9297c19f935ee762dd4c559fd9a
Instruction ID: 57c33e543f979de8d0ced6d35d087341e0f6141b68d0511bf0fdd24012dbf678
Opcode Fuzzy Hash: d86684b370b193e23606b81f9402c9af1f13f9297c19f935ee762dd4c559fd9a
Instruction Fuzzy Hash: 7D526670D412698BDB61DB24CC99BEDB7B0AF65304F1042E9E409A7291EB746F89CF80

Uniqueness

Uniqueness Score: -1.00%

Function 002DB040 Relevance: 32.0, APIs: 3, Strings: 15, Instructions: 513COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceExW.KERNEL32(?,?,?,?,?,7D8B83E9), ref: 002DB0ED
GetDiskFreeSpaceExW.KERNEL32(00000000,?,?,?,7D8B83E9), ref: 002DB43A
GetLogicalDrives.KERNEL32 ref: 002DB71E

Strings

>1GB&<1.5GB, xrefs: 002DB22A
>2GB&<2.5GB, xrefs: 002DB2E5
no_enough_install_mem_single_drive, xrefs: 002DB771
>1.5GB&<2GB, xrefs: 002DB28B
act_o, xrefs: 002DB323, 002DB5D0, 002DB6CC
>500MB&1GB, xrefs: 002DB1C9
def_drive_free_space, xrefs: 002DB48B, 002DB4F5, 002DB552
no_enough_install_mem, xrefs: 002DB3AE, 002DB7CA
chosen_drive_free_space, xrefs: 002DB138, 002DB199, 002DB1FA, 002DB25B, 002DB2B5
>3.5GB&<5GB, xrefs: 002DB585
no_enough_download_mem, xrefs: 002DB664
Free Space in directory :%s: %llu , xrefs: 002DB419
mem_status, xrefs: 002DB376, 002DB629, 002DB73F, 002DB798
<500MB, xrefs: 002DB168, 002DB4BE
>500MB&<3.5GB, xrefs: 002DB528

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: DiskFreeSpace$DrivesLogical
String ID: <500MB$>1.5GB&<2GB$>1GB&<1.5GB$>2GB&<2.5GB$>3.5GB&<5GB$>500MB&1GB$>500MB&<3.5GB$Free Space in directory :%s: %llu $act_o$chosen_drive_free_space$def_drive_free_space$mem_status$no_enough_download_mem$no_enough_install_mem$no_enough_install_mem_single_drive
API String ID: 2459482588-4110180424
Opcode ID: b78abac2f7d846b35023cc1170922aad2216b7e415e4610afdc46ffe0385fd3d
Instruction ID: a1bea8be914808f7084bf5102fc469beed228905905ecfda2c4b023c698f6016
Opcode Fuzzy Hash: b78abac2f7d846b35023cc1170922aad2216b7e415e4610afdc46ffe0385fd3d
Instruction Fuzzy Hash: 13229B30E60209DBDB15DFA0C865BEDBBB1AF54324F25821AE510773C1EBB46A95CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0032B5B0 Relevance: 24.9, APIs: 2, Strings: 12, Instructions: 416stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002D8570: __Init_thread_footer.LIBCMT ref: 002D85F8

lstrlenW.KERNEL32(?), ref: 0032B6B8
PathFileExistsW.SHLWAPI(?,?,?), ref: 0032BA05

Strings

{A6EADE66-0000-0000-484E-7E8A45000000}, xrefs: 0032B647
!I, xrefs: 0032B69D
WorkflowManager::launchReaderApplication begin, xrefs: 0032B5F3
InstallLocation, xrefs: 0032B85E
Reader\AcroRd32.exe, xrefs: 0032B8D3, 0032B911, 0032B91D, 0032B987, 0032BA56
AdobeAcrobatReaderAPP, xrefs: 0032B8F1
AdobeAcrobatReader, xrefs: 0032B8B9
WorkflowManager::launchReader Application end, xrefs: 0032BC5A
WorkflowManager.launchReader for Reader Product Path is :%s, xrefs: 0032BA7C
AdobeReader, xrefs: 0032B966
VersionString, xrefs: 0032B6D4
AcroRd32.exe, xrefs: 0032B918, 0032BA23

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ExistsFileInit_thread_footerPathlstrlen
String ID: !I$AcroRd32.exe$AdobeAcrobatReader$AdobeAcrobatReaderAPP$AdobeReader$InstallLocation$Reader\AcroRd32.exe$VersionString$WorkflowManager.launchReader for Reader Product Path is :%s$WorkflowManager::launchReader Application end$WorkflowManager::launchReaderApplication begin${A6EADE66-0000-0000-484E-7E8A45000000}
API String ID: 2100421720-3578024078
Opcode ID: 24fc723b27a4e2cede0462c72dbf7ae7bba8e44818b803a710b34fc0f1d10c46
Instruction ID: f851b8ecf75e774243ae0c0b84bfc39ae24e055a5bc6169b4105da789cdbc8d9
Opcode Fuzzy Hash: 24fc723b27a4e2cede0462c72dbf7ae7bba8e44818b803a710b34fc0f1d10c46
Instruction Fuzzy Hash: 8A027C71D002289BDB25DB24DC85BEAB7B8BB54304F1582D9E589A7290EF709FC5CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00302200 Relevance: 23.2, APIs: 6, Strings: 7, Instructions: 481registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00000001,?,7D8B83E9), ref: 0030230C
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?), ref: 0030233D
RegCloseKey.ADVAPI32(?), ref: 0030234D
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?), ref: 003023F0
RegCloseKey.ADVAPI32(?), ref: 003023FE
Concurrency::cancel_current_task.LIBCPMT ref: 003029D1

Strings

ConflictingProcessActionError, xrefs: 00302615
@(O, xrefs: 0030250D, 00302890, 003029A4, 00302976, 00302645, 00302864, 0030262C
JX0, xrefs: 00302502
user, xrefs: 003022B5
0E0, xrefs: 00302544
Invalid conflictingProcessDataType '%d' specified in application xml for package: %s, xrefs: 00302610
machine, xrefs: 0030238A

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CloseQueryValue$Concurrency::cancel_current_taskOpen
String ID: 0E0$@(O$ConflictingProcessActionError$Invalid conflictingProcessDataType '%d' specified in application xml for package: %s$JX0$machine$user
API String ID: 3712699509-3539409990
Opcode ID: 4b960a09a4f89b15c17e29e596805f7504a2d7beb5a2ac1fef37c9eec0d857aa
Instruction ID: baba721536b5cc5a8a57929e926da6a154762130486bbc58173221e0c2f3dad7
Opcode Fuzzy Hash: 4b960a09a4f89b15c17e29e596805f7504a2d7beb5a2ac1fef37c9eec0d857aa
Instruction Fuzzy Hash: 9B22AD709016289FCB25DF24CC69BEEBBB4AF15309F5041D9E509A7281EB746F84CF94

Uniqueness

Uniqueness Score: -1.00%

Function 00314090 Relevance: 22.0, Strings: 17, Instructions: 795COMMON

Download Yara Rule

Strings

actions, xrefs: 003140D2
progressWaitTime, xrefs: 003144E9, 00314520
success, xrefs: 00314968
uiMessage, xrefs: 00314A2D, 00314A76
warning, xrefs: 003149A0
', xrefs: 00314C74
InstallActionInitError, xrefs: 003145C4
progressWaitLimit, xrefs: 003143C1, 003143F8
ProgressWaitLimit not specified for package '%s', xrefs: 00314495
arguments, xrefs: 0031419A, 003141D7, 00314240
ProgressWaitTime not specified for package '%s', xrefs: 003145BD
type, xrefs: 0031488B, 003148D4
error, xrefs: 003149D8
text, xrefs: 00314B44, 00314BBE
returnCodes, xrefs: 00314625, 0031465C, 003146BF
install, xrefs: 00314130
code, xrefs: 003147A3, 003147E3

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID: '$InstallActionInitError$ProgressWaitLimit not specified for package '%s'$ProgressWaitTime not specified for package '%s'$actions$arguments$code$error$install$progressWaitLimit$progressWaitTime$returnCodes$success$text$type$uiMessage$warning
API String ID: 0-2163134898
Opcode ID: 95e0a9a960205456b1b2c61a773547c66db461a695468588531ade118758f361
Instruction ID: 68111fc75ed6283a8c05b2da9f5e03e1605060193c2d47d1c163687859a39a55
Opcode Fuzzy Hash: 95e0a9a960205456b1b2c61a773547c66db461a695468588531ade118758f361
Instruction Fuzzy Hash: CC8288B1D00259CBDF15CF94C9847EEBBB5BF58304F254299D109BB281EB70AAC9CB91

Uniqueness

Uniqueness Score: -1.00%

Function 002ED000 Relevance: 19.8, APIs: 6, Strings: 5, Instructions: 547COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32 ref: 002ED05C
wsprintfW.USER32 ref: 002ED1F8
CloseHandle.KERNEL32(?), ref: 002ED272
PathFindFileNameW.SHLWAPI(?,?,?), ref: 002ED4AB
CloseHandle.KERNEL32(?,00000000,-00000002), ref: 002ED4E7
PathAppendW.SHLWAPI(00000000,?), ref: 002ED68F

Strings

\VarFileInfo\Translation, xrefs: 002ED3A5
FileDescription, xrefs: 002ED3BB
Process , xrefs: 002ED2B3
Adobe\Acrobat\ActiveX\AcroPDF.dll, xrefs: 002ED609
\StringFileInfo\%04x%04x\%s, xrefs: 002ED3C9

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CloseHandlePath$AppendFileFindNameOpenProcesswsprintf
String ID: Adobe\Acrobat\ActiveX\AcroPDF.dll$FileDescription$Process $\StringFileInfo\%04x%04x\%s$\VarFileInfo\Translation
API String ID: 833066182-237570103
Opcode ID: a7a79ea7d052571fe5f76a2622be029480c67c86d19037e7696323d108805d97
Instruction ID: d4e52f722aefae3598a16b78c14f3d70b670b57205a65b8be526aeeffd02d573
Opcode Fuzzy Hash: a7a79ea7d052571fe5f76a2622be029480c67c86d19037e7696323d108805d97
Instruction Fuzzy Hash: 62329A74C102A89BDB20DF64CC45BEEB7B8AF54304F5842DAE449A7281EBB56ED4CF50

Uniqueness

Uniqueness Score: -1.00%

Function 002F2500 Relevance: 19.5, APIs: 1, Strings: 10, Instructions: 294COMMON

Download Yara Rule

APIs

Part of subcall function 002F2980: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000101,00000037,?,?,00000037), ref: 002F29C2
Part of subcall function 002F2980: RegQueryValueExW.ADVAPI32(00000037,7D8B83E9,00000000,00000000,?,00000004,?,?,00000037), ref: 002F29E3
Part of subcall function 002F2980: RegCloseKey.ADVAPI32(00000037,?,?,00000037), ref: 002F29F0

wsprintfW.USER32 ref: 002F260F

Part of subcall function 002D8620: __Init_thread_footer.LIBCMT ref: 002D8742

Strings

Release, xrefs: 002F256B
Software\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full, xrefs: 002F253E
ADM_STATUS_DOTNET_PRECHECK_ERROR, xrefs: 002F26EA
act_o, xrefs: 002F28D9
adm_status_code, xrefs: 002F264B
adm_status_name, xrefs: 002F26BA
pre_installed, xrefs: 002F27D3
NetFramework_Not_Installed, xrefs: 002F271C
Generic_ExitCode_PreInstalled, xrefs: 002F283B
isInstalled, xrefs: 002F2773

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CloseInit_thread_footerOpenQueryValuewsprintf
String ID: ADM_STATUS_DOTNET_PRECHECK_ERROR$Generic_ExitCode_PreInstalled$NetFramework_Not_Installed$Release$Software\\Microsoft\\NET Framework Setup\\NDP\\v4\\Full$act_o$adm_status_code$adm_status_name$isInstalled$pre_installed
API String ID: 2991573583-3508562451
Opcode ID: fcff39c901bfa23edbafdc37133235db1edecda7e1646d185fe86853d41e0680
Instruction ID: b489c5723145d74eb61df3f58512fc28b5602b9203630783607a91d4eb770366
Opcode Fuzzy Hash: fcff39c901bfa23edbafdc37133235db1edecda7e1646d185fe86853d41e0680
Instruction Fuzzy Hash: AED1B030D6034CDAEB11DFA0C855BEEBBB4AF15304F64429DE1457B282EBB46A98CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0031E1C0 Relevance: 18.1, Strings: 14, Instructions: 562COMMON

