Edit tour

Windows Analysis Report
drw_free_installer.17163939163819b153.exe

Overview

General Information

Sample name:	drw_free_installer.17163939163819b153.exe
Analysis ID:	1445894
MD5:	6e3bc255dc7b79e452c66610c741eb95
SHA1:	972d9adbec19dd1277b4329fa13641847ca18c87
SHA256:	bdb74a31956e7c2ce7a3c6344ac7265d84b735c1038a390168f01d6d9fa43b3a
Infos:

Detection

Score:	23
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

AI detected suspicious sample

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to create an SMB header

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found evasive API chain (date check)

Found evasive API chain (may stop execution after checking a module file name)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Potential key logger detected (key state polling based)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

drw_free_installer.17163939163819b153.exe (PID: 7416 cmdline: "C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe" MD5: 6E3BC255DC7B79E452C66610C741EB95)

EDownloader.exe (PID: 7440 cmdline: "C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_free_installer.17163939163819b153.exe ||| DOWNLOAD_VERSION=free ||| PRODUCT_VERSION=2.0.0 ||| INSTALL_TYPE=0 MD5: 8A250A75859FE52116E706A640E6D77C)

InfoForSetup.exe (PID: 7456 cmdline: /Uid "S-1-5-21-2246122658-3693405117-2476756634-1002" MD5: 99891AAA0E15B2A514A4FF5C9EC03F4D)

InfoForSetup.exe (PID: 7488 cmdline: /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"Switzerland\",\"Pageid\":\"17163939163819b153\",\"Timezone\":\"GMT-05:00\"}" MD5: 99891AAA0E15B2A514A4FF5C9EC03F4D)

AliyunWrapExe.exe (PID: 7504 cmdline: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.Exe MD5: F3B9A2D94682FEE26FC079BA1E0FB040)

cleanup

HTTP traffic detected: GET /product/index.php?c=main&a=getstatus&pid=2 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: track.easeus.comConnection: Keep-Alive

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe

Code function: 1_2_00FAE0C0 recv,

1_2_00FAE0C0

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 22 May 2024 16:07:00 GMTContent-Type: text/html; charset=UTF-8Content-Length: 21Connection: keep-aliveServer: ApacheContent-Encoding: gzipX-Via: 1.1 luoshan65:1 (Cdn Cache Server V2.0), 1.1 fra13:1 (Cdn Cache Server V2.0)X-Ws-Request-Id: 664e1822_kf98_16929-13800Data Raw: 1f 8b 08 00 00 00 00 00 00 03 33 00 00 21 df db f4 01 00 00 00 Data Ascii: 3!

Source: global traffic

Source: global traffic	DNS traffic detected: DNS query: track.easeus.com
Source: global traffic	DNS traffic detected: DNS query: easeusinfo.us-east-1.log.aliyuncs.com

Source: unknown

HTTP traffic detected: POST /logstores/logstore_drw_ip/shards/lb HTTP/1.1Host:easeusinfo.us-east-1.log.aliyuncs.comUser-Agent: log-c-lite_0.1.0Accept: */*Content-Type:application/x-protobufx-log-apiversion:0.6.0x-log-compresstype:lz4x-log-signaturemethod:hmac-sha1Date:Wed, 22 May 2024 16:06:59 GMTContent-MD5:A1955387E255B9FDEE28F34DF281DDF5Content-Length:248x-log-bodyrawsize:255Authorization:LOG LTAIBDHwLKKvsH19:wEJEW14HDW8fOSJPTmTMg59xCU0=Data Raw: f7 44 0a b7 01 08 a3 b0 b8 b2 06 12 17 0a 09 54 69 6d 65 73 74 61 6d 70 12 0a 31 37 31 36 33 39 34 30 31 35 12 17 0a 06 57 69 6e 64 6f 77 12 0d 57 65 62 5f 49 6e 73 74 61 6c 6c 65 72 12 20 0a 08 41 63 74 69 76 69 74 79 12 14 52 65 73 75 6c 74 5f 52 75 6e 22 00 f2 22 5b 0a 09 41 74 74 72 69 62 75 74 65 12 4e 7b 22 43 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 50 61 67 65 69 64 22 3a 22 77 00 f0 00 33 39 31 36 33 38 31 39 62 31 35 33 22 2c 22 97 00 f0 48 7a 6f 6e 65 22 3a 22 47 4d 54 2d 30 35 3a 30 30 22 7d 1a 2e 53 2d 31 2d 35 2d 32 31 2d 32 32 34 36 31 32 32 36 35 38 2d 33 36 39 33 34 30 35 31 31 37 2d 32 34 37 36 37 35 36 36 33 34 2d 31 30 30 32 32 13 0a 0c 50 72 6f 64 75 63 74 00 62 61 64 20 12 03 64 72 77 Data Ascii: DTimestamp1716394015WindowWeb_Installer ActivityResult_Run""[AttributeN{"Country":"Switzerland","Pageid":"w39163819b153","Hzone":"GMT-05:00"}.S-1-5-21-2246122658-3693405117-2476756634-10022Productbad drw

Source: InfoForSetup.exe, 00000002.00000002.1653255235.000000006E2D3000.00000002.00000001.01000000.00000007.sdmp, InfoForSetup.exe, 00000003.00000002.1675072188.000000006CA13000.00000002.00000001.01000000.00000007.sdmp, AliyunWrapExe.exe, 00000004.00000002.2890588150.000000006CA13000.00000002.00000001.01000000.00000007.sdmp, AliyunWrap.dll.0.dr	String found in binary or memory: http://./logstores//shards/lbContent-Type:application/x-protobufx-log-apiversion:0.6.0x-log-compress
Source: InitConfigure.ini.0.dr	String found in binary or memory: http://baidu.com
Source: EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://baidu.com7
Source: EDownloader.exe, 00000001.00000003.1670012501.00000000024BE000.00000004.00000020.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000003.1670232846.00000000024BA000.00000004.00000020.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000003.1670305223.00000000024BB000.00000004.00000020.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000003.1704847679.00000000024BB000.00000004.00000020.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000003.1704792281.00000000024BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://baidu.comJ
Source: EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://baidu.comq
Source: drw_free_installer.17163939163819b153.exe, AliyunWrap.dll.0.dr, EDownloader.exe.0.dr, AliyunWrapExe.exe.0.dr, InfoForSetup.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: drw_free_installer.17163939163819b153.exe, AliyunWrap.dll.0.dr, EDownloader.exe.0.dr, AliyunWrapExe.exe.0.dr, InfoForSetup.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: drw_free_installer.17163939163819b153.exe, AliyunWrap.dll.0.dr, EDownloader.exe.0.dr, AliyunWrapExe.exe.0.dr, InfoForSetup.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: drw_free_installer.17163939163819b153.exe, AliyunWrap.dll.0.dr, EDownloader.exe.0.dr, AliyunWrapExe.exe.0.dr, InfoForSetup.exe.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: drw_free_installer.17163939163819b153.exe, AliyunWrap.dll.0.dr, EDownloader.exe.0.dr, AliyunWrapExe.exe.0.dr, InfoForSetup.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: drw_free_installer.17163939163819b153.exe, AliyunWrap.dll.0.dr, EDownloader.exe.0.dr, AliyunWrapExe.exe.0.dr, InfoForSetup.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: drw_free_installer.17163939163819b153.exe, AliyunWrap.dll.0.dr, EDownloader.exe.0.dr, AliyunWrapExe.exe.0.dr, InfoForSetup.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: InfoForSetup.exe.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: drw_free_installer.17163939163819b153.exe, AliyunWrap.dll.0.dr, EDownloader.exe.0.dr, AliyunWrapExe.exe.0.dr, InfoForSetup.exe.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0=
Source: InitConfigure.ini.0.dr	String found in binary or memory: http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/
Source: EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp, InitConfigure.ini.0.dr	String found in binary or memory: http://download2.easeus.com/api2/index.php/Apicp/Drwdl202004/index/
Source: EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp, InitConfigure.ini.0.dr	String found in binary or memory: http://download3.easeus.com/api2/index.php/Apicp/Drwdl202004/index/
Source: EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, InitConfigure.ini.0.dr	String found in binary or memory: http://download3.easeus.com/drw/drw16.2.0.0_ad_google_trial_x.exe
Source: EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://download3.easeus.com/drw/drw16.2.0.0_ad_google_trial_x.exe9
Source: EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp, InitConfigure.ini.0.dr	String found in binary or memory: http://download3.easeus.com/drw/drw16.2.0.0_free_x.exe
Source: EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp, InitConfigure.ini.0.dr	String found in binary or memory: http://download3.easeus.com/drw/drw16.2.0.0_trial_x.exe
Source: AliyunWrapExe.exe, 00000004.00000002.2889967549.0000000001600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_drw_ip/shards/lb
Source: AliyunWrapExe.exe, 00000004.00000002.2889967549.0000000001600000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_drw_ip/shards/lb76756634-1002
Source: drw_free_installer.17163939163819b153.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: drw_free_installer.17163939163819b153.exe, AliyunWrap.dll.0.dr, EDownloader.exe.0.dr, AliyunWrapExe.exe.0.dr, InfoForSetup.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: drw_free_installer.17163939163819b153.exe, AliyunWrap.dll.0.dr, EDownloader.exe.0.dr, AliyunWrapExe.exe.0.dr, InfoForSetup.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: drw_free_installer.17163939163819b153.exe, AliyunWrap.dll.0.dr, EDownloader.exe.0.dr, AliyunWrapExe.exe.0.dr, InfoForSetup.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: drw_free_installer.17163939163819b153.exe, AliyunWrap.dll.0.dr, EDownloader.exe.0.dr, AliyunWrapExe.exe.0.dr, InfoForSetup.exe.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp, InitConfigure.ini.0.dr	String found in binary or memory: http://track.easeus.com/product/index.php/?a=statistics&p_type=m_drw_user_action_table
Source: EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, InitConfigure.ini.0.dr	String found in binary or memory: http://track.easeus.com/product/index.php/?a=statistics&p_type=m_drw_user_base_infos
Source: EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://track.easeus.com/product/index.php/?a=statistics&p_type=m_drw_user_base_infosfP
Source: AliyunWrapExe.exe, 00000004.00000002.2889749147.000000000129A000.00000004.00000020.00020000.00000000.sdmp, AliyunWrapExe.exe, 00000004.00000002.2889749147.000000000124E000.00000004.00000020.00020000.00000000.sdmp, AliyunConfig.ini.0.dr	String found in binary or memory: http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=2
Source: AliyunWrapExe.exe, 00000004.00000002.2889749147.000000000129A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=23
Source: AliyunWrapExe.exe, 00000004.00000002.2889749147.000000000129A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=27
Source: AliyunWrapExe.exe, 00000004.00000002.2889749147.000000000124E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=2C:
Source: AliyunWrapExe.exe, 00000004.00000002.2889749147.000000000129A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=2K
Source: drw_free_installer.17163939163819b153.exe, AliyunWrap.dll.0.dr, EDownloader.exe.0.dr, AliyunWrapExe.exe.0.dr, InfoForSetup.exe.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp, InitConfigure.ini.0.dr	String found in binary or memory: http://yiwo.easeus.com/
Source: EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp, InitConfigure.ini.0.dr	String found in binary or memory: http://yiwo.easeus.com/api/index.php/Home/index/licenseAgreement?lang=
Source: InfoForSetup.exe, InfoForSetup.exe, 00000003.00000002.1675072188.000000006CA13000.00000002.00000001.01000000.00000007.sdmp, AliyunWrapExe.exe, 00000004.00000002.2890588150.000000006CA13000.00000002.00000001.01000000.00000007.sdmp, AliyunWrap.dll.0.dr, EDownloader.exe.0.dr	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html
Source: InfoForSetup.exe	String found in binary or memory: https://curl.haxx.se/docs/http-cookies.html#
Source: EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, InitConfigure.ini.0.dr	String found in binary or memory: https://download.easeus.com/free/drw_free.exe
Source: EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://download.easeus.com/free/drw_free.exeni
Source: EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp, InitConfigure.ini.0.dr	String found in binary or memory: https://download.easeus.com/trial/drw_trial.exe
Source: AliyunWrapExe.exe, 00000004.00000002.2889749147.000000000129A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp, InitConfigure.ini.0.dr	String found in binary or memory: https://update.easeus.com/update/drw_eng/drw.ini
Source: EDownloader.exe.0.dr	String found in binary or memory: https://www.baidu.com/
Source: EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, InitConfigure.ini.0.dr	String found in binary or memory: https://www.easeus.com/datarecoverywizard/history.php?lang=
Source: EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.easeus.com/datarecoverywizard/history.php?lang=inst
Source: EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp, InitConfigure.ini.0.dr	String found in binary or memory: https://www.easeus.com/download-offline.html
Source: EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, InitConfigure.ini.0.dr	String found in binary or memory: https://www.easeus.com/privacy.htm?lang=
Source: EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.easeus.com/privacy.htm?lang=/histor
Source: EDownloader.exe, EDownloader.exe, 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmp, EDownloader.exe, 00000001.00000000.1642539347.0000000001006000.00000002.00000001.01000000.00000004.sdmp, EDownloader.exe.0.dr	String found in binary or memory: https://www.google.com/
Source: EDownloader.exe, 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmp, EDownloader.exe, 00000001.00000000.1642539347.0000000001006000.00000002.00000001.01000000.00000004.sdmp, EDownloader.exe.0.dr	String found in binary or memory: https://www.google.com/https://www.baidu.com/GMT

Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe

Code function: 0_2_00405461 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_00405461

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe

Code function: 1_2_00F4AB50 GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,GetKeyState,

1_2_00F4AB50

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FD3A40 CryptAcquireContextW,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	1_2_00FD3A40
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2B4B00 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	2_2_6E2B4B00
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9F4B00 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	3_2_6C9F4B00

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe

Code function: 2_2_6E2792B0 SetEvent,CloseHandle,_memset,_memset,_memset,GetCurrentProcess,OpenProcessToken,CreateProcessAsUserW,CloseHandle,CreateProcessW,CloseHandle,CloseHandle,

2_2_6E2792B0

Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Code function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_0040338F
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F26110 ExitWindowsEx,		1_2_00F26110

Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Code function: 0_2_00406B15	0_2_00406B15
Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Code function: 0_2_004072EC	0_2_004072EC
Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Code function: 0_2_00404C9E	0_2_00404C9E
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F701B0	1_2_00F701B0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F742A0	1_2_00F742A0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F4C22B	1_2_00F4C22B
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F90320	1_2_00F90320
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F52450	1_2_00F52450
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F91220	1_2_00F91220
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F396C0	1_2_00F396C0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F8E060	1_2_00F8E060
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F141F0	1_2_00F141F0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F642D0	1_2_00F642D0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F18260	1_2_00F18260
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F42240	1_2_00F42240
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F3E3E0	1_2_00F3E3E0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F16390	1_2_00F16390
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FF84E1	1_2_00FF84E1
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F38470	1_2_00F38470
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FF6426	1_2_00FF6426
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FEC40D	1_2_00FEC40D
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F6A5B0	1_2_00F6A5B0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F246C0	1_2_00F246C0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F206A0	1_2_00F206A0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F6E7A0	1_2_00F6E7A0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F1C780	1_2_00F1C780
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F3C710	1_2_00F3C710
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F2C820	1_2_00F2C820
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FFA829	1_2_00FFA829
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F3E9F0	1_2_00F3E9F0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F929E0	1_2_00F929E0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FEE909	1_2_00FEE909
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F16AA0	1_2_00F16AA0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F40A80	1_2_00F40A80
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FF8BD9	1_2_00FF8BD9
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F6EB60	1_2_00F6EB60
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F30CA0	1_2_00F30CA0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FE4E73	1_2_00FE4E73
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F26F50	1_2_00F26F50
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FCEF40	1_2_00FCEF40
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F7507C	1_2_00F7507C
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F8D050	1_2_00F8D050
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FA1150	1_2_00FA1150
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F23110	1_2_00F23110
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F6D2E0	1_2_00F6D2E0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F3B2B0	1_2_00F3B2B0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FEF284	1_2_00FEF284
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F7D3E0	1_2_00F7D3E0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F39330	1_2_00F39330
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FD9320	1_2_00FD9320
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FDB4D0	1_2_00FDB4D0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F2F460	1_2_00F2F460
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F2D590	1_2_00F2D590
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F83590	1_2_00F83590
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F11500	1_2_00F11500
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F436B0	1_2_00F436B0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F93670	1_2_00F93670
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F8D880	1_2_00F8D880
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F3B860	1_2_00F3B860
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F33810	1_2_00F33810
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F3D9B0	1_2_00F3D9B0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FF599E	1_2_00FF599E
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F45930	1_2_00F45930
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FFBAE2	1_2_00FFBAE2
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F8FAC0	1_2_00F8FAC0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F17A50	1_2_00F17A50
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F55A20	1_2_00F55A20
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F51B60	1_2_00F51B60
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F3FC80	1_2_00F3FC80
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F73C80	1_2_00F73C80
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F37C40	1_2_00F37C40
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F11D30	1_2_00F11D30
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F91D10	1_2_00F91D10
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F3DEF0	1_2_00F3DEF0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FF5EE2	1_2_00FF5EE2
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F23EA0	1_2_00F23EA0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F4BE70	1_2_00F4BE70
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F7DE50	1_2_00F7DE50
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_003457A7	2_2_003457A7
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E277FF0	2_2_6E277FF0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2A6D40	2_2_6E2A6D40
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2B9DBC	2_2_6E2B9DBC
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2D0DFD	2_2_6E2D0DFD
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2BDB10	2_2_6E2BDB10
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E278B90	2_2_6E278B90
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2D08B9	2_2_6E2D08B9
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2AC8C0	2_2_6E2AC8C0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2B69F0	2_2_6E2B69F0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2D14F5	2_2_6E2D14F5
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2AF530	2_2_6E2AF530
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2C6566	2_2_6E2C6566
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2D2561	2_2_6E2D2561
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2A7210	2_2_6E2A7210
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E281270	2_2_6E281270
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2D0375	2_2_6E2D0375
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2C4383	2_2_6E2C4383
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2C3390	2_2_6E2C3390
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E276070	2_2_6E276070
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2770E0	2_2_6E2770E0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2B8100	2_2_6E2B8100
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9F9DBC	3_2_6C9F9DBC
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6CA10DFD	3_2_6CA10DFD
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9E6D40	3_2_6C9E6D40
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9B7FF0	3_2_6C9B7FF0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6CA108B9	3_2_6CA108B9
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9EC8C0	3_2_6C9EC8C0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9F69F0	3_2_6C9F69F0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9B8B90	3_2_6C9B8B90
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9FDB10	3_2_6C9FDB10
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6CA114F5	3_2_6CA114F5
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9EF530	3_2_6C9EF530
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6CA12561	3_2_6CA12561
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6CA06566	3_2_6CA06566
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9B70E0	3_2_6C9B70E0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9B6070	3_2_6C9B6070
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9F8100	3_2_6C9F8100
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9E7210	3_2_6C9E7210
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9C1270	3_2_6C9C1270
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6CA04383	3_2_6CA04383
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6CA03390	3_2_6CA03390
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6CA10375	3_2_6CA10375
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Code function: 4_2_00A3DA69	4_2_00A3DA69

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: String function: 6C9C9940 appears 197 times
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: String function: 6C9C8F00 appears 44 times
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: String function: 6E289A20 appears 219 times
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: String function: 6C9F3910 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: String function: 6C9C9A20 appears 221 times
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: String function: 6E288F00 appears 44 times
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: String function: 6E2B3910 appears 37 times
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: String function: 6E289940 appears 197 times
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: String function: 6E2BFB78 appears 57 times
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: String function: 6E289060 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: String function: 6C9FFB78 appears 57 times
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: String function: 6C9C9060 appears 32 times
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: String function: 00F12580 appears 151 times
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: String function: 00FA8030 appears 237 times
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: String function: 00FE543C appears 66 times
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: String function: 00F12120 appears 169 times
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: String function: 00F1BB00 appears 253 times
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: String function: 00FA7FA0 appears 188 times
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: String function: 00F18860 appears 40 times
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: String function: 00F96A40 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: String function: 00FDC8E3 appears 56 times
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Code function: String function: 00A3A544 appears 33 times

Source: drw_free_installer.17163939163819b153.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: sus23.winEXE@9/35@2/2

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe

Code function: 1_2_00FD0610 GetLastError,_strerror,_strncpy,FormatMessageA,_strrchr,_strrchr,GetLastError,SetLastError,

1_2_00FD0610

Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Code function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,		0_2_0040338F
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F16280 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,		1_2_00F16280

Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe

Code function: 0_2_00404722 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW,

0_2_00404722

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe

Code function: 1_2_00F45480 CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,Process32NextW,CloseHandle,

1_2_00F45480

Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe

Code function: 0_2_00402104 CoCreateInstance,

0_2_00402104

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe

Code function: 1_2_00F71690 CreateFileW,GetFileSize,ReadFile,CloseHandle,FindResourceW,LoadResource,FreeResource,SizeofResource,LockResource,FreeResource,CreateFileW,GetFileSize,ReadFile,CloseHandle,_memset,CreateDIBSection,CharNextW,__wcstoui64,

1_2_00F71690

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\index[1].htm

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Mutant created: \Sessions\1\BaseNamedObjects\DRW_Installer
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\C$$USERS$user$APPDATA$LOCAL$TEMP$DOWNLOADER_EASEUS$2.0.0$2FREE$ALIYUN$ALIYUNCONFIG.INI
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\C$$USERS$user$APPDATA$LOCAL$TEMP$DOWNLOADER_EASEUS$2.0.0$2FREE$ALIYUN$DATAFILE.INI

Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe

File created: C:\Users\user\AppData\Local\Temp\nstF03.tmp

Jump to behavior

Source: drw_free_installer.17163939163819b153.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: drw_free_installer.17163939163819b153.exe	String found in binary or memory: resource/install_bg_1.png
Source: drw_free_installer.17163939163819b153.exe	String found in binary or memory: resource/install_bg_3.png
Source: drw_free_installer.17163939163819b153.exe	String found in binary or memory: resource/install_bg_4.png
Source: drw_free_installer.17163939163819b153.exe	String found in binary or memory: resource/install_bg_5.png

Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe

File read: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe "C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe"
Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Process created: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe "C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop \|\|\| EXENAME=drw_free_installer.17163939163819b153.exe \|\|\| DOWNLOAD_VERSION=free \|\|\| PRODUCT_VERSION=2.0.0 \|\|\| INSTALL_TYPE=0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Process created: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe /Uid "S-1-5-21-2246122658-3693405117-2476756634-1002"
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Process created: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"Switzerland\",\"Pageid\":\"17163939163819b153\",\"Timezone\":\"GMT-05:00\"}"
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.Exe
Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Process created: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe "C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop \|\|\| EXENAME=drw_free_installer.17163939163819b153.exe \|\|\| DOWNLOAD_VERSION=free \|\|\| PRODUCT_VERSION=2.0.0 \|\|\| INSTALL_TYPE=0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Process created: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe /Uid "S-1-5-21-2246122658-3693405117-2476756634-1002"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Process created: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe /SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"Switzerland\",\"Pageid\":\"17163939163819b153\",\"Timezone\":\"GMT-05:00\"}"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.Exe	Jump to behavior

Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: msftedit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: windows.globalization.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: bcp47mrm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: globinputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Section loaded: aliyunwrap.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Section loaded: fwpuclnt.dll	Jump to behavior

Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe

File written: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Korean.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe

File opened: C:\Windows\SysWOW64\msftedit.dll

Jump to behavior

Source: drw_free_installer.17163939163819b153.exe

Static PE information: certificate valid

Source: drw_free_installer.17163939163819b153.exe

Static file information: File size 2654624 > 1048576

Source: drw_free_installer.17163939163819b153.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: F:\testProject\AliyunLog\Code\UserInfoCollect\Release\AliyunWrapExe.pdb source: AliyunWrapExe.exe, 00000004.00000002.2889436492.0000000000A43000.00000002.00000001.01000000.00000009.sdmp, AliyunWrapExe.exe, 00000004.00000000.1671805830.0000000000A43000.00000002.00000001.01000000.00000009.sdmp, AliyunWrapExe.exe.0.dr
Source:	Binary string: F:\testProject\AliyunLog\Code\UserInfoCollect\Release\InfoForSetup.pdb source: drw_free_installer.17163939163819b153.exe, 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmp, InfoForSetup.exe, 00000002.00000002.1651145686.000000000034A000.00000002.00000001.01000000.00000006.sdmp, InfoForSetup.exe, 00000002.00000000.1647040740.000000000034A000.00000002.00000001.01000000.00000006.sdmp, InfoForSetup.exe, 00000003.00000002.1672647252.000000000034A000.00000002.00000001.01000000.00000006.sdmp, InfoForSetup.exe, 00000003.00000000.1668051537.000000000034A000.00000002.00000001.01000000.00000006.sdmp, InfoForSetup.exe.0.dr
Source:	Binary string: D:\downloader2.0_drw\main\EDownloader\Release\EDownloader.pdb source: EDownloader.exe, 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmp, EDownloader.exe, 00000001.00000000.1642539347.0000000001006000.00000002.00000001.01000000.00000004.sdmp, EDownloader.exe.0.dr
Source:	Binary string: F:\testProject\AliyunLog\Code\UserInfoCollect\Release\AliyunWrap.pdbP% source: InfoForSetup.exe, 00000003.00000002.1675072188.000000006CA13000.00000002.00000001.01000000.00000007.sdmp, AliyunWrapExe.exe, 00000004.00000002.2890588150.000000006CA13000.00000002.00000001.01000000.00000007.sdmp, AliyunWrap.dll.0.dr
Source:	Binary string: F:\testProject\AliyunLog\Code\UserInfoCollect\Release\AliyunWrap.pdbP%.n source: InfoForSetup.exe, 00000002.00000002.1653255235.000000006E2D3000.00000002.00000001.01000000.00000007.sdmp
Source:	Binary string: F:\testProject\AliyunLog\Code\UserInfoCollect\Release\AliyunWrap.pdb source: InfoForSetup.exe, 00000002.00000002.1653255235.000000006E2D3000.00000002.00000001.01000000.00000007.sdmp, InfoForSetup.exe, 00000003.00000002.1675072188.000000006CA13000.00000002.00000001.01000000.00000007.sdmp, AliyunWrapExe.exe, 00000004.00000002.2890588150.000000006CA13000.00000002.00000001.01000000.00000007.sdmp, AliyunWrap.dll.0.dr
Source:	Binary string: F:\testProject\AliyunLog\Code\UserInfoCollect\Release\InfoForSetup.pdbT source: drw_free_installer.17163939163819b153.exe, 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmp, InfoForSetup.exe, 00000002.00000002.1651145686.000000000034A000.00000002.00000001.01000000.00000006.sdmp, InfoForSetup.exe, 00000002.00000000.1647040740.000000000034A000.00000002.00000001.01000000.00000006.sdmp, InfoForSetup.exe, 00000003.00000002.1672647252.000000000034A000.00000002.00000001.01000000.00000006.sdmp, InfoForSetup.exe, 00000003.00000000.1668051537.000000000034A000.00000002.00000001.01000000.00000006.sdmp, InfoForSetup.exe.0.dr

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe

Code function: 1_2_00F816C0 LoadLibraryW,GetProcAddress,CoCreateInstance,

1_2_00F816C0

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F7CAB6 push 8B000001h; iretd	1_2_00F7CABB
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FE2BE6 push ecx; ret	1_2_00FE2BF9
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FA52D0 push ecx; mov dword ptr [esp], 00000000h	1_2_00FA52D1
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FE5481 push ecx; ret	1_2_00FE5494
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_003434AD push ecx; ret	2_2_003434C0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2BFBBD push ecx; ret	2_2_6E2BFBD0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2C0329 push ecx; ret	2_2_6E2C033C
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9FFBBD push ecx; ret	3_2_6C9FFBD0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6CA00329 push ecx; ret	3_2_6CA0033C
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Code function: 4_2_00A3A589 push ecx; ret	4_2_00A3A59C
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Code function: 4_2_00A38506 push ecx; ret	4_2_00A38519

Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	File created: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrap.dll	Jump to dropped file
Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	File created: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	File created: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Jump to dropped file
Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	File created: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F14B80 IsIconic,GetWindowRect,OffsetRect,CreateRoundRectRgn,SetWindowRgn,DeleteObject,	1_2_00F14B80
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F14C60 IsIconic,CallWindowProcW,	1_2_00F14C60
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F54DE0 IsIconic,GetWindowRect,OffsetRect,CreateRoundRectRgn,SetWindowRgn,DeleteObject,	1_2_00F54DE0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F537C0 IsIconic,	1_2_00F537C0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F49760 GetWindowRect,GetParent,GetWindow,MonitorFromWindow,GetMonitorInfoW,IsIconic,GetWindowRect,SetWindowPos,	1_2_00F49760
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F53BB0 IsIconic,GetWindowRect,OffsetRect,CreateRoundRectRgn,SetWindowRgn,DeleteObject,	1_2_00F53BB0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F4BE70 IsIconic,ScreenToClient,SendMessageW,SendMessageW,IsRectEmpty,IsIconic,GetTickCount,SendMessageW,_TrackMouseEvent,GetTickCount,SendMessageW,SetFocus,GetTickCount,SetFocus,GetTickCount,GetTickCount,SetFocus,GetTickCount,ScreenToClient,GetTickCount,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,GetWindowRect,IsIconic,GetActiveWindow,PtInRect,SendMessageW,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,GetTickCount,_memset,CreateWindowExW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetClientRect,SaveDC,GetWindow,GetWindowRect,MapWindowPoints,SetWindowOrgEx,SendMessageW,GetWindow,RestoreDC,	1_2_00F4BE70
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F4BE70 IsIconic,ScreenToClient,SendMessageW,SendMessageW,IsRectEmpty,IsIconic,GetTickCount,SendMessageW,_TrackMouseEvent,GetTickCount,SendMessageW,SetFocus,GetTickCount,SetFocus,GetTickCount,GetTickCount,SetFocus,GetTickCount,ScreenToClient,GetTickCount,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,GetWindowRect,IsIconic,GetActiveWindow,PtInRect,SendMessageW,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,GetTickCount,_memset,CreateWindowExW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetClientRect,SaveDC,GetWindow,GetWindowRect,MapWindowPoints,SetWindowOrgEx,SendMessageW,GetWindow,RestoreDC,	1_2_00F4BE70
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F4BE70 IsIconic,ScreenToClient,SendMessageW,SendMessageW,IsRectEmpty,IsIconic,GetTickCount,SendMessageW,_TrackMouseEvent,GetTickCount,SendMessageW,SetFocus,GetTickCount,SetFocus,GetTickCount,GetTickCount,SetFocus,GetTickCount,ScreenToClient,GetTickCount,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,GetWindowRect,IsIconic,GetActiveWindow,PtInRect,SendMessageW,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,GetTickCount,_memset,CreateWindowExW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetClientRect,SaveDC,GetWindow,GetWindowRect,MapWindowPoints,SetWindowOrgEx,SendMessageW,GetWindow,RestoreDC,	1_2_00F4BE70

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe

Code function: 2_2_00341060 LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_00341060

Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe

Evasive API call chain: GetLocalTime,DecisionNodes

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep	graph_1-98714
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	API coverage: 4.5 %
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	API coverage: 7.5 %
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	API coverage: 7.3 %

Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Code function: 0_2_004065FD FindFirstFileW,FindClose,	0_2_004065FD
Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Code function: 0_2_00402868 FindFirstFileW,	0_2_00402868
Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	Code function: 0_2_004059CC GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	0_2_004059CC
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FE0C2E __getdrive,FindFirstFileA,__wfullpath_helper,_strlen,_IsRootUNCName,GetDriveTypeA,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,	1_2_00FE0C2E
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2BCD5B __getdrive,FindFirstFileA,__wfullpath_helper,_strlen,_IsRootUNCName,GetDriveTypeA,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,	2_2_6E2BCD5B
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9FCD5B __getdrive,FindFirstFileA,__wfullpath_helper,_strlen,_IsRootUNCName,GetDriveTypeA,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FileTimeToLocalFileTime,FileTimeToSystemTime,___loctotime64_t,FindClose,___dtoxmode,GetLastError,__dosmaperr,FindClose,	3_2_6C9FCD5B

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe

Code function: 1_2_00F176C0 GetSystemInfo,GetVersionExW,LoadLibraryA,GetProcAddress,FreeLibrary,

1_2_00F176C0

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984\COMCTL32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.1110_none_a8625c1886757984	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	File opened: C:\Windows\SysWOW64\KERNELBASE.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.2006_none_d94bc80de1097097	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	File opened: C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.19041.2006_none_d94bc80de1097097\gdiplus.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	File opened: C:\Windows\SysWOW64\KERNEL32.DLL	Jump to behavior

Source: AliyunWrapExe.exe, 00000004.00000002.2889749147.00000000012B5000.00000004.00000020.00020000.00000000.sdmp, AliyunWrapExe.exe, 00000004.00000002.2889749147.000000000124E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: InfoForSetup.exe, 00000002.00000002.1652984754.0000000000E2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllk
Source: AliyunWrapExe.exe, 00000004.00000002.2889749147.000000000124E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWL
Source: InfoForSetup.exe, 00000003.00000002.1674237816.0000000001018000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe	API call chain: ExitProcess graph end node			graph_0-3285
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	API call chain: ExitProcess graph end node			graph_1-98677