Download Yara Rule

Strings

+, xrefs: 0031E942
preInstallCode, xrefs: 0031E8F7, 0031E930
downloadBytes, xrefs: 0031E7E5, 0031E853
productName, xrefs: 0031E2D4, 0031E31D
AcrobatProDC, xrefs: 0031E3AC
machine, xrefs: 0031E590
ReaderAPP, xrefs: 0031E3F7
registryVersionKey, xrefs: 0031E60F, 0031E648
Precheck registry for package '%s' is not in whitelisted list., xrefs: 0031E5DF
comparisonOperator, xrefs: 0031E4AB, 0031E4F0
Reader, xrefs: 0031E465
requiredBytes, xrefs: 0031E6D3, 0031E741
version, xrefs: 0031E20B, 0031E248
PrecheckActionInitError, xrefs: 0031E5E4

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID: +$AcrobatProDC$Precheck registry for package '%s' is not in whitelisted list.$PrecheckActionInitError$Reader$ReaderAPP$comparisonOperator$downloadBytes$machine$preInstallCode$productName$registryVersionKey$requiredBytes$version
API String ID: 0-4153930787
Opcode ID: 403e7564fbb27e75c344a07a032f88e1704e9aa322c71e16cfe004b493021844
Instruction ID: 885323f3b3b9075fbd67dd60393ca82ad27c330b84b438510b8e56d814f70b84
Opcode Fuzzy Hash: 403e7564fbb27e75c344a07a032f88e1704e9aa322c71e16cfe004b493021844
Instruction Fuzzy Hash: D832BBB1D00209DBEB05CF94C9447EEB7B5FF58304F258259E515BB281EB32AE85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 002EF430 Relevance: 18.0, APIs: 5, Strings: 5, Instructions: 471registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,00000001,?,7D8B83E9), ref: 002EF475
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?), ref: 002EF49D
RegCloseKey.ADVAPI32(?), ref: 002EF4AA
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?), ref: 002EF4EB
RegCloseKey.ADVAPI32(?), ref: 002EF4F6

Part of subcall function 002D8620: __Init_thread_footer.LIBCMT ref: 002D8742

Strings

AdobeFlashPlayer, xrefs: 002EF6E7, 002EF7BD, 002EF949, 002EFA75
act_o, xrefs: 002EF812, 002EFA12
Generic_ExitCode_Higher_PreInstalled, xrefs: 002EF97A
pre_installed, xrefs: 002EF67E, 002EF877, 002EF8E0
Generic_ExitCode_PreInstalled, xrefs: 002EF71A

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CloseQueryValue$Init_thread_footerOpen
String ID: AdobeFlashPlayer$Generic_ExitCode_Higher_PreInstalled$Generic_ExitCode_PreInstalled$act_o$pre_installed
API String ID: 4068527745-1641001615
Opcode ID: 446e1bda96786fe006f0d01367a043acd9083220ed911b388a40d5bf3c9621c0
Instruction ID: 16c4584b7484cc86e6aa356eaab95b4e3fe6b4542a3182dc075f38ebb945d7a6
Opcode Fuzzy Hash: 446e1bda96786fe006f0d01367a043acd9083220ed911b388a40d5bf3c9621c0
Instruction Fuzzy Hash: 0512E430D60389EFDB14DFA4C955BEDBBB1BF15304F918269E4016B282E7B0AD95CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0032C300 Relevance: 17.0, APIs: 1, Strings: 10, Instructions: 455stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002D8570: __Init_thread_footer.LIBCMT ref: 002D85F8

lstrlenW.KERNEL32(?), ref: 0032C3F8

Strings

Acrobat\Acrobat.exe, xrefs: 0032C56B
WorkflowManager::launchReaderSAPPApplication begin, xrefs: 0032C343
!I, xrefs: 0032C3DD
InstallLocation, xrefs: 0032C538
WorkflowManager.launchReaderSAPP for ReaderSingleAPP Product Path is :%s, xrefs: 0032C58E
AdobeAcrobatReaderAPP, xrefs: 0032C69C
/prcz_a, xrefs: 0032C710
WorkflowManager::launchReaderSAPP Application end, xrefs: 0032CAEB
VersionString, xrefs: 0032C414
{AC76BA86-0000-0000-7760-7E8A45000000}, xrefs: 0032C384

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Init_thread_footerlstrlen
String ID: !I$/prcz_a$Acrobat\Acrobat.exe$AdobeAcrobatReaderAPP$InstallLocation$VersionString$WorkflowManager.launchReaderSAPP for ReaderSingleAPP Product Path is :%s$WorkflowManager::launchReaderSAPP Application end$WorkflowManager::launchReaderSAPPApplication begin${AC76BA86-0000-0000-7760-7E8A45000000}
API String ID: 4034772305-1997275171
Opcode ID: 35be208efa62fc1bd8bd881eaa80a3db70cb3823165815eda8acc9e7cc9195bd
Instruction ID: 0d0c80c946b938e77bb5735f4058f49f9f1323bd98c93452f953c46dabf538bd
Opcode Fuzzy Hash: 35be208efa62fc1bd8bd881eaa80a3db70cb3823165815eda8acc9e7cc9195bd
Instruction Fuzzy Hash: BC2258B1C102289ADB25DF24DC55BEEB7B5BF94304F1082D9E409A7181EB766BE4CF90

Uniqueness

Uniqueness Score: -1.00%

Function 003100C0 Relevance: 16.8, Strings: 13, Instructions: 552COMMON

Download Yara Rule

Strings

/launchParams/launchPath, xrefs: 003101FF
returnCode, xrefs: 00310847
/launchParams/arguments/argument, xrefs: 003102FB
Error code : %d, returnCode : %d, xrefs: 0031060F
-au 1, xrefs: 00310412
errorCode, xrefs: 003107E8
/launchParams/launchProcessGuid, xrefs: 003101B9
false, xrefs: 003102B7
<launchParams/>, xrefs: 0031064E
{PrefArgs}, xrefs: 00310433
/launchParams/waitForCompletion, xrefs: 00310269
InstallError, xrefs: 00310614
launchProcessGuid, xrefs: 003106C8

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: _com_issue_errorex
String ID: -au 1$/launchParams/arguments/argument$/launchParams/launchPath$/launchParams/launchProcessGuid$/launchParams/waitForCompletion$<launchParams/>$Error code : %d, returnCode : %d$InstallError$errorCode$false$launchProcessGuid$returnCode${PrefArgs}
API String ID: 79918163-2476825172
Opcode ID: c42fc4fac1014576d095a46fde7df4beeccde5ac6f8b8ea390a351e89e4baf79
Instruction ID: dd23807d49ab47eff9f85ccaafb5153a33184d7856d93df6a36372279d58ec43
Opcode Fuzzy Hash: c42fc4fac1014576d095a46fde7df4beeccde5ac6f8b8ea390a351e89e4baf79
Instruction Fuzzy Hash: F9424A70C1525CDADB15DFA4C955BEEBBB4AF29304F208199E049B7281DBB42F88CF91

Uniqueness

Uniqueness Score: -1.00%

Function 003404D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 72timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?), ref: 003404F2
GetTimeFormatW.KERNEL32(00000400,00000008,?,hh'-'mm'-'ss,?,00000100), ref: 00340516
GetDateFormatW.KERNEL32(00000400,00000000,?,M-d-yyyy,?,00000100), ref: 0034053A

Strings

hh'-'mm'-'ss, xrefs: 00340505
M-d-yyyy, xrefs: 00340529
%s %s, xrefs: 00340550

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: FormatTime$DateLocal
String ID: %s %s$M-d-yyyy$hh'-'mm'-'ss
API String ID: 367962810-1111048991
Opcode ID: 852bfddf48c4a30229daaf1a99421455605620f83e2462f043f5c19ae94b223f
Instruction ID: 1a3cbe10107d1b2fcfa99c1f3481e16589059e68cf6d7807c0da68c79137c08a
Opcode Fuzzy Hash: 852bfddf48c4a30229daaf1a99421455605620f83e2462f043f5c19ae94b223f
Instruction Fuzzy Hash: 55212BB25443086FC620DF54DC46FEB73DCEBC8715F00096AFA85C71D1EA70A9198B96

Uniqueness

Uniqueness Score: -1.00%

Function 002EE1E0 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 226COMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 002EE27A

Strings

<registryParams/>, xrefs: 002EE2DA
registryPath, xrefs: 002EE342
registryValue, xrefs: 002EE40F
registryType, xrefs: 002EE3AE

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: wsprintf
String ID: <registryParams/>$registryPath$registryType$registryValue
API String ID: 2111968516-2000735354
Opcode ID: 3f49b420bfc47d10701b3e47420fbb809554ca593f3a2cc391d4e6741edf0fe8
Instruction ID: 8ee2b4fae9c35289941310405e4db7e494ec0acd3d8f0c343dda12c81575fb83
Opcode Fuzzy Hash: 3f49b420bfc47d10701b3e47420fbb809554ca593f3a2cc391d4e6741edf0fe8
Instruction Fuzzy Hash: 43A16C70C1535CDAEB11DFA4C959BDEFBB4AF15304F248299E404AB282EB742A49CF91

Uniqueness

Uniqueness Score: -1.00%

Function 004C9387 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 004BFC70: GetLastError.KERNEL32(?,00000008,004B7369), ref: 004BFC74
Part of subcall function 004BFC70: SetLastError.KERNEL32(00000000,00000001,00000006,000000FF), ref: 004BFD16

GetACP.KERNEL32(?,?,?,?,?,?,004BB93A,?,?,?,00000055,?,-00000050,?,?,00000000), ref: 004C9448
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,004BB93A,?,?,?,00000055,?,-00000050,?,?), ref: 004C9473
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 004C95D6

Strings

utf8, xrefs: 004C9545

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ErrorLast$CodeInfoLocalePageValid
String ID: utf8
API String ID: 607553120-905460609
Opcode ID: 19d4ff759315dfb0b23a04975a7ea5b90dcb9a2fc50d86ab37a8ba7d2cf2111f
Instruction ID: a8189e06589f3f234984e21e449f826a202f71782d7a32bc40b110766a2b4c7c
Opcode Fuzzy Hash: 19d4ff759315dfb0b23a04975a7ea5b90dcb9a2fc50d86ab37a8ba7d2cf2111f
Instruction Fuzzy Hash: 6171F43A604602BADB69AB75CC4AFBB73A8EF44704F14402FF505D6281EB78ED41876C

Uniqueness

Uniqueness Score: -1.00%

Function 004B5150 Relevance: 3.4, APIs: 2, Instructions: 449COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9b306b418df6198821e2372ddfeaebe62b3d3d4911b6be8c569d4659d6aa99
Instruction ID: 6bfc7ae5b4adfea16131a545876f89d0968913634317a5cbc2ad2eb9b038f4d6
Opcode Fuzzy Hash: 3b9b306b418df6198821e2372ddfeaebe62b3d3d4911b6be8c569d4659d6aa99
Instruction Fuzzy Hash: 52F14D71E016199FDF14CFA9D8807EEF7B2FF88314F15826AE815AB384D73499418B94

Uniqueness

Uniqueness Score: -1.00%

Function 002F4570 Relevance: 3.1, Strings: 2, Instructions: 563COMMON

Download Yara Rule

Strings

End Application Detection Id. Code = %s, xrefs: 002F4CC3
Start Application Detection Id, xrefs: 002F45CB

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Init_thread_footer
String ID: End Application Detection Id. Code = %s$Start Application Detection Id
API String ID: 1385522511-2548038187
Opcode ID: df0ae81c19b049282fb7f72f8576fa4ea68c8f5d0ecd0872119492e7cb90953f
Instruction ID: 3c8e435a1a6cfbbf9c19d9791e41b751cb64faf99bce6b4ba30923b78d78aee6
Opcode Fuzzy Hash: df0ae81c19b049282fb7f72f8576fa4ea68c8f5d0ecd0872119492e7cb90953f
Instruction Fuzzy Hash: 3C328D31D20219CBCF24DFA8C8547EEF7B1AF54304F6542A9E505B7291EB706A94CF91

Uniqueness

Uniqueness Score: -1.00%

Function 004AB11B Relevance: 2.9, Strings: 2, Instructions: 388COMMONLIBRARYCODE

Download Yara Rule

Strings

0, xrefs: 004AB2B0
o~J, xrefs: 004AB488

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID: 0$o~J
API String ID: 0-745342745
Opcode ID: ceb67e73b275f7ca94b2b11468d2f7ac98fa04e9f2c69b23203be1d9232669a7
Instruction ID: 3faad44e5dc802acea7868be9cf85d8a62731f50d02bd3adf49edf27883009d7
Opcode Fuzzy Hash: ceb67e73b275f7ca94b2b11468d2f7ac98fa04e9f2c69b23203be1d9232669a7
Instruction Fuzzy Hash: 7DE1CF706006058FCB24CF68C494AAFB7F1FF6A314B24465FD8569B392D738AD42CB99