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe

Code function: 1_2_00FDADFF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

1_2_00FDADFF

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe

Code function: 1_2_00F816C0 LoadLibraryW,GetProcAddress,CoCreateInstance,

1_2_00F816C0

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe

Code function: 1_2_00FF81D5 CreateFileA,__lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

1_2_00FF81D5

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FDADFF IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00FDADFF
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FDAD69 _abort,__NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00FDAD69
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FE302D __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00FE302D
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FDB13F _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_00FDB13F
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_0034286C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_0034286C
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_00347AFE __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,	2_2_00347AFE
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_0034415B SetUnhandledExceptionFilter,	2_2_0034415B
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_00342186 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00342186
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2CFE05 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_6E2CFE05
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2B8C52 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6E2B8C52
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2B90CA _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_6E2B90CA
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9F8C52 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6C9F8C52
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6CA0FE05 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_6CA0FE05
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9F90CA _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_6C9F90CA
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Code function: 4_2_00A374A2 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00A374A2
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Code function: 4_2_00A40886 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,RtlUnwind,	4_2_00A40886
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Code function: 4_2_00A39864 SetUnhandledExceptionFilter,	4_2_00A39864
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Code function: 4_2_00A37718 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_00A37718

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe

Code function: 2_2_6E2798D0 _memset,_memset,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,CreateMutexW,GetLastError,

2_2_6E2798D0

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: GetTimeZoneInformation,_memset,GetLocaleInfoW,	1_2_00F396C0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	1_2_00FEC0B8
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	1_2_00FEC1E0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	1_2_00FEC179
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,_ProcessCodePage,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itoa_s,	1_2_00FEC21C
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: GetLocaleInfoA,	1_2_00FE43CC
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: _memset,GetLocaleInfoW,	1_2_00F3C710
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: GetLocaleInfoA,	1_2_00FF28C0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,InterlockedDecrement,InterlockedDecrement,	1_2_00FE2BFA
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,__invoke_watson,___crtGetLocaleInfoW,	1_2_00FE8B1D
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	1_2_00FEAFA9
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: __time64,_memset,GetLocaleInfoW,	1_2_00F26F50
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,	1_2_00FEB617
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: __calloc_crt,__malloc_crt,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,InterlockedDecrement,InterlockedDecrement,	1_2_00FEB86F
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: GetLocaleInfoA,GetLocaleInfoA,GetACP,	1_2_00FEBCC3
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	1_2_00FEBDDA
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	1_2_00FEBEE6
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: GetLocaleInfoA,_LcidFromHexString,_GetPrimaryLen,_strlen,	1_2_00FEBE72
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLastError,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,GetLocaleInfoA,	1_2_00FF3E4F
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: _LocaleUpdate::_LocaleUpdate,GetLocaleInfoW,	1_2_00FF3E1B
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	1_2_00FF3F8E
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: GetLocaleInfoA,	2_2_00347D4F
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: GetLocaleInfoA,	2_2_6E2CD8E6
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: GetLocaleInfoA,	3_2_6CA0D8E6
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	Code function: GetLocaleInfoA,	4_2_00A41874

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe

Code function: 1_2_00F96A40 CloseHandle,GetLocalTime,_memset,GetCurrentThreadId,__snprintf,_vswprintf_s,OutputDebugStringA,

1_2_00F96A40

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe

Code function: 1_2_00F15AA0 _memset,GetUserNameW,_memset,_memset,LookupAccountNameW,IsValidSid,GetSidIdentifierAuthority,swprintf,swprintf,GetSidSubAuthorityCount,GetSidSubAuthority,GetSidSubAuthority,swprintf,

1_2_00F15AA0

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe

Code function: 1_2_00F396C0 GetTimeZoneInformation,_memset,GetLocaleInfoW,

1_2_00F396C0

Source: C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe

Code function: 0_2_0040338F EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_0040338F

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FBA1D0 _memset,__wcstoui64,__wcstoui64,getsockname,WSAGetLastError,_strncpy,WSAGetLastError,WSAGetLastError,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,htons,	1_2_00FBA1D0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FAD810 _memset,_memset,_strncmp,_strncmp,htons,bind,bind,htons,bind,_memset,getsockname,WSAGetLastError,htons,WSAGetLastError,	1_2_00FAD810
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FB5E30 bind,WSAGetLastError,	1_2_00FB5E30
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E28F680 _memset,_memset,_strncmp,_strncmp,htons,bind,htons,htons,bind,_memset,getsockname,WSAGetLastError,htons,htons,htons,WSAGetLastError,	2_2_6E28F680
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E29D420 _memset,_strncpy,__wcstoui64,__wcstoui64,_strncpy,getsockname,WSAGetLastError,WSAGetLastError,WSAGetLastError,WSAGetLastError,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,htons,	2_2_6E29D420
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E299280 bind,WSAGetLastError,	2_2_6E299280
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9DD420 _memset,_strncpy,__wcstoui64,__wcstoui64,_strncpy,getsockname,WSAGetLastError,WSAGetLastError,WSAGetLastError,WSAGetLastError,htons,bind,WSAGetLastError,getsockname,WSAGetLastError,getsockname,WSAGetLastError,listen,WSAGetLastError,htons,htons,	3_2_6C9DD420
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9CF680 _memset,_memset,_strncmp,_strncmp,htons,bind,htons,htons,bind,_memset,getsockname,WSAGetLastError,htons,htons,htons,WSAGetLastError,	3_2_6C9CF680
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9D9280 bind,WSAGetLastError,	3_2_6C9D9280

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	3 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	1 Input Capture	2 System Time Discovery	1 Exploitation of Remote Services	12 Archive Collected Data	3 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	2 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	1 System Shutdown/Reboot
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Access Token Manipulation	1 DLL Side-Loading	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Clipboard Data	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Process Injection	1 Masquerading	NTDS	15 System Information Discovery	Distributed Component Object Model	Input Capture	14 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Valid Accounts	LSA Secrets	21 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 Access Token Manipulation	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Process Injection	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
drw_free_installer.17163939163819b153.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrap.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://nsis.sf.net/NSIS_ErrorError	0%	URL Reputation	safe
https://curl.haxx.se/docs/http-cookies.html	0%	URL Reputation	safe
http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=27	0%	Avira URL Cloud	safe
https://update.easeus.com/update/drw_eng/drw.ini	0%	Avira URL Cloud	safe
http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/	0%	Avira URL Cloud	safe
https://download.easeus.com/trial/drw_trial.exe	0%	Avira URL Cloud	safe
http://baidu.com	0%	Avira URL Cloud	safe
https://www.easeus.com/privacy.htm?lang=	0%	Avira URL Cloud	safe
http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=2K	0%	Avira URL Cloud	safe
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_drw_ip/shards/lb76756634-1002	0%	Avira URL Cloud	safe
http://download3.easeus.com/drw/drw16.2.0.0_free_x.exe	0%	Avira URL Cloud	safe
http://track.easeus.com/product/index.php/?a=statistics&p_type=m_drw_user_base_infos	0%	Avira URL Cloud	safe
http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=23	0%	Avira URL Cloud	safe
http://baidu.com7	0%	Avira URL Cloud	safe
https://www.google.com/https://www.baidu.com/GMT	0%	Avira URL Cloud	safe
http://baidu.comq	0%	Avira URL Cloud	safe
http://track.easeus.com/product/index.php/?a=statistics&p_type=m_drw_user_action_table	0%	Avira URL Cloud	safe
https://curl.haxx.se/docs/http-cookies.html#	0%	Avira URL Cloud	safe
https://www.easeus.com/datarecoverywizard/history.php?lang=inst	0%	Avira URL Cloud	safe
https://download.easeus.com/free/drw_free.exeni	0%	Avira URL Cloud	safe
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_drw_ip/shards/lb	0%	Avira URL Cloud	safe
https://download.easeus.com/free/drw_free.exe	0%	Avira URL Cloud	safe
https://www.easeus.com/privacy.htm?lang=/histor	0%	Avira URL Cloud	safe
https://www.easeus.com/download-offline.html	0%	Avira URL Cloud	safe
http://download3.easeus.com/drw/drw16.2.0.0_trial_x.exe	0%	Avira URL Cloud	safe
http://download2.easeus.com/api2/index.php/Apicp/Drwdl202004/index/	0%	Avira URL Cloud	safe
http://baidu.comJ	0%	Avira URL Cloud	safe
https://www.easeus.com/datarecoverywizard/history.php?lang=	0%	Avira URL Cloud	safe
http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=2C:	0%	Avira URL Cloud	safe
http://track.easeus.com/product/index.php/?a=statistics&p_type=m_drw_user_base_infosfP	0%	Avira URL Cloud	safe
http://download3.easeus.com/drw/drw16.2.0.0_ad_google_trial_x.exe	0%	Avira URL Cloud	safe
http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=2	0%	Avira URL Cloud	safe
https://www.google.com/	0%	Avira URL Cloud	safe
http://./logstores//shards/lbContent-Type:application/x-protobufx-log-apiversion:0.6.0x-log-compress	0%	Avira URL Cloud	safe
http://download3.easeus.com/drw/drw16.2.0.0_ad_google_trial_x.exe9	0%	Avira URL Cloud	safe
http://yiwo.easeus.com/api/index.php/Home/index/licenseAgreement?lang=	0%	Avira URL Cloud	safe
http://yiwo.easeus.com/	0%	Avira URL Cloud	safe
https://www.baidu.com/	0%	Avira URL Cloud	safe
http://download3.easeus.com/api2/index.php/Apicp/Drwdl202004/index/	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
track.easeus.com.whecloud.com	163.171.128.150	true	false	unknown
easeusinfo.us-east-1.log.aliyuncs.com	47.252.97.212	true	false	unknown
track.easeus.com	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=2	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://download3.easeus.com/drw/drw16.2.0.0_free_x.exe	EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp, InitConfigure.ini.0.dr	false	Avira URL Cloud: safe	unknown
http://track.easeus.com/product/index.php/?a=statistics&p_type=m_drw_user_base_infos	EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, InitConfigure.ini.0.dr	false	Avira URL Cloud: safe	unknown
http://download.easeus.com/api2/index.php/Apicp/Drwdl202004/index/	InitConfigure.ini.0.dr	false	Avira URL Cloud: safe	unknown
http://baidu.com	InitConfigure.ini.0.dr	false	Avira URL Cloud: safe	unknown
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_drw_ip/shards/lb76756634-1002	AliyunWrapExe.exe, 00000004.00000002.2889967549.0000000001600000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://update.easeus.com/update/drw_eng/drw.ini	EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp, InitConfigure.ini.0.dr	false	Avira URL Cloud: safe	unknown
http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=2K	AliyunWrapExe.exe, 00000004.00000002.2889749147.000000000129A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=27	AliyunWrapExe.exe, 00000004.00000002.2889749147.000000000129A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://download.easeus.com/trial/drw_trial.exe	EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp, InitConfigure.ini.0.dr	false	Avira URL Cloud: safe	unknown
https://www.easeus.com/privacy.htm?lang=	EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, InitConfigure.ini.0.dr	false	Avira URL Cloud: safe	unknown
http://nsis.sf.net/NSIS_ErrorError	drw_free_installer.17163939163819b153.exe	false	URL Reputation: safe	unknown
http://baidu.com7	EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=23	AliyunWrapExe.exe, 00000004.00000002.2889749147.000000000129A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/https://www.baidu.com/GMT	EDownloader.exe, 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmp, EDownloader.exe, 00000001.00000000.1642539347.0000000001006000.00000002.00000001.01000000.00000004.sdmp, EDownloader.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://track.easeus.com/product/index.php/?a=statistics&p_type=m_drw_user_action_table	EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp, InitConfigure.ini.0.dr	false	Avira URL Cloud: safe	unknown
https://download.easeus.com/free/drw_free.exeni	EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://baidu.comq	EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.easeus.com/datarecoverywizard/history.php?lang=inst	EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://curl.haxx.se/docs/http-cookies.html	InfoForSetup.exe, InfoForSetup.exe, 00000003.00000002.1675072188.000000006CA13000.00000002.00000001.01000000.00000007.sdmp, AliyunWrapExe.exe, 00000004.00000002.2890588150.000000006CA13000.00000002.00000001.01000000.00000007.sdmp, AliyunWrap.dll.0.dr, EDownloader.exe.0.dr	false	URL Reputation: safe	unknown
https://curl.haxx.se/docs/http-cookies.html#	InfoForSetup.exe	false	Avira URL Cloud: safe	unknown
http://easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_drw_ip/shards/lb	AliyunWrapExe.exe, 00000004.00000002.2889967549.0000000001600000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://download.easeus.com/free/drw_free.exe	EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, InitConfigure.ini.0.dr	false	Avira URL Cloud: safe	unknown
http://baidu.comJ	EDownloader.exe, 00000001.00000003.1670012501.00000000024BE000.00000004.00000020.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000003.1670232846.00000000024BA000.00000004.00000020.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000003.1670305223.00000000024BB000.00000004.00000020.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000003.1704847679.00000000024BB000.00000004.00000020.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000003.1704792281.00000000024BA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.easeus.com/download-offline.html	EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp, InitConfigure.ini.0.dr	false	Avira URL Cloud: safe	unknown
http://download2.easeus.com/api2/index.php/Apicp/Drwdl202004/index/	EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp, InitConfigure.ini.0.dr	false	Avira URL Cloud: safe	unknown
https://www.easeus.com/privacy.htm?lang=/histor	EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://download3.easeus.com/drw/drw16.2.0.0_trial_x.exe	EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp, InitConfigure.ini.0.dr	false	Avira URL Cloud: safe	unknown
https://www.easeus.com/datarecoverywizard/history.php?lang=	EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, InitConfigure.ini.0.dr	false	Avira URL Cloud: safe	unknown
http://track.easeus.com/product/index.php/?a=statistics&p_type=m_drw_user_base_infosfP	EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://download3.easeus.com/drw/drw16.2.0.0_ad_google_trial_x.exe	EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, InitConfigure.ini.0.dr	false	Avira URL Cloud: safe	unknown
http://track.easeus.com/product/index.php?c=main&a=getstatus&pid=2C:	AliyunWrapExe.exe, 00000004.00000002.2889749147.000000000124E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://./logstores//shards/lbContent-Type:application/x-protobufx-log-apiversion:0.6.0x-log-compress	InfoForSetup.exe, 00000002.00000002.1653255235.000000006E2D3000.00000002.00000001.01000000.00000007.sdmp, InfoForSetup.exe, 00000003.00000002.1675072188.000000006CA13000.00000002.00000001.01000000.00000007.sdmp, AliyunWrapExe.exe, 00000004.00000002.2890588150.000000006CA13000.00000002.00000001.01000000.00000007.sdmp, AliyunWrap.dll.0.dr	false	Avira URL Cloud: safe	unknown
http://yiwo.easeus.com/api/index.php/Home/index/licenseAgreement?lang=	EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp, InitConfigure.ini.0.dr	false	Avira URL Cloud: safe	unknown
https://www.google.com/	EDownloader.exe, EDownloader.exe, 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmp, EDownloader.exe, 00000001.00000000.1642539347.0000000001006000.00000002.00000001.01000000.00000004.sdmp, EDownloader.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://download3.easeus.com/api2/index.php/Apicp/Drwdl202004/index/	EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp, InitConfigure.ini.0.dr	false	Avira URL Cloud: safe	unknown
http://download3.easeus.com/drw/drw16.2.0.0_ad_google_trial_x.exe9	EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://yiwo.easeus.com/	EDownloader.exe, 00000001.00000003.1643557910.0000000002460000.00000004.00000800.00020000.00000000.sdmp, EDownloader.exe, 00000001.00000002.2889462577.0000000000666000.00000004.00000020.00020000.00000000.sdmp, InitConfigure.ini.0.dr	false	Avira URL Cloud: safe	unknown
https://www.baidu.com/	EDownloader.exe.0.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
47.252.97.212	easeusinfo.us-east-1.log.aliyuncs.com	United States		45102	CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	false
163.171.128.150	track.easeus.com.whecloud.com	European Union		54994	QUANTILNETWORKSUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1445894
Start date and time:	2024-05-22 18:06:04 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	drw_free_installer.17163939163819b153.exe
Detection:	SUS
Classification:	sus23.winEXE@9/35@2/2
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 80 Number of non-executed functions: 249
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: drw_free_installer.17163939163819b153.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
47.252.97.212	DRW14.0_Trial.exe	Get hash	malicious	Unknown	Browse	easeusinfo.us-east-1.log.aliyuncs.com/logstores/logstore_windrw_ip/shards/lb
163.171.128.150	https://www--wellsfargo--com--2x49329d48d6c.wsipv6.com/	Get hash	malicious	Unknown	Browse
163.171.128.150	https://www--wellsfargo--com--mx49329d48d6c.wsipv6.com/	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
easeusinfo.us-east-1.log.aliyuncs.com	DRW14.0_Trial.exe	Get hash	malicious	Unknown	Browse	47.252.97.212
track.easeus.com.whecloud.com	testfile2.exe	Get hash	malicious	Unknown	Browse	163.171.132.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CNNIC-ALIBABA-US-NET-APAlibabaUSTechnologyCoLtdC	FRA.0038253.exe	Get hash	malicious	FormBook, GuLoader	Browse	47.243.134.243
	waybillDoc_20052024.exe	Get hash	malicious	FormBook, GuLoader	Browse	47.243.134.243
	https://mte-reguje.onrender.com/?scn=29023&ble=statistics&em=314387306_160807	Get hash	malicious	Phisher	Browse	47.254.144.66
	zDAH4anUtC.elf	Get hash	malicious	Unknown	Browse	47.88.168.114
	fa10576.exe	Get hash	malicious	FormBook, GuLoader	Browse	47.243.134.243
	SlHgSOYcMY.exe	Get hash	malicious	Unknown	Browse	47.88.4.215
	Your file name without extension goes here.exe	Get hash	malicious	FormBook	Browse	47.243.134.243
	loader.exe	Get hash	malicious	CobaltStrike	Browse	8.219.94.174
	loader.exe	Get hash	malicious	CobaltStrike	Browse	8.219.94.174
	setup#U67e5#U8be2#U7248.exe	Get hash	malicious	Unknown	Browse	47.75.18.205
QUANTILNETWORKSUS	bR9Ri9cFkm.elf	Get hash	malicious	Unknown	Browse	220.242.145.244
	http://0.0.0mail3.cryptonight.net/	Get hash	malicious	Unknown	Browse	163.171.137.177
	http://0fileserver.cryptonight.net/	Get hash	malicious	Unknown	Browse	163.171.137.177
	http://caoca.2826864149.workers.dev/	Get hash	malicious	Unknown	Browse	163.171.131.248
	http://cctv.qmimi.workers.dev/	Get hash	malicious	Unknown	Browse	163.171.131.248
	http://cdnheicloudeuorg-1015.iaku-1.workers.dev/	Get hash	malicious	Unknown	Browse	163.171.131.248
	http://cdnheicloudeuorg-1015.iaku-1.workers.dev/	Get hash	malicious	Unknown	Browse	163.171.131.248
	3rFz8BnDmn.elf	Get hash	malicious	Mirai	Browse	116.254.200.248
	X7oMmXD99L.elf	Get hash	malicious	Mirai	Browse	220.242.145.224
	SecuriteInfo.com.Trojan.DownLoader40.40259.3271.29415.exe	Get hash	malicious	Unknown	Browse	157.185.170.144

Process:	C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Arabic.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	5654
Entropy (8bit):	5.191098703346186
Encrypted:	false
SSDEEP:	96:SD8jLrznJvUw/UOA1forwTmWREtKNlWAWSwjHWDv947B3sc9oC36rDE6YRAYJS:SD8jLrznJvUw/Up1A1WREtKrx9wSDv28
MD5:	B334764EB0A1069F6BA04C8E1F088CD0
SHA1:	94937BE84E853031683E426886FE1861F0B397ED
SHA-256:	D9A87257F203A80489756B8B31628FFF8D10AAB229D20A637A083059233DC54C
SHA-512:	2E643CF3E089A20495E85441FC2904555C5C87BC15118C1136860736F295EAC00D5D761ECD12D01B5A017757B04325A394CA50FCB147A854028835BD9B6D0810
Malicious:	false
Reputation:	low
Preview:	[string]..InstallerName=%1 .........ProductName=EaseUS Data Recovery Wizard..RecommendProductName=Mobimover..InstallNow=..... ......InstallRecommend=%1 .......LicenseTps= %1 ... .... .......LicenseClick=....... ..... EaseUS..CustomInstall=....... .........Languge=.......InstallationPath =.... .........AgreeExperience=........ ... ........ .. ...... ..... ..... .........Downloading=.... ....... .... .............WaitTime=(.. ....... ........ .... %1m %2s.)..Installing =..........DownloadFailed=... .........CheckNet=...... ...... .. ..... .........DownloadOffline=..... ... .......Retry=..... ..........StartNow=.... ......Later=.......StartNowTips=...........................InstallFailed=... .........InstallFailedTip

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Chinese.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3835
Entropy (8bit):	6.29016396880312
Encrypted:	false
SSDEEP:	96:Sz9rI59jSvRD27+2OWesAWSwjsR74e/W2AdQ3oS+XruV/:Sz9rEjYRD27+2OWG9w4YDKV/
MD5:	FD6CA501ED9A613A5094EB4C92C1A847
SHA1:	DD0FB0EDD4ABDA1A3F6367086D99BFE5661B6B6A
SHA-256:	4637C9C3FF511C3F15CB482C5A3EE42A3237D26AD002B2FCC3FF467E7A10B99F
SHA-512:	3DF1A140ECD3E75F5B61CCB5018ED823F4619F8A32931E3A8D2244B998E76F724BB5C699C487C6B4077934CA14F832A68A47BA0469780D912C162B51EA335351
Malicious:	false
Reputation:	low
Preview:	[string]..InstallerName=%1.....ProductName=........RecommendProductName=Mobimover..InstallNow=......InstallRecommend=..%1..LicenseTps=........ %1..LicenseClick= EaseUS .......CustomInstall=......Languge=....InstallationPath =......AgreeExperience=..............Downloading=.............WaitTime= (.... %1m %2s...Installing =.........DownloadFailed=......CheckNet=..........DownloadOffline=......Retry=....StartNow=......Later=......StartNowTips=...........InstallFailed=......InstallFailedTips=......................Restart=......btn_Restartnow=......lb_RestartText=.............lb_RestartTip=.........................FailedSolveSteps=........RestartSt

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\ChineseTrad.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3906
Entropy (8bit):	6.304017277626276
Encrypted:	false
SSDEEP:	96:Ah2hiHlqOeXvZaqzSSwjXvCewCqIqQsrTIMTl5rTXOLX9PBq8:i2hODkvZawhwWDCqIcrRvk9Jq8
MD5:	FE7AD6D1DD07AEAFEECE921ECB23F3E7
SHA1:	86E74EBDE9C8C6E90E64A757DAF12FD69B75E4EB
SHA-256:	7EF907A793D9087AA804A688BDDDECF33A76011E4D820E7332533C070277507F
SHA-512:	6F854D16E4828842713A58AE0E15ABDFC01B9DF85E5CC8ABB4BBD07FC5B6988584EB767E3639510C9B7698A70D38341014517D90EB8FD63E7F10E77EFE10DF4C
Malicious:	false
Reputation:	low
Preview:	[string] ..InstallerName=%1.....ProductName=EaseUS Data Recovery Wizard..RecommendProductName=Mobimover..InstallNow=......InstallRecommend=..%1..LicenseTps=........%1 ..LicenseClick=......CustomInstall=......Languge=....InstallationPath =......AgreeExperience=..............Downloading=.............WaitTime= ..... %1m %2s....Installing =........DownloadFailed=......CheckNet=..........DownloadOffline=......Retry=......StartNow=......Later=....StartNowTips=...........InstallFailed=......InstallFailedTips=........................Restart=......btn_Restartnow=........lb_RestartText=...............lb_RestartTip=...........................FailedSolveSteps=.