Uniqueness

Uniqueness Score: -1.00%

Function 003372E0 Relevance: 2.7, Strings: 1, Instructions: 1494COMMON

Download Yara Rule

Strings

0123456789ABCDEFabcdef-+XxPp, xrefs: 00337445

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Lockitstd::_$Lockit::_Lockit::~_
String ID: 0123456789ABCDEFabcdef-+XxPp
API String ID: 593203224-3606100449
Opcode ID: 7c63987b5b37f033b1dc01e1e0f8406f1ebd76cbb5031515d7733042c73663ed
Instruction ID: 587ad1bc2003585a5acf66dcfc4b33fdc83efa7aa9eb141632efb92727ed9530
Opcode Fuzzy Hash: 7c63987b5b37f033b1dc01e1e0f8406f1ebd76cbb5031515d7733042c73663ed
Instruction Fuzzy Hash: 87D267B4604245CFDB76CF18C890BB5B7B1AF46304F6584D9E8898B392DB35ED86CB60

Uniqueness

Uniqueness Score: -1.00%

Function 004BD22A Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,00000000,?,00000008,?,?,004BD225,00000000,?,00000008,?,?,004CEF2E,00000000), ref: 004BD457

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: d4e80d827268d17f94bcd06835086b3ccde421f660b73fa328a6c8f74ac5cc41
Instruction ID: 3bba6f3495e6ebddae98ff486bd45f1ba2f02c75dbc8986ad906b02130381d68
Opcode Fuzzy Hash: d4e80d827268d17f94bcd06835086b3ccde421f660b73fa328a6c8f74ac5cc41
Instruction Fuzzy Hash: 8EB18F31A10604DFD718CF28C486BA57BE0FF45364F298699E899CF3A1D339E982CB55

Uniqueness

Uniqueness Score: -1.00%

Function 002D10D0 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ecfe98650ce80b65451e6107918aa3102029278c7b72910b33a45b633f2f9ce7
Instruction ID: f0e2e41dc1db5509062db6bcd5f245b81a1a27f61133554ea80557d15668c9f4
Opcode Fuzzy Hash: ecfe98650ce80b65451e6107918aa3102029278c7b72910b33a45b633f2f9ce7
Instruction Fuzzy Hash: F8A1102171A2C79FC30DCE6C48805A9FF617B7610074887DEE884EB783C514EAA9C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 004B3173 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 138b19d0908f75a30e2a6b14e347264a92ec6ec6c40ea4e4025e589548016a3a
Instruction ID: cc0f7443f1cf22cff6c3e637a076cc7735ff115d7e2083923ecea7ee4e563f72
Opcode Fuzzy Hash: 138b19d0908f75a30e2a6b14e347264a92ec6ec6c40ea4e4025e589548016a3a
Instruction Fuzzy Hash: A4518471E00119AFDF08CF9AC951AEEBBB6EF84304F59809DE815AB301D734AE50CB64

Uniqueness

Uniqueness Score: -1.00%

Function 003AA338 Relevance: 42.3, APIs: 23, Strings: 1, Instructions: 327fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 003AA342
GetModuleFileNameW.KERNEL32(00000000,?,00000104,00532434,00000000,0053276C,00000000,005343B0,00000000,?,00000000,00000A88,003AB5C8,003728AD,00000000,00000038), ref: 003AA3E1
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,005343B0,00000000,?,00000000,00000A88,003AB5C8,003728AD,00000000,00000038), ref: 003AA494

Strings

, xrefs: 003AA780

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: File$CreateH_prolog3_ModuleName
String ID:
API String ID: 3408945735-3916222277
Opcode ID: 03bdbcd10cb490ba1fec73f6b2fcab860735e32fef50eb7aa1e4d4cbfa3343eb
Instruction ID: 378bd04594d7a19994f720dba285b52e989b604748b6e9c6efaf69c2712e6f87
Opcode Fuzzy Hash: 03bdbcd10cb490ba1fec73f6b2fcab860735e32fef50eb7aa1e4d4cbfa3343eb
Instruction Fuzzy Hash: 75C19272A00614AFDB229F60CC49FFE77B8EF4A310F1041A9F909A6151DB759E94CF62

Uniqueness

Uniqueness Score: -1.00%

Function 002F2200 Relevance: 35.2, APIs: 18, Strings: 2, Instructions: 170threadinjectionprocessCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,?,?,?,?,?,?,?,00000004,0145A768), ref: 002F2290
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 002F22A6
GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,?,?,00000004,0145A768), ref: 002F22B9
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 002F22D3
GetWindowsDirectoryW.KERNEL32(?,00000104,?,?,?,?,?,?,?,00000004,0145A768), ref: 002F22DB
CreateProcessW.KERNEL32(?,00000000,00000000,00000000,00000000,00000044,00000000,00000000,00000044,?), ref: 002F231F
GetCurrentProcess.KERNEL32(?,?,00000000,00000000,00000000), ref: 002F2379
GetCurrentProcess.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000004,0145A768), ref: 002F237C
DuplicateHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000004,0145A768), ref: 002F237F
GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?,?,?,?,?,?,?,?,?,?,00000004,0145A768), ref: 002F2393
GetThreadContext.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000004,0145A768), ref: 002F23C2
VirtualProtectEx.KERNEL32(?,?,00000424,00000040,?), ref: 002F2404
WriteProcessMemory.KERNEL32(?,?,?,00000424,00000000), ref: 002F241F
FlushInstructionCache.KERNEL32(?,?,00000424,?,?,?,?,?,?,?,?,?,?,?,00000004,0145A768), ref: 002F2431
SetThreadContext.KERNEL32(?,00010003,?,?,?,?,?,?,?,?,?,?,?,00000004,0145A768), ref: 002F2444
ResumeThread.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000004,0145A768), ref: 002F2450
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000004,0145A768), ref: 002F245C
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000004,0145A768), ref: 002F2464

Strings

kernel32, xrefs: 002F228B
IsWow64Process, xrefs: 002F22A0

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Process$Handle$CurrentThread$CloseContextDirectoryModule$AddressCacheCreateDuplicateFileFlushInstructionMemoryNameProcProtectResumeSystemVirtualWindowsWrite
String ID: IsWow64Process$kernel32
API String ID: 1692321928-3789238822
Opcode ID: 547c08b2fda7a9046420653e2d3db55eca6ec2c3647e7c10019fe977a21de6ba
Instruction ID: 5e78bbb461edae076ad05c0053b17169f735c871438e92ea28a766683f75de9d
Opcode Fuzzy Hash: 547c08b2fda7a9046420653e2d3db55eca6ec2c3647e7c10019fe977a21de6ba
Instruction Fuzzy Hash: DC614DB1D0021CAFEB21DF61DC45FEAB7B8EB48704F0041E5FA09A6191DB746A94CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00315560 Relevance: 28.5, APIs: 7, Strings: 9, Instructions: 485sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000064), ref: 00315694
wsprintfW.USER32 ref: 00315703
RtlEnterCriticalSection.NTDLL(-0000018C), ref: 0031585F
__Init_thread_footer.LIBCMT ref: 00315A62

Part of subcall function 0049F16D: RtlEnterCriticalSection.NTDLL(005767E0), ref: 0049F177
Part of subcall function 0049F16D: RtlLeaveCriticalSection.NTDLL(005767E0), ref: 0049F1AA
Part of subcall function 0049F16D: RtlWakeAllConditionVariable.NTDLL ref: 0049F221

RtlLeaveCriticalSection.NTDLL(00577884), ref: 00315A6F
__Init_thread_footer.LIBCMT ref: 00315AD3
__Init_thread_footer.LIBCMT ref: 00315BFA

Strings

ADM_STATUS_READER_INSTALL_ERROR, xrefs: 003157D7
GoCart pushed to front of the installed Queue: %s, xrefs: 003159E8
adm_status_code, xrefs: 0031573A
Precheck, xrefs: 0031582D
AdobeAcrobatReaderAPP, xrefs: 003155E9
AdobeAcrobatReader, xrefs: 003155AC
adm_status_name, xrefs: 0031579C
adm_status_reason, xrefs: 003157FE
GoCart, xrefs: 00315650, 003158E8

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CriticalSection$Init_thread_footer$EnterLeave$ConditionSleepVariableWakewsprintf
String ID: GoCart pushed to front of the installed Queue: %s$ADM_STATUS_READER_INSTALL_ERROR$AdobeAcrobatReader$AdobeAcrobatReaderAPP$GoCart$Precheck$adm_status_code$adm_status_name$adm_status_reason
API String ID: 1346125039-1087257696
Opcode ID: c7a0d8b576bbbede13ed680fc1bed77494cbaf8f1499984d73daa0c7c4bd5855
Instruction ID: ab2e8fc97507d07781c9d4596ddf33e8b49b5894a4e9cf9a74ecbf6b57b547a8
Opcode Fuzzy Hash: c7a0d8b576bbbede13ed680fc1bed77494cbaf8f1499984d73daa0c7c4bd5855
Instruction Fuzzy Hash: 5712E270A00709DFDB15DFA4C856BEDBBB1BF59314F158269E409AB2C2DB70AD84CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0033B220 Relevance: 26.5, APIs: 11, Strings: 4, Instructions: 233memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0033B2AA
VariantCopy.OLEAUT32(?,?), ref: 0033B2B8
VariantClear.OLEAUT32(?), ref: 0033B33F
SysAllocString.OLEAUT32(7D8B83E9), ref: 0033B35A
_com_issue_errorex.COMSUPP ref: 0033B398
VariantClear.OLEAUT32(?), ref: 0033B3A5

Strings

addChildToNode ... node is null!, xrefs: 0033B25D
lR, xrefs: 0033B41D, 0033B424
XMLParser, xrefs: 0033B267, 0033B4C2
addChildToNode ... XMLParser not Initialized ..., xrefs: 0033B4B8

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Variant$Clear$AllocCopyInitString_com_issue_errorex
String ID: XMLParser$addChildToNode ... XMLParser not Initialized ...$addChildToNode ... node is null!$lR
API String ID: 4186184965-1835530078
Opcode ID: af549f6c4cbd350f68a38db9323ebee9e5d7bbc4c73c50ac5277ffffaa327712
Instruction ID: b296f8c896b3f8a2c14d473cd61404082cb48f9ac6e6de5dea5bfbeb5dd9a9d6
Opcode Fuzzy Hash: af549f6c4cbd350f68a38db9323ebee9e5d7bbc4c73c50ac5277ffffaa327712
Instruction Fuzzy Hash: B881E174A01248EFDB12DFA9C989B9EBBF8FF45314F104159F905AB291D775AA00CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0033B520 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 199memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 0033B5BE
VariantCopy.OLEAUT32(?,?), ref: 0033B5CC
VariantClear.OLEAUT32(?), ref: 0033B653
SysAllocString.OLEAUT32(?), ref: 0033B66E
_com_issue_errorex.COMSUPP ref: 0033B6AC
VariantClear.OLEAUT32(?), ref: 0033B6B9

Strings

addChildToNode ... node is null!, xrefs: 0033B571
XMLParser, xrefs: 0033B57B, 0033B79B
addChildToNode ... XMLParser not Initialized ..., xrefs: 0033B791

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Variant$Clear$AllocCopyInitString_com_issue_errorex
String ID: XMLParser$addChildToNode ... XMLParser not Initialized ...$addChildToNode ... node is null!
API String ID: 4186184965-4178667580
Opcode ID: b67d53e60d29a99cce18216b4ae7c23a297d3dea0969de44add88062956b6569
Instruction ID: 936b795e0f20b3e8a9db5d028d0cb3a5b2243969ed2a017a8074313b73350b95
Opcode Fuzzy Hash: b67d53e60d29a99cce18216b4ae7c23a297d3dea0969de44add88062956b6569
Instruction Fuzzy Hash: F071DC74E00348EFDB11DFA8C889B9EBBB8FF45314F14415DE915AB292D7B4AA00CB61

Uniqueness

Uniqueness Score: -1.00%

Function 002F5250 Relevance: 19.7, APIs: 1, Strings: 10, Instructions: 422COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,7D8B83E9,00000000,00000000), ref: 002F5320

Strings

google llc, xrefs: 002F5764
google inc, xrefs: 002F573E
adobe systems incorporated, xrefs: 002F56CC
adobe inc, xrefs: 002F56F2
6.0, xrefs: 002F54F7
Binary signature validation failed., xrefs: 002F57B5
ValidationFailure, xrefs: 002F57BA
mcafee llc, xrefs: 002F5718
Certificate mismatch: , xrefs: 002F57F2
5.1, xrefs: 002F54B8

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Version
String ID: 5.1$6.0$Binary signature validation failed.$Certificate mismatch: $ValidationFailure$adobe inc$adobe systems incorporated$google inc$google llc$mcafee llc
API String ID: 1889659487-4007284344
Opcode ID: e458e8f3485600e77532cb898795543da65c2756e340964c69d57906193ccc85
Instruction ID: 2c3a415085c379c2073da08f54a48214aea5cabbd96dcd45cbd197c286eec697
Opcode Fuzzy Hash: e458e8f3485600e77532cb898795543da65c2756e340964c69d57906193ccc85
Instruction Fuzzy Hash: B0128D71D10269DBDF20CFA4CC55BEDBBB0AF56314F20829AE50877281EB706A95CF91