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Danish.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4234
Entropy (8bit):	4.9732153426133765
Encrypted:	false
SSDEEP:	96:SZnzwqTQqZCR9s7ZFcZeoAWSwjVbHg6F4f0CMBhYah/6CC7Pd2Wp3:SZzTTQqZCR9an9wJHz00n3BCwWp3
MD5:	EB6CB6A1EA028CAC7AE61DADC568C2F9
SHA1:	7DA5B3E2F2F3FE326BC5EB4F073DB2B46F3381AF
SHA-256:	4524116093969EE206FA4F04D84346349ED551B4D7B87D4206E9A12D32AF5D61
SHA-512:	1FF642BDAE2E7519EB0BA3802718146DB9440BD7356F363F51CEA82193E0222C01504D726D49588F4B523E8BB112068408C2EBBB8A669705499D4342A430F7DA
Malicious:	false
Reputation:	low
Preview:	[string]..InstallerName=%1 Installer..ProductName=EaseUS Data Recovery Wizard..RecommendProductName=Mobimover..InstallNow=Installer nu..InstallRecommend=Installer %1..LicenseTps=Jeg har l.st og accepteret %1..LicenseClick=EaseUS licensaftale..CustomInstall=Installationsindstillinger..Languge=Sprog..InstallationPath =Installationsvej..AgreeExperience=Enig at deltage i Customer Experience Improvement Programmet..Downloading=Downloader, vent venligst.....WaitTime=(det forventes at vente i %1m %2s.)..Installing =Installerer, vent venligst.....DownloadFailed=Download mislykkedes..CheckNet=Kontroller netv.rksforbindelsen...DownloadOffline=Download offline..Retry=Fors.g igen..StartNow=Start nu..Later=Senere..StartNowTips=Vil du starte programmet nu?..InstallFailed=Installation mislykkedes..InstallFailedTips=Download offline for at f. fuld installationspakke eller genstart pc'en for at pr.ve igen...Restart=Genstart..btn_Restartnow=Genstart nu..lb_RestartText=Sikker p. at genstarte pc'en

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Dutch.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4503
Entropy (8bit):	4.93018089287948
Encrypted:	false
SSDEEP:	96:SSBYgKiCsYTaFnSZJcNzSSwjbutYZ5+e0ukUk6TG5hWTZPALH8E2LmX7:Sopka54cdhwetYZh0NlKYLHgyr
MD5:	E4E098A3E165FC5ECB4CB806B7E6E9D8
SHA1:	3384368FCFED720E743ABE5D4DA5F358BE22A11C
SHA-256:	3FE882930B7C5299290AE6C0C20AE065BD915984B381436B1C3D1D1CBFC67127
SHA-512:	76F6B463708AB529838AF6E66664B56D3E4959DFE82DBB9ECF9CB8EEAB63617DD8A7C8773ECA4B2A1703F19475A1E0AF31C6E992CB52F823DE29CDE16798A677
Malicious:	false
Reputation:	low
Preview:	[string]..InstallerName=%1 Installatiewizard..ProductName=EaseUS Data Recovery Wizard..RecommendProductName=Mobimover..InstallNow=Nu Installeren..InstallRecommend=Installeer %1..LicenseTps=%1 gelezen en ga er mee akkoord..LicenseClick=EaseUS Licentie Overeenkomst..CustomInstall=Installatie-instellingen..Languge=Taal..InstallationPath =Installatiepad..AgreeExperience=Ik wil deelnemen aan het klanttevredenheidsonderzoek..Downloading=Downloaden, even geduld a.u.b......WaitTime= (Er wordt verwacht dat er wordt gewacht op %1m %2s.)..Installing =Installeren.....DownloadFailed=Downloaden Mislukt..CheckNet=Controleer de netwerkverbinding..DownloadOffline=In Browser Downloaden..Retry=Opnieuw Proberen..StartNow=Nu Beginnen..Later=Later..StartNowTips=Wilt u het programma nu starten?..InstallFailed=Installatie Mislukt..InstallFailedTips=Download offline om het volledige installatiepakket te krijgen of start de pc opnieuw op om het opnieuw te proberen...Restart=Opnieuw Opstarten..btn_Restartnow=Sta

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1263112
Entropy (8bit):	6.600651467754926
Encrypted:	false
SSDEEP:	24576:JisJdAcuXY/WQjkLxNEl5DYjwuoJ039NzO0lQHoR8lOuLkdNoQv:PjYzhQHou8qkboQv
MD5:	8A250A75859FE52116E706A640E6D77C
SHA1:	473C36D9D80173636FAEEB0AE4AE9E047E4E9D8B
SHA-256:	823AB6955052EF34218559B53D4F15224B5A850B532672FA33A7634DC74981DC
SHA-512:	4B519B1DE8F6647A5CBBDA11084D096E8BBFE8F694F4FDA0E0F244B477F3F15C143254B044B046302AC79B136377894027D9BAA2D4BA67ED38F5A55F480A44B4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?.1Z{._.{._.{._.\.1.z._....\|._.r..._._.r...4._.r....._.\.2.v._.\.$.`._.{.^..._.e....._.r...8._.e...z._.r...z._.Rich{._.........PE..L......e.................F...................`....@.......................................@.................................D............................*..........g...............................L..@............`...............................text....E.......F.................. ..`.rdata.......`.......J..............@..@.data....\...0...4..................@....rsrc................@..............@..@.reloc...............F..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EasyLog.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	294
Entropy (8bit):	5.553752885599058
Encrypted:	false
SSDEEP:	6:tICb6qwNwT0gwWLwgOXLgGYjJz46uBShYRf6LDSrVhH/WEs70f1H770fy:KMQgjwgOXyJzJexRfKcHrdtHMK
MD5:	D25FFA955789F2DF613B239901D8CE62
SHA1:	EF880E097BB1E5289BF9CED898EF58DCCC65275C
SHA-256:	CBD0F2436CFF7BF3A2A93A88391EDA70889DA487D20F368FA1F78083AD2BBF7D
SHA-512:	6BA150FAEDE05C06A27F66754E47F69C484DAE062AB08ECA740B1924B1175B15AD26FA97FE2A70079543BFF9D7DE3649DD9D250EBF227C5DCE94925E19C583D6
Malicious:	false
Preview:	[7444]-12:06:52:991 ParseCmdLine param=EXEDIR=C:\Users\user\Desktop \|\|\| EXENAME=drw_free_installer.17163939163819b153.exe \|\|\| DOWNLOAD_VERSION=free \|\|\| PRODUCT_VERSION=2.0.0 \|\|\| INSTALL_TYPE=0...[7444]-12:06:53:397 Install recomand return=259..[7444]-12:06:55:491 Install recomand return=259..

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\French.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4738
Entropy (8bit):	4.9952395764331605
Encrypted:	false
SSDEEP:	96:SLmzQ90jiP1LkucYPdSwjHstWF6s/CUcYZb90O+9EPgsVHYfg:SLme0AhRc0gwLUWosqU0uY8kg
MD5:	1737B0DE1DA74E1D45285479CE66E556
SHA1:	9FF6A57D9186F3AAE00E4C307959FF7CA24C118A
SHA-256:	201229433F78F5CB87A9357921F34CAA2820B2917FF572E82A57D31DB5774E46
SHA-512:	DBDFB1DE474EEA240D1797DC35143F7258F6EC19C4A74F2C47645CD4A4253654975B90D9BBFCB202CC33D3BF872BB2FB967AA7AAC5A25C6991DEC794C184C9A1
Malicious:	false
Preview:	[string]..InstallerName=%1 Installateur..ProductName=EaseUS Data Recovery Wizard..RecommendProductName=Mobimover..InstallNow=Installer maintenant..InstallRecommend=Installer %1..LicenseTps=J'ai lu et accept. le %1..LicenseClick=contrat de licence d'EaseUS..CustomInstall=Param.tres d'installation..Languge=La langue..InstallationPath =Chemin d'installation..AgreeExperience=J'accepte de participer au programme d.am.lioration d'exp.rience d'utilisateur..Downloading=T.l.chargement, veuillez patienter.....WaitTime= (il est pr.vu d'attendre %1m %2s.)..Installing =Installation en cours .....DownloadFailed=Echec du t.l.chargement..CheckNet=Veuillez v.rifier la connexion r.seau...DownloadOffline=T.l.charger hors ligne..Retry=R.essayer..StartNow=D.marrer..Later=Plus tard..StartNowTips=Voulez-vous d.marrer le programme maintenant?..InstallFailed=L'installation a .chou...InstallFailedTips=T.l.charger hors ligne pour obtenir le package d'installation complet ou red.marrer le P

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\German.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4711
Entropy (8bit):	4.942043533856361
Encrypted:	false
SSDEEP:	96:ShppFF6wxWsMj8rSzSSwjnf7lWMpOKuFjDPuz09tKTNa2hTMYOOtD2W:ShpLF9xWzwrIhwbxFpOKuL24W
MD5:	DECAA2CBBACCAE2A64C588243FBD6435
SHA1:	851020B5CD91A24720A2A61CC75108106679C618
SHA-256:	4FFD51F20C76EE5D6CBAF16EA2AB9D0A0B0491E710C42D548724D5B5AAF3D55F
SHA-512:	3B1EA0DEE1AABB64D9335B6FA7C62F6EA4D57DA94D37085D3D5D0E995FE9BF5A7F34FE4946D874850C595800BEE00E38E054BB47923014AB596AD00B1C06BED2
Malicious:	false
Preview:	[string]..InstallerName=%1 Installationsprogramm..ProductName=EaseUS Data Recovery Wizard..RecommendProductName=Mobimover..InstallNow=Jetzt installieren..InstallRecommend=Install %1..LicenseTps=Ich habe die %1 gelesen und akzeptiere sie..LicenseClick=EaseUS Lizenzvereinbarung..CustomInstall=Installationseinstellungen..Languge=Sprache..InstallationPath =Installationspfad..AgreeExperience=Ich m.chte am Programm zur Verbesserung der Benutzerfreundlichkeit teilnehmen..Downloading=Wird heruntergeladen, bitte warten.....WaitTime= (es wird erwartet, dass Sie f.r %1m %2s warten.)..Installing =Installieren.....DownloadFailed=Download Fehlgeschlagen..CheckNet=Bitte .berpr.fen Sie Ihre Internetverbindung...DownloadOffline=Offline Download..Retry=Erneut versuchen..StartNow=Jetzt starten..Later=Sp.ter..StartNowTips=M.chten Sie jetzt das Programm starten?..InstallFailed=Installation fehlgeschlagen..InstallFailedTips=Laden Sie offline herunter, um vollst.ndiges Installationspaket zu erhalten,