Uniqueness

Uniqueness Score: -1.00%

Function 002F3360 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 265processsynchronizationCOMMON

Download Yara Rule

APIs

PathRemoveFileSpecW.SHLWAPI(00000000), ref: 002F353B
GetLastError.KERNEL32 ref: 002F3545
GetLastError.KERNEL32(005343B4,00000002,?,00000008,005343BC,00000001,7D8B83E9), ref: 002F356D
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,?,00000044,?,-00000002), ref: 002F3659
WaitForSingleObject.KERNEL32(?,000003E8), ref: 002F36C0
GetExitCodeProcess.KERNEL32(?,00000008), ref: 002F36D3
CloseHandle.KERNEL32(?), ref: 002F36F0
CloseHandle.KERNEL32(?), ref: 002F36F8

Strings

FileUtils, xrefs: 002F3556
D, xrefs: 002F35E5
Failed to remove file spec error: %d, xrefs: 002F354C

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CloseErrorHandleLastProcess$CodeCreateExitFileObjectPathRemoveSingleSpecWait
String ID: D$Failed to remove file spec error: %d$FileUtils
API String ID: 1791194634-3621875036
Opcode ID: f23875f01df7019d5e29a24750bcc9b12d0adf019a7bc9db40f65db764e35c27
Instruction ID: 1f358acf551f6f1f9ab3bab37d5a10c83bb441bfe2b7377066b9915112b775fc
Opcode Fuzzy Hash: f23875f01df7019d5e29a24750bcc9b12d0adf019a7bc9db40f65db764e35c27
Instruction Fuzzy Hash: A6B1AC70D102099FCB21DF64CD41BAEB7B5EF99304F5442A9E905A7291EB706A94CF90

Uniqueness

Uniqueness Score: -1.00%

Function 003111F0 Relevance: 19.5, APIs: 5, Strings: 6, Instructions: 201sleepCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0031121F

Part of subcall function 00330FE0: RtlEnterCriticalSection.NTDLL(?), ref: 0033101C
Part of subcall function 00330FE0: RtlLeaveCriticalSection.NTDLL(?), ref: 0033102F

RtlEnterCriticalSection.NTDLL(?), ref: 00311348
RtlLeaveCriticalSection.NTDLL(?), ref: 00311358
Sleep.KERNEL32(00000064), ref: 00311413

Part of subcall function 002D8570: __Init_thread_footer.LIBCMT ref: 002D85F8

Strings

InvalidParent, xrefs: 00311294
Error closing IPC channel, xrefs: 003114AD
Successfully closed IPC channel, xrefs: 00311490
Error reading packet : %d, xrefs: 0031144A
Error initializing IPC, xrefs: 0031125B
IPCCommunications, xrefs: 00311260, 0031144F, 003114B2

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Init_thread_footerInitializeSleep
String ID: Error closing IPC channel$Error initializing IPC$Error reading packet : %d$IPCCommunications$InvalidParent$Successfully closed IPC channel
API String ID: 4210563109-4172709400
Opcode ID: 843cf2cd38548f97128bdba9bfc482b553ed4ffbc22f0cfa4c8dc4adabd92e88
Instruction ID: 3e42504fa6bbee67f0e18f1cdc2c04f4b31a8635b87dd498fa83c3cce8ae67f7
Opcode Fuzzy Hash: 843cf2cd38548f97128bdba9bfc482b553ed4ffbc22f0cfa4c8dc4adabd92e88
Instruction Fuzzy Hash: 4881FF709043099FDB29DFA4C819BFEBBB4EF08304F14462DE552AB2D2DB74A994CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00331470 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242sleepCOMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(0145A7B4), ref: 003314CC
Sleep.KERNEL32(00000001), ref: 003314D4
RtlLeaveCriticalSection.NTDLL(0145A7B4), ref: 003314E1
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000,00000000,00000000,?), ref: 0033155B
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 00331586
RtlLeaveCriticalSection.NTDLL(?), ref: 003315CC

Strings

Terminate channel, xrefs: 00331625, 003316CB

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CriticalSection$ByteCharLeaveMultiWide$EnterSleep
String ID: Terminate channel
API String ID: 136537519-3506379291
Opcode ID: b7d3a6cc2c631f8711eda90a42cde3f1b8d186723d9aef1f2cf6101e89851de7
Instruction ID: f9ac70e6c428ca4693db25a4cd38f7adfc3ab97c2d0748b2095b555b3ad718c7
Opcode Fuzzy Hash: b7d3a6cc2c631f8711eda90a42cde3f1b8d186723d9aef1f2cf6101e89851de7
Instruction Fuzzy Hash: 64A19070D00219DFEB15DFA4CC95BAEBBB8BF45310F1442A9E409A7281DB70AA48CF65

Uniqueness

Uniqueness Score: -1.00%

Function 003481A0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 97fileCOMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,00000000,00000000,?,?,001,00000003,?), ref: 003481E4
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 00348204
GetLastError.KERNEL32 ref: 00348222
GetLastError.KERNEL32 ref: 00348230

Strings

failed to write data. Error code - %d, xrefs: 00348233
file pointer set error - %d, xrefs: 0034827C
file handler not initialized, xrefs: 003481B8
Failed to write the segment in the file which is to be downloaded, xrefs: 0034829A

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ErrorFileLast$PointerWrite
String ID: Failed to write the segment in the file which is to be downloaded$failed to write data. Error code - %d$file handler not initialized$file pointer set error - %d
API String ID: 2977825765-1319907779
Opcode ID: 731ec704558e397488a36244d08af1f94ce181e1e1f8e69d5882c2132f7734e3
Instruction ID: 47feb8e3faea0f1c4f2c77c18cc9ff30b5a5a0449907c3f3c5a4399105470b12
Opcode Fuzzy Hash: 731ec704558e397488a36244d08af1f94ce181e1e1f8e69d5882c2132f7734e3
Instruction Fuzzy Hash: 7631A675A00218AFCF01AF64DC85BAE7BE9EF48310F114096FD089F246DAB1AD54CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00348080 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 96fileCOMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(?,00000000,?,00000000,00000000,00000000,?,?,00000000,00000012,?), ref: 003480C4
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 003480E4
GetLastError.KERNEL32 ref: 00348103
GetLastError.KERNEL32 ref: 00348111

Strings

failed to read data. Error code - %d, xrefs: 00348114
Failed to read the segment from the downloaded file, xrefs: 0034817A
file handler to read not initialized, xrefs: 00348098
file pointer set error - %d, xrefs: 0034815C

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ErrorFileLast$PointerRead
String ID: Failed to read the segment from the downloaded file$failed to read data. Error code - %d$file handler to read not initialized$file pointer set error - %d
API String ID: 2170121939-552781294
Opcode ID: ec5446dc8edc6e690de830ab40bbf7c7537b3accdd5b503035680060c39376d8
Instruction ID: 95d42670d03fbdd100bdc66c99dc89edb25b3641ae0640ea627be19a7f35cafb
Opcode Fuzzy Hash: ec5446dc8edc6e690de830ab40bbf7c7537b3accdd5b503035680060c39376d8
Instruction Fuzzy Hash: 8431BE71A00218AFCF01EF64DC85BAE7BE8EF08311F1140A6FD099F242DA71AD54CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 003DB468 Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 271windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003DB46F
CreateCompatibleDC.GDI32(?), ref: 003DB4D8
CreateCompatibleBitmap.GDI32(?,?,?), ref: 003DB50E
SelectObject.GDI32(?,00000000), ref: 003DB568
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 003DB590
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 003DB75D
DeleteObject.GDI32(?), ref: 003DB774

Strings

3&7, xrefs: 003DB53B, 003DB559, 003DB69D, 003DB541, 003DB5F7
3&7, xrefs: 003DB483, 003DB4B8

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CompatibleCreateObject$BitmapDeleteH_prolog3Select
String ID: 3&7$3&7
API String ID: 3587968642-3020793735
Opcode ID: cf556421007887fdb0bc739130d3db65ad001e339c4468d43795ccf6ad7ae7ee
Instruction ID: 4ffa5ec681f0ca8d6f4a3ded0a4d65d5a483a86fa8f8a8a7707ef38b7acde307
Opcode Fuzzy Hash: cf556421007887fdb0bc739130d3db65ad001e339c4468d43795ccf6ad7ae7ee
Instruction Fuzzy Hash: 94A18D7290020ADBCF16DFA9D985ABEBBF4FF44304F12812AF555EA291DB34D914CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00352060 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 190encryptionmemoryCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 003520CD
CertGetIssuerCertificateFromStore.CRYPT32(?,00000000,00000000,?), ref: 003520F7
CertGetNameStringW.CRYPT32(?,00000004,00000000,00000000,00000000,00000000), ref: 0035211F
LocalAlloc.KERNEL32(00000000), ref: 00352133
CertGetNameStringW.CRYPT32(?,00000004,00000000,00000000,00000000,?), ref: 0035214B
LocalFree.KERNEL32(?,?,?), ref: 0035217A

Strings

Certificate not matching, xrefs: 003521EC
lR, xrefs: 0035208D, 003520C2

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Cert$LocalNameString$AllocCertificateErrorFreeFromIssuerLastStore
String ID: Certificate not matching$lR
API String ID: 771185627-2808037631
Opcode ID: 1e3b82a1cfd6c25ec22c37a47acbf7b6311760af6725d729b0b7a671fbd390c6
Instruction ID: e8296095c0bfa4be811ab5a2bec1aae98cd02612592f5b214d7eccd0fba89634
Opcode Fuzzy Hash: 1e3b82a1cfd6c25ec22c37a47acbf7b6311760af6725d729b0b7a671fbd390c6
Instruction Fuzzy Hash: C061EC75900214ABDB198F64DC48FAFBBB5FF4A315F150519ED01B72A0EB306A88CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 002F4420 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 107COMMON

Download Yara Rule

APIs

UrlIsW.SHLWAPI(?,00000000,7D8B83E9,?,?,00000000,004D4E5D,000000FF,?,0032FC7F,-00000030), ref: 002F4466
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 002F448A
ShellExecuteW.SHELL32(00000000,open,iexplore,00000008,00000000,00000001), ref: 002F44F2
UrlIsW.SHLWAPI(?,00000000), ref: 002F451A
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 002F453A

Strings

open, xrefs: 002F4483, 002F44EB, 002F4533
-nohome , xrefs: 002F44A1
iexplore, xrefs: 002F44E6

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ExecuteShell
String ID: -nohome $iexplore$open
API String ID: 587946157-2530092967
Opcode ID: 33fb1265cdb94a0904f1fe305efc4b27212d6fc53dd002007426a68a474a796f
Instruction ID: 37fc77495aff727755e5c8ddb3049ad17185c75505cc64940f8efa5f5ed00ac5
Opcode Fuzzy Hash: 33fb1265cdb94a0904f1fe305efc4b27212d6fc53dd002007426a68a474a796f
Instruction Fuzzy Hash: 5541B130650309ABDB30EF58CC59FAAFBB4AB04B54F60052AE601BB2D0D7B0A954CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00342380 Relevance: 12.6, APIs: 1, Strings: 6, Instructions: 323COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 003423D0

Strings

failed to create a new segment, xrefs: 003425B9
failed to create the last segment, xrefs: 00342597
number of jobs created when resuming from disk are %d, xrefs: 00342782
num of jobs to be created is %d, xrefs: 0034240D
already downloaded bytes for segment %d is %d, xrefs: 00342499
partially downloaded bytes for segment %d is %d, xrefs: 003424E5, 003426DD

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: __aulldiv
String ID: already downloaded bytes for segment %d is %d$failed to create a new segment$failed to create the last segment$num of jobs to be created is %d$number of jobs created when resuming from disk are %d$partially downloaded bytes for segment %d is %d
API String ID: 3732870572-2727180387
Opcode ID: 1607385c597f5f2bf1cb4b92c9ff0553b0643618b2a948df7ece5d4f5ed763af
Instruction ID: 6c6816a38b22e62771db0c0b41da04a4e0fa2cb887d44faefb226245b63b06eb
Opcode Fuzzy Hash: 1607385c597f5f2bf1cb4b92c9ff0553b0643618b2a948df7ece5d4f5ed763af
Instruction Fuzzy Hash: A7D15870A00609AFCB1AEFA4C895FAEFBB9FF45304F104159F415AB292DB31B915CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0034C420 Relevance: 12.5, APIs: 1, Strings: 7, Instructions: 459COMMON

Download Yara Rule

Strings

failed to retrieve the ETAG header from the head request, xrefs: 0034C83F
Retry Count: %d reached for retriving file size and total time taken in seconds is %d, xrefs: 0034C74B
The value of ETAG for the file is , xrefs: 0034C890
some intermittent error while fetching remote file size. Retrying now. Error code is %d and error type is %d, xrefs: 0034C6BA
failed to retrieve the server file Size, xrefs: 0034C779
ETag, xrefs: 0034C7D6, 0034C89D
failed to init the http downloader to get file Size, xrefs: 0034C57A