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Indonesian.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4274
Entropy (8bit):	4.952172846989875
Encrypted:	false
SSDEEP:	96:S1swSU1kpYKS7jioPAWSwja5G0JnjivGqTQ0UpJVCqk2O:S17kpYtio49waOv2p7dO
MD5:	38629FAB2999407FE8FA2DBABB097B57
SHA1:	692493408FC72747128B5678C8E5140C8C59B49E
SHA-256:	13F413DBFCBC4537D83F77E34EF0C9FA868BFA07792E990F4E94526CCEB79848
SHA-512:	1AA8283F315617C12F2BF79F1BEEC98C7319FD26A507A566B4F1130067E468817373D71EF35C2B8BBABD60E304A467F06FEBE14FF5496871CDA80E6EDCD3A70B
Malicious:	false
Preview:	[string]..InstallerName=%1 Menginstal..ProductName=EaseUS Data Recovery Wizard..RecommendProductName=Mobimover..InstallNow=Instal sekarang..InstallRecommend=Menginstal %1..LicenseTps=Saya telah membaca dan menerima %1..LicenseClick=perjanjian lisensi EaseUS..CustomInstall=Pengaturan instalasi..Languge=Bahasa..InstallationPath =Jalur instalasi..AgreeExperience=Setuju untuk berpartisipasi dalam Program peningkatan pengalaman Custmer..Downloading=Mengunduh, harap tunggu...WaitTime= (Diperkirakan menunggu selama %1m %2s.)..Installing =Instalasi.....DownloadFailed=Download gagal..CheckNet=Periksa koneksi jaringan...DownloadOffline=Download secara Offline..Retry=Coba lagi..StartNow=Mulai sekarang..Later=Kemudian..StartNowTips=Ingin Mulai Program Sekarang?..InstallFailed=Instalasi gagal..InstallFailedTips=Unduh offline untuk mendapatkan paket instalasi lengkap atau restart PC untuk mencoba lagi...Restart=Restart..btn_Restartnow=Restart sekarang..lb_RestartText=Tentu Mulai Ulang PC Sekarang?

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\InitConfigure.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Generic INItialization configuration [Language]
Category:	dropped
Size (bytes):	4153
Entropy (8bit):	6.043636147359956
Encrypted:	false
SSDEEP:	96:w+Pa4QWnrxj0yJLVDLGWCiB5LOQbwcx1vy2Mim7+rUUM0b:Ba4QWnrayJLVf2iB1O+wA2imKUUJb
MD5:	B71A433376606884D121F5017D0B58F2
SHA1:	338C2ECCC9D45AEA410650302DC2D6ED5C27B24D
SHA-256:	3833439CF03C0151A53B05E080878D39C36C28F68CBFCD2B6673A7B4ACB3BC0D
SHA-512:	8B4AC6C2EDDCC774EAE8224DFF2E3A618A041E0DC0241CF8F469CE53E771DA28BF9836DF46AEEAD0162172B58B67B71007DFC1BCEE05D8BFDE5A41F2BEACD32A
Malicious:	false
Preview:	[Product]..;LanguageType=English,....,Portugu.s,Fran.ais,Espa.ol,Deutsch,Nederlands,Italiano,.....;...............ProductID=2 ..ProductName=DRW..ProductExtentPath=EaseUS Data Recovery Wizard..ProductEventName=EaseUS_Data_Recovery_Wizard ..;..ID..RecommendProductID=1 ..;....ID..ProductProcess=DRW.exe,DRWUI.exe,EURawImg.exe,EuOfficeRepairWin32.exe..FreeVersionName=free..TrialVersionName=trial ..productContrastPage=0 ..;....... 1....0.....HasRecommendProduct=0 ..;.......,1....0.....homepage=normolPage..;....tbHomePage ebcHomePage ,normolPage ..InstallPath=EaseUS\EaseUS Data Recovery Wizard..;........BackUpPath=C:\Program Files..;......BProgramFilesPath=1..;.....program files 1. 0...InstallProgramFilesPath=C:\Program Files..;...program files.

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Italian.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4364
Entropy (8bit):	4.874617869709843
Encrypted:	false
SSDEEP:	96:Stfvy/ZuHm5toQv+W7RwwjAooPiqEHHS7qN2OhIoHb2Ww:StfvyBuHm5td+WFwwEqo7ICWw
MD5:	AF930A64DA61B99CB120C8A3222456EB
SHA1:	2B5F3F2EC77F649AABBC6CF40FE7DD337152E9EE
SHA-256:	1287CD9E6626EC2081379694A309578C1D83BCA25B2C621D1A5D4608CD7AF9BF
SHA-512:	4E7672D00C62CE1C7C437B99EAEC0FE48FAB3586E3D2AC8AB2A294FB30D30D52436AC7CE339023C6E3D56A4774F4ADD5C4B398568E087D3D930C8C63FD816CC6
Malicious:	false
Preview:	[string]..InstallerName=Installazione di %1..ProductName=EaseUS Data Recovery Wizard..RecommendProductName=Mobimover..InstallNow=Installa Ora..InstallRecommend=Installare %1..LicenseTps=Ho letto e accetto le %1..LicenseClick=condizioni di licenza di EaseUS..CustomInstall=Impostazioni di installazione..Languge=Lingua..InstallationPath =Percorso..AgreeExperience=Acconsento di partecipare al programma raccolta statistiche anonime uso programma...Downloading=Download in corso, prego attendere.....WaitTime=(Ci vorrebero %1m %2s.)..Installing =Installando.....DownloadFailed=Scarica Fallita..CheckNet=Controlla la connessione di rete...DownloadOffline=Scarica Offline..Retry=Riprova..StartNow=Inizia Ora..Later=Pi. Tardi..StartNowTips=Avvia ora il programma?..InstallFailed=Installazione Fallita..InstallFailedTips=Scaricare offline per ottenere il pacchetto di installazione completo o riavviare il PC per riprovare...Restart=Riavvia..btn_Restartnow=Riavvia ora..lb_RestartText=Sei sicuro di voler

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Japanese.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	5152
Entropy (8bit):	5.791494327764329
Encrypted:	false
SSDEEP:	96:Sg+plo5HSr7ddPb/L+2YZ+wjRFDueZGTkR+xfST5voSTENTS/xFRi:Sg+I5HWXTLsZ+wTCNEvphtpFRi
MD5:	76E3CFD74C8A8C99CCD461F17CBABD4D
SHA1:	6200D3958A80AE2E7F10134256AD27EBE7037212
SHA-256:	64EFC20036A6CAD10DDBDB014444C55B6DB93A481EE5FE84210DEB2377918BB8
SHA-512:	3E69FF59296D8D36EC52C6FBA37252CA2E648BB51ABA0BDFE51FD8B2C341C4A9CE2722F372704706D9A34A40F1F38D90898ECD66FE3FBA0DE394A1457214C75E
Malicious:	false
Preview:	[string]..InstallerName=%1 .........ProductName=EaseUS Data Recovery Wizard..RecommendProductName=Mobimover..InstallNow=.............InstallRecommend=%1..........LicenseTps=...............%1..LicenseClick=EaseUS..............CustomInstall=..........Languge=....InstallationPath =.........AgreeExperience=.............................Downloading=..........................WaitTime= (......: %1m %2s)..Installing =.........DownloadFailed=...............CheckNet=...................DownloadOffline=..............Retry=.......StartNow=........Later=....StartNowTips=..................InstallFailed=.

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Korean.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4550
Entropy (8bit):	6.037034351000263
Encrypted:	false
SSDEEP:	96:SezghdCE00TFTU54eSsdv3FTA3PwjHW66N51SPTyMp5bSK1cFOm2W32:Sezghu48PZ3G3PwhIwmIhT/W32
MD5:	81C343D7615A71FFA127E317C98B357E
SHA1:	F0B469E102E13384C063AA78C454ABE83233698E
SHA-256:	7E8E799B95A5E6F5AA8A18ACB78E6454E634AE52A4615F7A0B0740A51766A26F
SHA-512:	B8C8E35C4CFC609ABA55548489063D2EACB310805A0922DDF63507BF8FC084C983690DC7CE82D373C78A896EAC2EF4EAF92EE666D37DE8E5FC0B62C10D8E896C
Malicious:	false
Preview:	[string]..InstallerName=%1 ....ProductName=EaseUS Data Recovery Wizard..RecommendProductName=Mobimover..InstallNow=.. ....InstallRecommend=%1 ....LicenseTps=.. .. .. %1..LicenseClick=EaseUS .... ....CustomInstall=.. ....Languge=....InstallationPath =.. ....AgreeExperience=... .. .. .... ... ........Downloading=.... ..... ... ... .........WaitTime= ( %1m %2s .. ... ... ......)..Installing =.. ......DownloadFailed=.... ....CheckNet=........ ... .........DownloadOffline=.... ......Retry=.....StartNow=.. ....Later=.....StartNowTips=.. ..... ........?..InstallFailed=.. ....InstallFailedTips=.. .. .... .... ...... ....... PC. .. .... .. ...

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\LanguageTransfor.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.079622313957315
Encrypted:	false
SSDEEP:	6:5Qk+Jg+Ycc38A7XO4vo6xqrk3Eymec1iYlEJEHhuB3QRFLVGpteMKnnQex/:u/QP7XOqxqaiKXB3QRFJCLoQu/
MD5:	FFE692A67871185785EC705B1CC12C81
SHA1:	06A12BFFDFF33024A7B8798BDCDCDA1FD7255BCC
SHA-256:	373BEC6E7976324FF879C2988BAB772C69336D7BCB9A32386A6021568350A824
SHA-512:	7ECDB5A4E625370888FB3A827CB668E934E29CA764177FCA04E4EB620BEC2B664FE498C0E9E73288BF977006EABA9618A4DC5A169E0FC5588A0874D9E6BB6C50
Malicious:	false
Preview:	;...........[Language]..English=en..Japanese=jp..German=de..French=fr..Spanish=sp..Portuguese=pobr..Italian=ita..Dutch=dut..ChineseTrad=cht..Chinese=ch..Danish=Den..Swedish=Swe..Polish=Pol..Arabic=Arb..Korean=Kor..Russian=Rus..Norwegian=Nor..Indonesian=Ind..turkish=Tuk..Mungarian=Mun..Thai=Tha..Malay=Mas..