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID: ETag$Retry Count: %d reached for retriving file size and total time taken in seconds is %d$The value of ETAG for the file is $failed to init the http downloader to get file Size$failed to retrieve the ETAG header from the head request$failed to retrieve the server file Size$some intermittent error while fetching remote file size. Retrying now. Error code is %d and error type is %d
API String ID: 0-2065089768
Opcode ID: fc83cf0d4ab1039d5fda7d408cda17c887ad9f664e9d5fc283379f535273d3b9
Instruction ID: 7f5777292322ef096248b45bbc481be2ac0c4f6c1aa8cc53cba4bce09e649f27
Opcode Fuzzy Hash: fc83cf0d4ab1039d5fda7d408cda17c887ad9f664e9d5fc283379f535273d3b9
Instruction Fuzzy Hash: 2B129D719112199FCB1ADF64C859BEDBBF4BF15304F1441DAE40AAB292DB307A88CF61

Uniqueness

Uniqueness Score: -1.00%

Function 002EF010 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 131COMMON

Download Yara Rule

APIs

Part of subcall function 0033A120: _com_issue_errorex.COMSUPP ref: 0033A196

Part of subcall function 002D8570: __Init_thread_footer.LIBCMT ref: 002D85F8

PathFileExistsW.SHLWAPI(?), ref: 002EF10E
PathIsDirectoryW.SHLWAPI(?), ref: 002EF124
SHCreateDirectoryExW.SHELL32(00000000,?,00000000), ref: 002EF13F

Strings

FileUtils, xrefs: 002EF156
Non Admin creating destination directory %s, xrefs: 002EF0F6
SHCreateDirectoryEx failed. Error: %d, xrefs: 002EF14C
createDirectoryParams/createDestination, xrefs: 002EF0A6

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: DirectoryPath$CreateExistsFileInit_thread_footer_com_issue_errorex
String ID: FileUtils$Non Admin creating destination directory %s$SHCreateDirectoryEx failed. Error: %d$createDirectoryParams/createDestination
API String ID: 2933693980-4075147966
Opcode ID: e0e4727d9a770631491a3996d9add659b8c558c0171c660306c5c0ebfa292711
Instruction ID: d101bad5faed7885077a939b580c5efe9e337c6a710164e65059306570a55953
Opcode Fuzzy Hash: e0e4727d9a770631491a3996d9add659b8c558c0171c660306c5c0ebfa292711
Instruction Fuzzy Hash: 3551AC71D20259EFCB01DFA4DD56BEEBBB4FF54304F10422AE401AB281EBB45A45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0036C553 Relevance: 12.1, APIs: 8, Instructions: 97memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0036C55A
RtlEnterCriticalSection.NTDLL(00000000), ref: 0036C56B
TlsGetValue.KERNEL32(?,?,00000000,?,?,00000001,?,?,?,002E7E7A,?,7D8B83E9), ref: 0036C587
LocalAlloc.KERNEL32(00000000,00000000,00000010,?,?,00000000,?,?,00000001,?,?,?,002E7E7A,?,7D8B83E9), ref: 0036C5F0
LocalReAlloc.KERNEL32(?,00000000,00000002,00000010,?,?,00000000,?,?,00000001,?,?,?,002E7E7A,?,7D8B83E9), ref: 0036C5FE
TlsSetValue.KERNEL32(?,00000000,7D8B83E9), ref: 0036C62F
RtlLeaveCriticalSection.NTDLL(002E7E7A), ref: 0036C64D

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: AllocCriticalLocalSectionValue$EnterH_prolog3_catchLeave
String ID:
API String ID: 1707010094-0
Opcode ID: d0e663801b133199bd8877385007fce23e3f616f8df14412ccb38b4964e0da7d
Instruction ID: 354e57fd871cc1ac28a3d5167cf3eef68025fa3ea22139b50a22a1c0a8185180
Opcode Fuzzy Hash: d0e663801b133199bd8877385007fce23e3f616f8df14412ccb38b4964e0da7d
Instruction Fuzzy Hash: 3A31C271500701DFCB26DF15C845A7BBBB5EF80320B15D46AE89A9B26ACB70ED10CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0036A015 Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 262COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 0036A01C
_strlen.LIBCMT ref: 0036A04D
VariantClear.OLEAUT32(?), ref: 0036A206

Strings

`<u, xrefs: 0036A318

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ClearH_prolog3_catch_Variant_strlen
String ID: `<u
API String ID: 1755785604-3367579956
Opcode ID: f277971f421e0515ef8ede4521fb26f0b2657c0da9b9969195f5a6d61eedc966
Instruction ID: bc68d9e5ab50f36487428408954f7f32134399ff5c664d202d97e331e6ee512e
Opcode Fuzzy Hash: f277971f421e0515ef8ede4521fb26f0b2657c0da9b9969195f5a6d61eedc966
Instruction Fuzzy Hash: 32A19D75800A19DBCF06DFA4C8408FEBBB5FF09310B298159E811BB259D735AD52DFA2

Uniqueness

Uniqueness Score: -1.00%

Function 0035B12F Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 258memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0035B139
SysAllocStringLen.OLEAUT32(?,00000000), ref: 0035B20A
SetWindowPos.USER32(?,?,00000000,00000000,00000000,00000000,00000013,00000001,00000000,?,00000000,?,?,00000000,00000378,00000000), ref: 0035B3C8
SysFreeString.OLEAUT32(?), ref: 0035B419

Strings

`<u, xrefs: 0035B419
?J, xrefs: 0035B1E3

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: String$AllocFreeH_prolog3_Window
String ID: ?J$`<u
API String ID: 1244472968-1911096745
Opcode ID: c6e8ba06214b9cdd9b367545d2827392a07c44b1733fcfec51d768df045f7155
Instruction ID: c15ec06bfac9c836038ca2af83653ac35fe46a242e10d1443f24324252170ab4
Opcode Fuzzy Hash: c6e8ba06214b9cdd9b367545d2827392a07c44b1733fcfec51d768df045f7155
Instruction Fuzzy Hash: AEB1F3B5D002199FCF15CFA9C890AADFBB5FF48310F14816AE809AB355E734A945CF60

Uniqueness

Uniqueness Score: -1.00%

Function 00320210 Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 243sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 002D8570: __Init_thread_footer.LIBCMT ref: 002D85F8

Sleep.KERNEL32(000007D0), ref: 0032046B

Strings

Software\Adobe\Acrobat Reader\DC\AVAlert\cCheckbox, xrefs: 00320425
Software\Adobe\Adobe Acrobat\DC\AVAlert\cCheckbox, xrefs: 003203C3
iAppDoNotTakePDFOwnershipAtLaunchWin10, xrefs: 003203E7
AcroExch.Document.DC, xrefs: 00320339
pdf_user_choice, xrefs: 0032026E, 003202F1, 00320504
Acrobat.Document.DC, xrefs: 00320548

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Init_thread_footerSleep
String ID: AcroExch.Document.DC$Acrobat.Document.DC$Software\Adobe\Acrobat Reader\DC\AVAlert\cCheckbox$Software\Adobe\Adobe Acrobat\DC\AVAlert\cCheckbox$iAppDoNotTakePDFOwnershipAtLaunchWin10$pdf_user_choice
API String ID: 1811701964-3549503691
Opcode ID: 160719634ac6869bec2e3aae4a726810212845cbd7638dbe4b2021b5ae591ec9
Instruction ID: 6564bcb5571b417bb4d75853edec0d46f3d5c5dce2e231668f841187ec459489
Opcode Fuzzy Hash: 160719634ac6869bec2e3aae4a726810212845cbd7638dbe4b2021b5ae591ec9
Instruction Fuzzy Hash: 85A1BD71D103189BDB25DFA0C859BEEBBB0AF15314F65426AE1017B292EB706E89CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0030E470 Relevance: 10.7, APIs: 7, Instructions: 206threadCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,7D8B83E9,?,?), ref: 0030E4C3
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,7D8B83E9,?,?), ref: 0030E4DF
TerminateThread.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,7D8B83E9,?,?), ref: 0030E516
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,7D8B83E9,?,?), ref: 0030E522
TerminateThread.KERNEL32(74DF2EE0,000000FF,?,?,?,?,?,?,?,?,?,?,?,7D8B83E9,?,?), ref: 0030E556
CloseHandle.KERNEL32(74DF2EE0,?,?,?,?,?,?,?,?,?,?,?,7D8B83E9,?,?), ref: 0030E55D
CoInitialize.OLE32(00000000), ref: 0030E669

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CloseHandle$TerminateThread$Initialize
String ID:
API String ID: 196183332-0
Opcode ID: 505a6ca987ef2d7b1112fff55e69d8bafba227741d3104f25c13b871a15fbc11
Instruction ID: 80988344ee7508038684da6127c070b0ef32119cd0af228d9c73a9bd1c271610
Opcode Fuzzy Hash: 505a6ca987ef2d7b1112fff55e69d8bafba227741d3104f25c13b871a15fbc11
Instruction Fuzzy Hash: 27711171A00605EFDB15DF68CC55BAAFBB8FF05324F104A2AE424972D1DB74EA14CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00345550 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 49fileCOMMON

Download Yara Rule

APIs

PathFileExistsW.SHLWAPI(?,00000000,?,?,00348ACE,?,?), ref: 00345559
DeleteFileW.KERNEL32(?,?,00348ACE,?,?), ref: 00345583
GetLastError.KERNEL32(?,?,?,00348ACE,?,?), ref: 00345595
GetLastError.KERNEL32(?,?,?,00348ACE,?,?), ref: 003455A5

Strings

File does not exist at %s, xrefs: 00345569
Failed to delete file at path:%ls error:%d, xrefs: 003455AB

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ErrorFileLast$DeleteExistsPath
String ID: Failed to delete file at path:%ls error:%d$File does not exist at %s
API String ID: 2844817965-1968543198
Opcode ID: c9be9eca456dad325e5f3998027c73b68af390da5c04a8fc3d3fe0c897486a6e
Instruction ID: 66a25993caa049900933003c8b459a8aaf266ab6c7498452bafc462899dbceb7
Opcode Fuzzy Hash: c9be9eca456dad325e5f3998027c73b68af390da5c04a8fc3d3fe0c897486a6e
Instruction Fuzzy Hash: 3D01D6756001087FD7019F69DC85A7ABBECEF49255B0040A4FD0DCB212DA32AC21CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0036D066 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,003572B1,00000000), ref: 0036D078
GetProcAddress.KERNEL32(00000000,ApplicationRecoveryInProgress), ref: 0036D088
RtlEncodePointer.NTDLL(00000000), ref: 0036D091
RtlDecodePointer.NTDLL(00000000), ref: 0036D09F

Strings

ApplicationRecoveryInProgress, xrefs: 0036D082
kernel32.dll, xrefs: 0036D073

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: ApplicationRecoveryInProgress$kernel32.dll
API String ID: 2061474489-2899047487
Opcode ID: b4a60338463ff2145b269b3ba06e6a5b51c837e3a712dcc7b9e64bf34e5d8c3f
Instruction ID: 5e4c3b8552568d5427c8606b81bef2cce14fc4d1ea4edc2f45510ae6bc77488f
Opcode Fuzzy Hash: b4a60338463ff2145b269b3ba06e6a5b51c837e3a712dcc7b9e64bf34e5d8c3f
Instruction Fuzzy Hash: 42F02734B023119B87222B30BC0883A3BAC6A84742B014030FD0AD3325CB718C11DAA9

Uniqueness

Uniqueness Score: -1.00%

Function 0036D011 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,?,003572F4,00000001), ref: 0036D023
GetProcAddress.KERNEL32(00000000,ApplicationRecoveryFinished), ref: 0036D033
RtlEncodePointer.NTDLL(00000000), ref: 0036D03C
RtlDecodePointer.NTDLL(00000000), ref: 0036D04A

Strings

kernel32.dll, xrefs: 0036D01E
ApplicationRecoveryFinished, xrefs: 0036D02D

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Pointer$AddressDecodeEncodeHandleModuleProc
String ID: ApplicationRecoveryFinished$kernel32.dll
API String ID: 2061474489-1962646049
Opcode ID: 1f059de38e6af1e93a26a5bfc9942ba5ee6b1f956a264998c5a9611a0f401bc1
Instruction ID: 404da082aa0051053784a9e137ef35dcc1e14a7c2cd85d1c3cf2bb71f89a9bc4
Opcode Fuzzy Hash: 1f059de38e6af1e93a26a5bfc9942ba5ee6b1f956a264998c5a9611a0f401bc1
Instruction Fuzzy Hash: 46F06575B423159B87221F70BD088797B9CAA847527054075FD05D3265DB349C21DBE9

Uniqueness

Uniqueness Score: -1.00%

Function 003051B0 Relevance: 9.2, APIs: 6, Instructions: 167COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00305200
std::_Lockit::_Lockit.LIBCPMT ref: 00305222
std::_Lockit::~_Lockit.LIBCPMT ref: 0030524A
__Getctype.LIBCPMT ref: 0030532E
std::_Facet_Register.LIBCPMT ref: 0030539E
std::_Lockit::~_Lockit.LIBCPMT ref: 003053C8

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_GetctypeRegister
String ID:
API String ID: 1102183713-0
Opcode ID: 02f583c15b402df795eed922045148401950eb5ea71c314a8c89b0975abad6ee
Instruction ID: 02532f46d0bdbacd064a7c705beb9bba84e46817cc5a5b8c9e9e5cc605ed5fa9
Opcode Fuzzy Hash: 02f583c15b402df795eed922045148401950eb5ea71c314a8c89b0975abad6ee
Instruction Fuzzy Hash: 9A71BFB0D01648CFDB12CF68C5507AEBBF8EF18314F14855ED849AB391E774AA84DB91

Uniqueness

Uniqueness Score: -1.00%

Function 002F6090 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 403COMMON

Download Yara Rule

APIs

Part of subcall function 00338D00: SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001C,00000000,?), ref: 00338D23

PathAppendW.SHLWAPI(00000000,?,?,?,?,?), ref: 002F616E
PathFileExistsW.SHLWAPI(?,pathValid.txt,0000000D,7D8B83E9,?,?), ref: 002F61BA
PathIsDirectoryW.SHLWAPI(?), ref: 002F61D4

Strings

pathValid.txt, xrefs: 002F6105
parent UNC Path in Child: %s, xrefs: 002F6437

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Path$AppendDirectoryExistsFileFolderSpecial
String ID: parent UNC Path in Child: %s$pathValid.txt
API String ID: 2104674270-357044310
Opcode ID: 01f9274040e83c3d84c94f62452fa8db886ef92ccbbc6cd784e9a91397f4d1bb
Instruction ID: 1ac5b9fcb61270cbcd3fd4a73180fe587a1e6beef83a0a8fa80ead0cc651c64c
Opcode Fuzzy Hash: 01f9274040e83c3d84c94f62452fa8db886ef92ccbbc6cd784e9a91397f4d1bb
Instruction Fuzzy Hash: 0E02CF71D1025DCBDF14DFA4C858BEEBBB0EF14308F544169D405AB282EB75AA96CF90

Uniqueness

Uniqueness Score: -1.00%

Function 003344D0 Relevance: 9.1, APIs: 6, Instructions: 103COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00334506
std::_Lockit::_Lockit.LIBCPMT ref: 00334529
std::_Lockit::~_Lockit.LIBCPMT ref: 00334549
std::_Facet_Register.LIBCPMT ref: 003345BB
std::_Lockit::~_Lockit.LIBCPMT ref: 003345D3
Concurrency::cancel_current_task.LIBCPMT ref: 003345F6

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 360a93b84daf8ffba730ec09041b1172253b5af02284e0892ba8c208e8176774
Instruction ID: 74b72a2791a8bdbd6bcf763998f79b4b91c374219fe396e327e225028abdec17
Opcode Fuzzy Hash: 360a93b84daf8ffba730ec09041b1172253b5af02284e0892ba8c208e8176774
Instruction Fuzzy Hash: 4B41D172D002198FDB12CF55E9806AEBBB8FF1A724F15415AE81667351E734BE44CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 003320D0 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 87COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00577C78,000000FF,00000000,00000000,00000405,?,?,00000000,00000038,?), ref: 003320EB
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00577C78,000000FF,00000000,?), ref: 0033213B
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,005337DC,?,?,00000000), ref: 00332145

Strings

Failed to convert MultiByteToWideChar. ErrorCode::%d, xrefs: 0033214C
Error allocating memory while converting UTF8 string to Native string, xrefs: 0033210B
StringUtils, xrefs: 00332115, 00332156

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: Error allocating memory while converting UTF8 string to Native string$Failed to convert MultiByteToWideChar. ErrorCode::%d$StringUtils
API String ID: 1717984340-281077328
Opcode ID: 5014388afca282fe18b1c142143740e096d0e96497be0dd5355c13cc98e01ee1
Instruction ID: ef6eb9b1e330f539ae8e9e4b595f632332834a4712f836a1413c34bbca41d4ab
Opcode Fuzzy Hash: 5014388afca282fe18b1c142143740e096d0e96497be0dd5355c13cc98e01ee1
Instruction Fuzzy Hash: 0A212E76B8031037CB2177A97C07FEF3B68DF86720F0501A9FE09A72C2D965551186A5

Uniqueness

Uniqueness Score: -1.00%

Function 00341310 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 215COMMON

Download Yara Rule

Strings

The file has changed on the server. Please close this workflow and try again., xrefs: 0034362C
The new ETAG (%s) is different from the previous ETAG value (%s). So, the current download is invalid., xrefs: 00343614
dle is not paused. So, no need to resume, xrefs: 00343493
ETag, xrefs: 003434BF, 0034358A, 003435D0

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID:
String ID: ETag$The file has changed on the server. Please close this workflow and try again.$The new ETAG (%s) is different from the previous ETAG value (%s). So, the current download is invalid.$dle is not paused. So, no need to resume
API String ID: 0-2798059100
Opcode ID: a85b3f93121ece1b8622127c250cf52bc2d64832b6175991b04e15743ac3245d
Instruction ID: e97acdca0e26b6e7f6ea1c819f800d79c63ef5a136c915fa0c576e1600ab0e60
Opcode Fuzzy Hash: a85b3f93121ece1b8622127c250cf52bc2d64832b6175991b04e15743ac3245d
Instruction Fuzzy Hash: E581B070910249DBDB15DF74C895BEEBBB4AF04318F20421EE456AB391DB346A44CB55

Uniqueness

Uniqueness Score: -1.00%

Function 003284A0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 206COMMON

Download Yara Rule

APIs

Part of subcall function 002D8570: __Init_thread_footer.LIBCMT ref: 002D85F8

RtlEnterCriticalSection.NTDLL(-0000018C), ref: 003286BB
RtlLeaveCriticalSection.NTDLL(-0000018C), ref: 003286DC

Part of subcall function 003205B0: SendMessageW.USER32(?,00000BCA,00000000,00000000), ref: 003205E8

Part of subcall function 002D8620: __Init_thread_footer.LIBCMT ref: 002D8742

Strings

Downloading : %s, xrefs: 003286F5
Starting download for all packages., xrefs: 003285DE
GoCart, xrefs: 0032867B

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CriticalInit_thread_footerSection$EnterLeaveMessageSend
String ID: Downloading : %s$GoCart$Starting download for all packages.
API String ID: 1743593657-1678466242
Opcode ID: 75e5bfa1c33c056eea5cd3d027073a65fb5b1f56e9f2693c4036f7d13292d7ce
Instruction ID: 97bc32f5f1b0249e5e991ba3dae1d1e61a34cf67e15f65d633e46211d5c79d68
Opcode Fuzzy Hash: 75e5bfa1c33c056eea5cd3d027073a65fb5b1f56e9f2693c4036f7d13292d7ce
Instruction Fuzzy Hash: BE810171A01204AFDB15DF68E886BA9FBB0FF41314F25826AE81467382DF70AC55CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0032D4F0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 196COMMON

Download Yara Rule

APIs

Part of subcall function 002D8570: __Init_thread_footer.LIBCMT ref: 002D85F8

Part of subcall function 0033A120: _com_issue_errorex.COMSUPP ref: 0033A196

__Init_thread_footer.LIBCMT ref: 0032D638

Strings

Acrobat Pro DC, xrefs: 0032D685
Received Launch Acrobat Check Box click message, xrefs: 0032D52D
AcrobatDCCheckBox, xrefs: 0032D6E2, 0032D751
//launchAcrobat, xrefs: 0032D59F

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Init_thread_footer$_com_issue_errorex
String ID: //launchAcrobat$Acrobat Pro DC$AcrobatDCCheckBox$Received Launch Acrobat Check Box click message
API String ID: 1829800392-2360623104
Opcode ID: 4690bbe471c183acdfb27b05cffc1a81feb1ea524d9fd973d05ce93e1856779b
Instruction ID: b174ca3126b18a4e7aece527af1be70a0c5f61fd3c3c4b370de063f5a864d45d
Opcode Fuzzy Hash: 4690bbe471c183acdfb27b05cffc1a81feb1ea524d9fd973d05ce93e1856779b
Instruction Fuzzy Hash: A3819F30D10259DFDB11DFA4D855BEEBBB0BF55304F214269E005AB282DBB56A48CB91

Uniqueness

Uniqueness Score: -1.00%

Function 002E21E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,002DFE4B,00000006,002DFE4A), ref: 002E2264
LoadResource.KERNEL32(00000000,00000000), ref: 002E2277
LockResource.KERNEL32(00000000), ref: 002E2286
SizeofResource.KERNEL32(?,?), ref: 002E229C

Strings

|x5, xrefs: 002E222D, 002E2296, 002E2345

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID: |x5
API String ID: 3473537107-335511547
Opcode ID: fd962c98d26161036e784677e2741d8e88498d45fdc1b0a2b3f75d6eae6a86ae
Instruction ID: 06d8e048cdbffd12291bef6cce4752e9277d517655d14cb1eb148b814a332b67
Opcode Fuzzy Hash: fd962c98d26161036e784677e2741d8e88498d45fdc1b0a2b3f75d6eae6a86ae
Instruction Fuzzy Hash: 38412431A10556DFDB249F2ACC45A3EB7A9EF41301F4041ADF9039B3A1EB789D28CE90

Uniqueness

Uniqueness Score: -1.00%

Function 0033C240 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(?,Advapi32.dll,7D8B83E9), ref: 0033C2B0
GetProcAddress.KERNEL32(00000000,CreateProcessWithTokenW), ref: 0033C2C4
FreeLibrary.KERNEL32(00000000), ref: 0033C303

Strings

Advapi32.dll, xrefs: 0033C297
CreateProcessWithTokenW, xrefs: 0033C2BE

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: Advapi32.dll$CreateProcessWithTokenW
API String ID: 145871493-2244679747
Opcode ID: 0a921398c3c25c73e7989f6a1604d7af79e0989ed8052ffb5b55af3fcd1643cb
Instruction ID: afcdd1e68e8bef65dc4ca53dea9be8a13c0caaa7f96aa83e9a9253fac693220e
Opcode Fuzzy Hash: 0a921398c3c25c73e7989f6a1604d7af79e0989ed8052ffb5b55af3fcd1643cb
Instruction Fuzzy Hash: EE31F172A01218EFCF01DFA9D984ADEBBF5FB08720F41412AF915E3250E7359911CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00364137 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 0036413E
GetTopWindow.USER32(00000000), ref: 00364181
GetWindow.USER32(00000000,00000002), ref: 003641A3

Strings

U5, xrefs: 0036416D, 00364159

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Window
String ID: U5
API String ID: 2353593579-1897351987
Opcode ID: ea8798042463d4406bd45d5d7310f459770e5f4773bfe6089218d2b26a5cf691
Instruction ID: 91763bbfdd4f89be365faec51359cbc6ee3a42f4b5332dd15dda98499acf3db4
Opcode Fuzzy Hash: ea8798042463d4406bd45d5d7310f459770e5f4773bfe6089218d2b26a5cf691
Instruction Fuzzy Hash: 4001A53240111AEBDF236F90ED09E9E3B29BF26361F058014FA1954064C776C9B5EBA5

Uniqueness

Uniqueness Score: -1.00%

Function 002FC500 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 165stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 002FC5AA

Strings

!I, xrefs: 002FC58F
{AC76BA86-0000-0000-BA7E-7E8A45000000}, xrefs: 002FC54E
VersionString, xrefs: 002FC5E6
{AC76BA86-0000-0000-7760-7E8A45000000}, xrefs: 002FC544

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: lstrlen
String ID: !I$VersionString${AC76BA86-0000-0000-7760-7E8A45000000}${AC76BA86-0000-0000-BA7E-7E8A45000000}
API String ID: 1659193697-167949492
Opcode ID: fd172df0351ee5587f23167e3bfd15369612de75aa725346d91283942f2aaa14
Instruction ID: 85f21a5a8c797044b2a83073014dcf22bb4c7f9f9ed87f4a8bc221f8b9e41a25
Opcode Fuzzy Hash: fd172df0351ee5587f23167e3bfd15369612de75aa725346d91283942f2aaa14
Instruction Fuzzy Hash: 417162B191061C9BCB20DF24CC55BEAB7B8FF54308F5042D9E609A7241EB30AB95CF58

Uniqueness

Uniqueness Score: -1.00%

Function 003341F0 Relevance: 7.6, APIs: 5, Instructions: 122COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0033422A
std::_Lockit::_Lockit.LIBCPMT ref: 00334248
std::_Lockit::~_Lockit.LIBCPMT ref: 00334268
std::_Facet_Register.LIBCPMT ref: 0033432C
std::_Lockit::~_Lockit.LIBCPMT ref: 00334344

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Facet_Register
String ID:
API String ID: 459529453-0
Opcode ID: bb61b1f0d21c14e515231a6156b462b67ada8905e222a4541adb2a9f7187b651
Instruction ID: c0bf6ed95398b82bc15fa5543f9dc48878ec49b73c54be227ec06df295b2cb2f
Opcode Fuzzy Hash: bb61b1f0d21c14e515231a6156b462b67ada8905e222a4541adb2a9f7187b651
Instruction Fuzzy Hash: DD41CD71A002158FCB12CF65D981AAFB7B8FB14714F15456AE806AB350EB34BE45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 003572FE Relevance: 7.6, APIs: 5, Instructions: 118memorystringCOMMON

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 0035736B
GlobalFix.KERNEL32(00000000), ref: 00357394
lstrcmpW.KERNEL32(00000000,00000000,?,?,?,?,?,?,00372F98,000000F1,00000010,0037395F,0055A76C,00000010,00000008,003736B2), ref: 003573AD
GlobalAlloc.KERNEL32(00000042,00000000,00000000,00000001,00000000,00000000,00000000,00000000,00000000,00000001,00000000,00000000,?,?,?,?), ref: 003573EA
GlobalFix.KERNEL32(00000000), ref: 003573F8

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Global$Alloc_memcpy_slstrcmp
String ID:
API String ID: 4126437549-0
Opcode ID: 5af00e3ac8ab5f90a4cf5e23ba5e41dc260b1cc4520cf3ced761a0741accf1ab
Instruction ID: 7c61b83c8e58eab5cd8fe9869e098246ff4180f246adc1378271fcf92a07dbff
Opcode Fuzzy Hash: 5af00e3ac8ab5f90a4cf5e23ba5e41dc260b1cc4520cf3ced761a0741accf1ab
Instruction Fuzzy Hash: F541B0B1600208AFEB129F65DC85D6A7BADEF44745F05446AFE0287272DB30DD10DB90

Uniqueness

Uniqueness Score: -1.00%

Function 003AB516 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 185COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 003AB51D
GetObjectW.GDI32(00000000,00000018,?), ref: 003AB6D2
DeleteObject.GDI32(00000000), ref: 003AB72A

Strings

3&7, xrefs: 003AB713, 003AB71C, 003AB716, 003AB721, 003AB729

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Object$DeleteH_prolog3
String ID: 3&7
API String ID: 657949336-2718934256
Opcode ID: f54edafa6d4754b7506000e6a8c76ccc5997c0e19a3deeefdad7d9e5f1fadd0b
Instruction ID: 0a68296f5744f68b21a600d219ca63b160e3982531c63231d2c93d0d180395f7
Opcode Fuzzy Hash: f54edafa6d4754b7506000e6a8c76ccc5997c0e19a3deeefdad7d9e5f1fadd0b
Instruction Fuzzy Hash: C2719C71C006148BCF1AEF65C8847AEBBB5FF4A310F1581AAEC146F296CB758944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0030A390 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 177synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 0030A451
RtlEnterCriticalSection.NTDLL(-0000018C), ref: 0030A52D
RtlLeaveCriticalSection.NTDLL(-0000018C), ref: 0030A54E

Strings

InstallationSkipped, xrefs: 0030A4DA, 0030A58C

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CriticalSection$EnterLeaveObjectSingleWait
String ID: InstallationSkipped
API String ID: 501323975-1569378864
Opcode ID: dd7a0ff74afde71309e3ecc0e9c69ae98b4a007fd7d20ddf01efac5884003db4
Instruction ID: 5e07528b0711993e8daee83d0bd3c10c9e1dce3a61394fdcccf444ebb55812e9
Opcode Fuzzy Hash: dd7a0ff74afde71309e3ecc0e9c69ae98b4a007fd7d20ddf01efac5884003db4
Instruction Fuzzy Hash: E471C571E007059FDB11DF68D819BAA7BB1FF45318F258268E404AF382D771E942CB91

Uniqueness

Uniqueness Score: -1.00%

Function 002E04C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 002E0520
_com_issue_error.COMSUPP ref: 002E055C
SysFreeString.OLEAUT32(-00000001), ref: 002E0590

Strings

`<u, xrefs: 002E0590

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: String$AllocFree_com_issue_error
String ID: `<u
API String ID: 1786537486-3367579956
Opcode ID: 26d268990d5aebd08c468f15e4a727219a240f289a0528d44a29a1eb889726f9
Instruction ID: 828f0a458b2bc82cd918c283a035389566f84e9db4c71b8489db133687e289f3
Opcode Fuzzy Hash: 26d268990d5aebd08c468f15e4a727219a240f289a0528d44a29a1eb889726f9
Instruction Fuzzy Hash: 7931D7B1950756ABD7208F1AD844B5BBBE8FF40720F50462EEC1597280E7F4A955CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00339240 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

PathRemoveFileSpecW.SHLWAPI(00000000,?,?,?,?), ref: 003392BB
GetLastError.KERNEL32(?,?,?,?), ref: 003392C5

Strings

FileUtils, xrefs: 003392D6
Failed to remove file spec error: %d, xrefs: 003392CC

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ErrorFileLastPathRemoveSpec
String ID: Failed to remove file spec error: %d$FileUtils
API String ID: 3648509562-2156732388
Opcode ID: 399f08675d8f28f517280993386eef7ca41ca2bd6b797cb3b85759341bc295af
Instruction ID: 32be03d9f6eb36d92f80527fac4120380f339d51c15f0c8b3d8b9525abfb7c23
Opcode Fuzzy Hash: 399f08675d8f28f517280993386eef7ca41ca2bd6b797cb3b85759341bc295af
Instruction Fuzzy Hash: 86216172600714EBC725AB54EC81FBB73ACEF96300F45056AFC06CB152E7A5B910C6A5

Uniqueness

Uniqueness Score: -1.00%

Function 003412A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 65COMMON

Download Yara Rule

Strings

already stopped. No need to stop now, xrefs: 00342108
failed to stop the file downloader, xrefs: 00342139

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CriticalEnterSection
String ID: already stopped. No need to stop now$failed to stop the file downloader
API String ID: 1904992153-1172314604
Opcode ID: f5aa12eb44204116e1c0ae1122aaa14ca718146a8f7cf215dc3ff54a38f8bbdc
Instruction ID: d076ed6596044af00f7a583b77bbf463db78df484624d498fefd567e779241e4
Opcode Fuzzy Hash: f5aa12eb44204116e1c0ae1122aaa14ca718146a8f7cf215dc3ff54a38f8bbdc
Instruction Fuzzy Hash: 33119031600A019FD722AF28EC55B96B3E8AF50314F50452EF556DE1A2DF60B88ACA95

Uniqueness

Uniqueness Score: -1.00%

Function 004C057B Relevance: 6.3, APIs: 4, Instructions: 338fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(7D8B83E9,004C120D,00000000,?), ref: 004C05DE

Part of subcall function 004C76B6: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,0000FDE9,00000000,-00000008,00000000,?,004C3F37,?,00000000,-00000008), ref: 004C7762

WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 004C0839
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 004C0881
GetLastError.KERNEL32 ref: 004C0924

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: FileWrite$ByteCharConsoleErrorLastMultiOutputWide
String ID:
API String ID: 2112829910-0
Opcode ID: a09131df7217316b048b4e99b4fa1ca11b72d6d4cdddfb59b68896dc1191d2b4
Instruction ID: f5bf2290f82f784445a35d08f62fb8a8fdacdefc87f292934bfce9dd25d75771
Opcode Fuzzy Hash: a09131df7217316b048b4e99b4fa1ca11b72d6d4cdddfb59b68896dc1191d2b4
Instruction Fuzzy Hash: 84D158B9E04248DFCB15CFA8D880AADBBB4FF49304F18816EE455E7352D734A946CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0034F150 Relevance: 6.2, APIs: 4, Instructions: 234COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 0034F212
__aulldiv.LIBCMT ref: 0034F2DA
__aulldiv.LIBCMT ref: 0034F361
__aulldiv.LIBCMT ref: 0034F382

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: 0044c3175a0cf309a1959604e4a280beb9391e38d5f14ce19050f97b5d7fd7e9
Instruction ID: fec31ed1b8be46c48afe983fe3adace658e53462d40c8d2925328556b2bd705e
Opcode Fuzzy Hash: 0044c3175a0cf309a1959604e4a280beb9391e38d5f14ce19050f97b5d7fd7e9
Instruction Fuzzy Hash: 9391C875E102159FCB48DF69C980AA9BBF5FF8C310B1541AAE818EB316D774AD41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 002FC020 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 156stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 002FC0B0

Strings

{A6EADE66-0000-0000-484E-7E8A45000000}, xrefs: 002FC090
!I, xrefs: 002FC095
VersionString, xrefs: 002FC0EC

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: lstrlen
String ID: !I$VersionString${A6EADE66-0000-0000-484E-7E8A45000000}
API String ID: 1659193697-3318499031
Opcode ID: 69d1290baae20f0a2605c231d9ff4d98ee9cdd250d0821b07276422e2e42c5cf
Instruction ID: 2188884f5ead37df8ebd895043e0284b2da1a9b77d72887568cc89584d1e6eea
Opcode Fuzzy Hash: 69d1290baae20f0a2605c231d9ff4d98ee9cdd250d0821b07276422e2e42c5cf
Instruction Fuzzy Hash: F86191B191021C9BCB20DF64CD95BEAB3B8EF55304F5042DAE609A7241EB70AF85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 002FC290 Relevance: 6.2, APIs: 1, Strings: 3, Instructions: 156stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?), ref: 002FC320

Strings

!I, xrefs: 002FC305
VersionString, xrefs: 002FC35C
{AC76BA86-0000-0000-7760-7E8A45000000}, xrefs: 002FC300

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: lstrlen
String ID: !I$VersionString${AC76BA86-0000-0000-7760-7E8A45000000}
API String ID: 1659193697-3696887189
Opcode ID: 15642510b3014b17b6916a5c68cd46bee9ca2f07be1bcac0aed5ae021c950459
Instruction ID: 3f88168149ebf37d3324d53c7a2defdbd0be881987636430827e8a092e11c84f
Opcode Fuzzy Hash: 15642510b3014b17b6916a5c68cd46bee9ca2f07be1bcac0aed5ae021c950459
Instruction Fuzzy Hash: C16191B191021D9BCB20DF24CD95BEAB3B8EF55304F5042DAE609A7281EB70AB85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0035935E Relevance: 6.1, APIs: 4, Instructions: 122threadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 003592A9: GetParent.USER32(?), ref: 00359309

GetWindowThreadProcessId.USER32(?,?), ref: 003593BF
GetCurrentProcessId.KERNEL32 ref: 003593C9
SendMessageW.USER32(?,00000376,00000000,00000000), ref: 003593DF
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 0035946A

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Process$CurrentFileMessageModuleNameParentSendThreadWindow
String ID:
API String ID: 2033580816-0
Opcode ID: fa776286e97a35d26c503f59995f6418c14207f41d9da705d766d247552154fa
Instruction ID: bc802a3c23fe04b4de1fe66ba3c996999fbe2013a9ffd39544bbeab03f3561bb
Opcode Fuzzy Hash: fa776286e97a35d26c503f59995f6418c14207f41d9da705d766d247552154fa
Instruction Fuzzy Hash: 9441B2B5A4021DDFCB22DF69DC88BA977B8FB14301F0545AAE909D7260D7708E898B50

Uniqueness

Uniqueness Score: -1.00%

Function 002E2540 Relevance: 6.1, APIs: 4, Instructions: 100COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00000000,?,00000006,?,?,?,?,?,00356C03,?,00000000,00000004,80004005,?,00000000), ref: 002E2581
LoadResource.KERNEL32(00000000,00000000,?,?,?,?,00356C03,?,00000000,00000004,80004005,?,00000000,?,003671BB,00000000), ref: 002E2594
LockResource.KERNEL32(00000000,?,?,?,?,00356C03,?,00000000,00000004,80004005,?,00000000,?,003671BB,00000000,00000000), ref: 002E25A3
SizeofResource.KERNEL32(00000001,?,?,?,?,?,00356C03,?,00000000,00000004,80004005,?,00000000,?,003671BB,00000000), ref: 002E25B9

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof
String ID:
API String ID: 3473537107-0
Opcode ID: e8ecaf89cf3f8c6073701773f967b6ee6fcf793ed7450a27d4854c7980c93bd2
Instruction ID: a2538c0612e11753762c20604195287459c97994f7c90551f79ad55abe1544b8
Opcode Fuzzy Hash: e8ecaf89cf3f8c6073701773f967b6ee6fcf793ed7450a27d4854c7980c93bd2
Instruction Fuzzy Hash: DD313871551562DFCB209F2BDD4497AB7ECFF85300B80066EF942CB261DA30DC68CAA4

Uniqueness

Uniqueness Score: -1.00%

Function 00371535 Relevance: 6.0, APIs: 4, Instructions: 37COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00574EA0), ref: 00371566
RtlInitializeCriticalSection.NTDLL(00000000), ref: 0037157C
RtlLeaveCriticalSection.NTDLL(00574EA0), ref: 0037158A
RtlEnterCriticalSection.NTDLL(00000000), ref: 00371597

Part of subcall function 003714CC: RtlInitializeCriticalSection.NTDLL(00574EA0), ref: 003714E4

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CriticalSection$EnterInitialize$Leave
String ID:
API String ID: 713024617-0
Opcode ID: c80ecd3f8c1017058756108debbac6886199be35a44eb03622ff6805763ac426
Instruction ID: 96287527d036851a7237777fa229238e8840831bc333205d848194cb7f1aa94e
Opcode Fuzzy Hash: c80ecd3f8c1017058756108debbac6886199be35a44eb03622ff6805763ac426
Instruction Fuzzy Hash: B7F09C735001189FDB152B58FC49B39766CFBD2375F815025F94993122D738CC49EE96

Uniqueness

Uniqueness Score: -1.00%

Function 0036C4AC Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

RtlEnterCriticalSection.NTDLL(00574C80), ref: 0036C4B8
TlsGetValue.KERNEL32(00574C64,?,?,?,?,0036C4A8,00000000,00000004,00369CB2,00356155,00367584,002E1FC2,00000001,?,?,?), ref: 0036C4CC
RtlLeaveCriticalSection.NTDLL(00574C80), ref: 0036C4E6
RtlLeaveCriticalSection.NTDLL(00574C80), ref: 0036C4F1

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CriticalSection$Leave$EnterValue
String ID:
API String ID: 3969253408-0
Opcode ID: b7649bcb53d5c224d81db187b7437431091f8cba1e638922dea86639b729bdb9
Instruction ID: 57271861c08da7f009ee399f92b85f58d3f23d0bc14655daa05d065cf3ecbd39
Opcode Fuzzy Hash: b7649bcb53d5c224d81db187b7437431091f8cba1e638922dea86639b729bdb9
Instruction Fuzzy Hash: 96F090362102159BCB23DF26DC5897AF7ACEEC4364306D065E952A7216CE31EC11CAE0

Uniqueness

Uniqueness Score: -1.00%

Function 0049F23F Relevance: 6.0, APIs: 4, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,0049F1DC,00000064), ref: 0049F262
RtlLeaveCriticalSection.NTDLL(005767E0), ref: 0049F26C
WaitForSingleObjectEx.KERNEL32(?,00000000,?,0049F1DC,00000064,?,002D85B1,00577C54,7D8B83E9,00000000,004D1581,000000FF,?,002E67D5,HTTPSend_01,0000000B), ref: 0049F27D
RtlEnterCriticalSection.NTDLL(005767E0), ref: 0049F284

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID:
API String ID: 3269011525-0
Opcode ID: 4d1af9f92a479f36714ed51f143fbb3ad8d2f2d6d3f044e02214317395c88e32
Instruction ID: 5fd0ff45d3680c140190715de3d4648e2241223b536db295a670240cf3e4c127
Opcode Fuzzy Hash: 4d1af9f92a479f36714ed51f143fbb3ad8d2f2d6d3f044e02214317395c88e32
Instruction Fuzzy Hash: 19E09235501A34BBCA051B40FC09AA97F28EB887E5B008071F509A6161C7715825EFDD

Uniqueness

Uniqueness Score: -1.00%

Function 0035B457 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

GetWindow.USER32(?,00000002), ref: 0035B522

Strings

+J, xrefs: 0035B57E

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Window
String ID: +J
API String ID: 2353593579-3909002960
Opcode ID: 02bc4139fef20534a79cee5fda4766c2d2b3017cccef20a8f019439bf7651cd0
Instruction ID: 682636f3be8f5b9698f81e81f8b994aed8a25982fa5185a435188115a251b63f
Opcode Fuzzy Hash: 02bc4139fef20534a79cee5fda4766c2d2b3017cccef20a8f019439bf7651cd0
Instruction Fuzzy Hash: C9517071E00106DBDF2ACF99C840AAEF7B5EF89311F668529EC45A7350E7309E45DB50

Uniqueness

Uniqueness Score: -1.00%

Function 003AA1A2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(00000000), ref: 003AA1C2
CreateCompatibleDC.GDI32(00000000), ref: 003AA1CF

Strings

3&7, xrefs: 003AA202, 003AA247

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CompatibleCreate
String ID: 3&7
API String ID: 3111197059-2718934256
Opcode ID: 0569728dfa797bf236ae41bd1be637b20e24eeb689505bb4600b8c7932fb6a5b
Instruction ID: 1c406747ad8297c6c11f73d373a42c2e34499296aee57ec45ed67d9eb39982d3
Opcode Fuzzy Hash: 0569728dfa797bf236ae41bd1be637b20e24eeb689505bb4600b8c7932fb6a5b
Instruction Fuzzy Hash: FC31F6B19007009FCB85DF68D8843AA7BF5FF0A301F5046BAD855DE256E7B28645DF90

Uniqueness

Uniqueness Score: -1.00%

Function 0033B150 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

_com_issue_errorex.COMSUPP ref: 0033B19A

Part of subcall function 004A15E0: GetErrorInfo.OLEAUT32(00000000,?), ref: 004A1646

Strings

getRootNode ... XMLParser not Initialized ..., xrefs: 0033B1E5
XMLParser, xrefs: 0033B1EF

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: ErrorInfo_com_issue_errorex
String ID: XMLParser$getRootNode ... XMLParser not Initialized ...
API String ID: 1686768256-3694962709
Opcode ID: 172d9411ce95d7181d0057805dc0f241515ffa8a24883a46a4b8d8a08c34289e
Instruction ID: 0c6bba9687f72dc2028794bcb15d0bc7969a02b5bbb49b9185bc88feb7546f5c
Opcode Fuzzy Hash: 172d9411ce95d7181d0057805dc0f241515ffa8a24883a46a4b8d8a08c34289e
Instruction Fuzzy Hash: E7218E72E05218AFC725CF54C846FAABBA8FF05B24F01465EEC15A7390D775A900CB90

Uniqueness

Uniqueness Score: -1.00%

Function 002E84C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 002E84EB
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 002E854E

Part of subcall function 004A1C53: _Yarn.LIBCPMT ref: 004A1C72
Part of subcall function 004A1C53: _Yarn.LIBCPMT ref: 004A1C96

Strings

bad locale name, xrefs: 002E8571

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: 4b0562eb73c6d2aeb1a5328abb979b14b760466826c6f86a94b6e39bcff164c6
Instruction ID: b4d3f450887d54f7b7b952790ad2bafa0a292f31a166b6f07ef18202535b5c32
Opcode Fuzzy Hash: 4b0562eb73c6d2aeb1a5328abb979b14b760466826c6f86a94b6e39bcff164c6
Instruction Fuzzy Hash: B421F0B0808784EED721CF69C80474BBFF4AF25314F10869ED48597B81D3B9A704CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0049F076 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0049F657
___raise_securityfailure.LIBCMT ref: 0049F73F

Strings

(hW, xrefs: 0049F73A

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: (hW
API String ID: 3761405300-2436164530
Opcode ID: fcae94007cab5ac5df85dd5a099f862af83320ac9e1986c526b33f1dc7a0bdfd
Instruction ID: 6f02699d81b11ea38fa3644be71e5b14d58f6933f20d8f92313cbc4b0f4a19bf
Opcode Fuzzy Hash: fcae94007cab5ac5df85dd5a099f862af83320ac9e1986c526b33f1dc7a0bdfd
Instruction Fuzzy Hash: 9A21DFB4512A00DED704CF1AFD85A547BE4BB68714F20442AE608CB3A1E3B599CDFF49

Uniqueness

Uniqueness Score: -1.00%

Function 00342020 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,00001388), ref: 003420A1
CloseHandle.KERNEL32 ref: 003420A9

Strings

download is not complete and hence stopping the download now, xrefs: 00342056

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: CloseHandleObjectSingleWait
String ID: download is not complete and hence stopping the download now
API String ID: 528846559-3481887753
Opcode ID: 73a9ebb7386316057710bd948e56357db3a6851d1f0a5127611313157021da8c
Instruction ID: 126ace9bd70167c12b576e87be7d0f04d5f007aeeda91767ffe2d96744db1bc9
Opcode Fuzzy Hash: 73a9ebb7386316057710bd948e56357db3a6851d1f0a5127611313157021da8c
Instruction Fuzzy Hash: 81118E71100B009BD736AF28C809BA7BAE4BF41309F56482DF58AAE2A1DB757844CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00395197 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0039519E
SetRectEmpty.USER32(00000014), ref: 00395206

Strings

fT9, xrefs: 003951AF

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: EmptyH_prolog3Rect
String ID: fT9
API String ID: 1443337074-852066008
Opcode ID: bc75d6d1dc27fb26029e90b9b8fd6feff15d526b4b665d50339e16706b9af68e
Instruction ID: f07fd7bd26e5d152a23db9783ea30654b225c9be9e9947b77d7d33473ff33ee0
Opcode Fuzzy Hash: bc75d6d1dc27fb26029e90b9b8fd6feff15d526b4b665d50339e16706b9af68e
Instruction Fuzzy Hash: 37112AB0A01B02EFD309DF2AC581789FBA0BF19300F90862ED56D87251DB743129CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00356121 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 004A35BC: RaiseException.KERNEL32(E06D7363,00000001,00000003,?,?,?,?,004A1905,?,005670A0,?,?,?), ref: 004A361C

__EH_prolog3.LIBCMT ref: 0035615C

Part of subcall function 0036C010: LocalAlloc.KERNEL32(00000040,00000000,?,0035616B,00000164,00000004,0056C118,0055884C,?,?,0056C230,005587EC,?,?,?,00558890), ref: 0036C018

Strings

wO, xrefs: 0035612D
xO, xrefs: 00356147

Memory Dump Source

Source File: 00000000.00000002.2896650324.00000000002D1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002D0000, based on PE: true

Associated: 00000000.00000002.2896595272.00000000002D0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000056C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000579000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005EC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005F8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000005FC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000606000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.000000000060B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.0000000000620000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006BF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2896650324.00000000006F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897633372.000000000070D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2897660493.000000000070F000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2d0000_Reader_Install_Setup.jbxd

Similarity

API ID: AllocExceptionH_prolog3LocalRaise
String ID: xO$wO
API String ID: 4284520404-2436730409
Opcode ID: 55d6cc4ee2abfde4cab0f1c8416c8e1798ff7f8be66b64462dd6c200dadf0257
Instruction ID: 44af0db1b2f471d8c40f6d119af73071f7965a60a68fab1685c481d28c60be28
Opcode Fuzzy Hash: 55d6cc4ee2abfde4cab0f1c8416c8e1798ff7f8be66b64462dd6c200dadf0257
Instruction Fuzzy Hash: FEE0D86090030CF7D604FFD18C0BE9D7D9CD705708F50045A760067642EAF4AF084568

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Reader_Install_Setup.exe

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\160[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\d[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\d[2]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\231[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\p[1].gif

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\d[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\d[2]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\bxf0ivf[1].js

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\d[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\d[2]

C:\Users\user\AppData\Local\Temp\Adobe_ADMLogs\Adobe_ADM.log

C:\Users\user\AppData\Local\Temp\Adobe_ADMLogs\Adobe_GDE.log

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Windows Analysis Report
Reader_Install_Setup.exe

Function 002DEE50 Relevance: 81.4, APIs: 22, Strings: 24, Instructions: 914
libraryloadersynchronizationCOMMON

Function 002FD240 Relevance: 64.5, Strings: 51, Instructions: 725
COMMON

Function 002F9910 Relevance: 53.7, APIs: 5, Strings: 25, Instructions: 1152
COMMON

Function 002FC7B0 Relevance: 39.1, APIs: 4, Strings: 18, Instructions: 601
COMMON

Function 003213D0 Relevance: 34.2, APIs: 5, Strings: 14, Instructions: 940
windowCOMMON

Function 00322950 Relevance: 31.0, Strings: 24, Instructions: 1010
COMMON

Function 003207D0 Relevance: 30.4, APIs: 6, Strings: 11, Instructions: 608
COMMON

Function 0031F970 Relevance: 21.6, Strings: 17, Instructions: 315
COMMON

Function 003A5F39 Relevance: 68.6, APIs: 34, Strings: 5, Instructions: 366
stringCOMMON

Function 003A646A Relevance: 64.8, APIs: 43, Instructions: 298
COMMON

Function 002E3230 Relevance: 36.3, APIs: 12, Strings: 12, Instructions: 303
COMMON

Function 002FB670 Relevance: 33.7, APIs: 12, Strings: 7, Instructions: 408
COMMON

Function 00360BE8 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 189
windowCOMMON

Function 002E0EA0 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 233
windowCOMMON

Function 0036C0D1 Relevance: 21.2, APIs: 14, Instructions: 197
memoryCOMMON