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Malay.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4341
Entropy (8bit):	4.887667630289714
Encrypted:	false
SSDEEP:	96:SBlXdu0pCYpBPvGZ4I9Bj1cV20jFkDdETlRnCyPlT0lJc2qk2T:SBlX9CYpxvGr7pcV20j9ChWrdT
MD5:	534A5DFA634D7B7DF7A581D4E1D08F78
SHA1:	2C2AD2EF1DFBAFB69EDBA2F1EA7EFA152420DBA0
SHA-256:	984E71C01CB1C2DFB260AE1C0F764F6BDF91E4F523F5DC4161B3D19456993CBB
SHA-512:	7D4B6D6CCE8A6C7BF18803F69988FC54D80DD30E48DBB5336C587CEA8BC74CE1E553E1E549D43A2C2B6A2BA4D3538552DF4C5A684818A7E7EE63DB466C96EAE2
Malicious:	false
Preview:	[string]..InstallerName=%1 pemasang..ProductName=EaseUS Data Recovery Wizard..RecommendProductName=Mobimover..InstallNow=Pasang sekarang..InstallRecommend=Pasang %1..LicenseTps=Saya telah membaca dan menerima %1..LicenseClick=Perjanjian Lesen EaseUS..CustomInstall=Tetapan pemasangan..Languge=Bahasa..InstallationPath=Laluan Pemasangan..AgreeExperience=Bersetuju untuk menyertai Program Peningkatan Pengalaman Pelanggan..Downloading=Sedang Memuat turun..Installing=Memuat turun, sila tunggu...DownloadFailed=Muat turun gagal..WaitTime= (Ia dijangka menunggu selama %1m %2s.)..CheckNet=Sila periksa sambungan rangkaian...DownloadOffline=Muat turun Luar Talian..Retry=Cuba lagi..StartNow=Mulakan sekarang..Later=Kemudian..StartNowTips=Ingin Memulakan Program Sekarang?..InstallFailed=Pemasangan gagal..InstallFailedTips=Muat turun di luar talian untuk mendapatkan pakej pemasangan penuh atau mulakan semula PC untuk mencuba lagi...Restart=Mulakan semula PC..btn_Restartnow=Mulakan semula sekarang..lb

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Mungarian.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	5647
Entropy (8bit):	5.242008838233848
Encrypted:	false
SSDEEP:	96:St824dcCSfLhwjAWSwjbKkkRFgr0ZOE636z/WUsQ0d28SYSQnP1m/T66i/v2pm:St8HdPSf1wc9wfKkk7m6br7sGDP6tFX3
MD5:	35331ED66C059568C54865EF7D41087C
SHA1:	480FBFA2C4265C526B148A9725994C1C687355BD
SHA-256:	F55A35E6D3CCC944D4C264E34244A127BCE54079621CAB25D9E8E53CC1F9AC07
SHA-512:	70BD95CE94C32FCF5E252AA9762BA6BE8112D4F8FDD1172B3588246FA4A5E7C91E18179228BF9A5204FEF1D30563E7C69B1E1E0829310933A18B1478BF7F4199
Malicious:	false
Preview:	[string]..InstallerName=%1 telep.tse..ProductName=EaseUS Data Recovery Wizard..RecommendProductName=Mobimover..InstallNow=Felszerel most..InstallRecommend=%1 telep.t.se..LicenseTps=Elolvastam .s elfogadtam %1..LicenseClick=EaseUS licencszerz.d.st..CustomInstall=Telep.t.si be.ll.t.sok..Languge=Nyelv..InstallationPath =Telep.t.si .tvonal..AgreeExperience=Meg.llapodnak abban, hogy r.szt vegyenek custmer tapasztalat jav.t. program..Downloading=Let.lt.s, k.rj.k, v.rjon...WaitTime= (V.rhat.an %1p %2s.)..Installing =Telep.t.se.....DownloadFailed=Let.lt.s nem siker.lt..CheckNet=Ellen.rizze a h.l.zati kapcsolatot...DownloadOffline=Let.lt.s offline..Retry=.jra..StartNow=Elkezd most..Later=K.s.bb..StartNowTips=Szeretne most elind.tani a programot?..InstallFailed=Telep.t.s nem siker.lt..InstallFailedTips=T.ltse le offline .llapotban a teljes telep.t.csomag el.r.s.hez, vagy ind.tsa .jra a sz.m.t.g.pet, hogy .jra megpr.b.lja...Restart=Ind.

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Norwegian.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4331
Entropy (8bit):	4.986041692080868
Encrypted:	false
SSDEEP:	96:SZW6SqbvTbksATWSwj52UhqTk5Fgr0ZOE636z/WUsQ0d2l:SZNvv/kNT9wiTYm6br7sGl
MD5:	74F6E38B2B7AC3893B1AB6C092B854D1
SHA1:	583B35335D479E9E3BC6B412A7CAE52FC1B3D3BF
SHA-256:	9692FECB48E8745F26C235C8925F106E56E862CD1B7B8CA8C84B8CB751B7A748
SHA-512:	0464BE71E6EEAC902346D1A5119612D7BDE62D2EFCB15D4A14CF88814294358E69BA592CFD5F4B86EEB72FE3E3A9C2EDF61510AE16B16CA5D0A591DBB416E0AF
Malicious:	false
Preview:	[string]..InstallerName=%1 Installer..ProductName=EaseUS Data Recovery Wizard..RecommendProductName=Mobimover..InstallNow=Installer n...InstallRecommend=Installer %1..LicenseTps=Jeg har lest og akseptert %1..LicenseClick=EaseUS Lisensavtale..CustomInstall=Installasjonsinnstillinger..Languge=Spr.k..InstallationPath =Installasjonsvei..AgreeExperience=Godta . delta i Customer Experience Improvement Program..Downloading=Laster ned, vennligst vent.....WaitTime= (Det forventes . vente i %1m %2s.)..Installing =Installerer .....DownloadFailed=Nedlasting mislyktes..CheckNet=Vennligst sjekk nettverksforbindelsen...DownloadOffline=Last ned frakoblet..Retry=Pr.v igjen..StartNow=Start n...Later=Senere..StartNowTips=Vil du starte programmet n.?..InstallFailed=Installasjonen mislyktes..InstallFailedTips=Last ned offline for . f. full installasjonspakke eller start PC p. nytt for . pr.ve igjen...Restart=Restart..btn_Restartnow=Start p. nytt n...lb_RestartText=Sikker p. . starte PCen p.

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Polish.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4649
Entropy (8bit):	5.225222333646186
Encrypted:	false
SSDEEP:	96:SF1TP6QlypRZ6ZBZeZI451OueAWSwjQQZmZIIPKZ34V6bgI7ginVQoZnFNR2X0:SF1jVane3yt1Bp9w/K/O5LjFNm0
MD5:	DEF85351F7FDA76B962D6DE5F86F5FE5
SHA1:	C47F43BCD9FF278429297B559E9103642C4A7EFC
SHA-256:	E833E96EA0E4568FDDF90386AFDFF3F9BED6EA643FAF9EE6BC0938BE71344294
SHA-512:	0A9FD9F708B7EECA12ED9F361B379EB1C89571E06679E06DC4DAA4A4694B29B25F69ADA42A8133CE8E067383B1A6579A320D91E543521EF9F555D17FBD9C01D4
Malicious:	false
Preview:	[string]..InstallerName=%1 Instalacja..ProductName=EaseUS Data Recovery Wizard..RecommendProductName=Mobimover..InstallNow=Zainstaluj teraz..InstallRecommend=Instalacja %1..LicenseTps=Przeczyta.em i zaakceptowa.em %1..LicenseClick=umow. licencyjn. EaseUS..CustomInstall=Ustawienia instalacji..Languge=J.zyk..InstallationPath =.cie.ka instalacji..AgreeExperience=Zgadzam si. na uczestnictwo w programie poprawy jako.ci obs.ugi klienta..Downloading=Pobieranie, prosz. czeka....WaitTime= (Oczekuje si., .e b.dzie czeka. %1m %2s.)..Installing =Instalowanie.....DownloadFailed=Pobieranie nie poWiod.o si...CheckNet=Prosz. sprawdzi. po..czenie sieciowe...DownloadOffline=Pobierz w trybie offline..Retry=Pon.w pr.b...StartNow=Zacznij teraz..Later=P..niej..StartNowTips=Chcesz rozpocz.. program teraz?..InstallFailed=Instalacja nie poWiod.a si...InstallFailedTips=Pobierz offline, aby uzyska. pe.ny pakiet instalacyjny lub uruchom ponownie komputer, aby spr.bowa. ponowni

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Portuguese.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4433
Entropy (8bit):	4.991097438110485
Encrypted:	false
SSDEEP:	96:SB3g+ctNMPGfSfzSSwjE+EBTZkCSZOkZK2M8:SB3g+ctyPGfehwI7SM8
MD5:	7DA92400736262F4E3032DC4B977AB39
SHA1:	B08A564C2F4138714614DBE436673B724C9FA2B0
SHA-256:	E22707B2E0E21C3DF87F7F85EDA9A3E76F98BDB76EDD3ED07CD19DBFA2CDC967
SHA-512:	132E55942B2F4C638B32EE51FE5C1510E83F8D290076D4BBC86B5D6797B47C844D66C5EB84E14C98DC4912F0F5D4B1339B59B239C8E5C6404387E991728997BA
Malicious:	false
Preview:	[string]..InstallerName=Instalador de %1..ProductName=EaseUS Data Recovery Wizard..RecommendProductName=Mobimover..InstallNow=Instalar Agora..InstallRecommend=Instalar %1..LicenseTps=Eu li e aceito %1..LicenseClick=Contrato de Licen.a da EaseUS..CustomInstall=Configura..o de instalar..Languge=L.ngua..InstallationPath =Caminho de instalar..AgreeExperience=Concordar em participar do Programa de Melhoria da Experi.ncia do Cliente..Downloading=Baixando, aguarde.....WaitTime=(espera-se esperar %1m %2s.)..Installing =Instalando.....DownloadFailed=Falha no Download..CheckNet=Verifique a conex.o de rede...DownloadOffline=Baixar off-line..Retry=Tente novamente..StartNow=Iniciar Agora..Later=Mais Tarde..StartNowTips=Quer iniciar o programa agora?..InstallFailed=Instala..o Falhada..InstallFailedTips=Fa.a o download offline para obter o pacote de instala..o completo ou reinicie o PC para tentar novamente...Restart=Reiniciar..btn_Restartnow=Reiniciar Agora..lb_RestartText=Tem certeza que

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Russian.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	6500
Entropy (8bit):	5.159362915190586
Encrypted:	false
SSDEEP:	96:SeKiY2bqUw9sKzwYYNaum9E+DmAWSwj4hwRt5P6dSRR/0plczz22W7:SeKP2WU6s1fm3DB9wLRt5zvW7
MD5:	5AFE8AE210DFF6FB6962030283B9EF2A
SHA1:	F5F5DBB648466DF9F3D5CEB8C7770BFD7E2D5880
SHA-256:	043B705D2B019574E7BEF57BD2DDA9E916BB85C56E4B375DDB5F5C06AB21B936
SHA-512:	5607D47174D444E9CC1EB3DA0EF97773BF8B28096380DBD8C6AD1C3E0D0102D092A9B43661F48192E05CB09CACC51E4D5DDB98BF2E15C0FEF92B19ABDC61243F
Malicious:	false
Preview:	[string]..InstallerName=%1 ...........ProductName=EaseUS Data Recovery Wizard..RecommendProductName=Mobimover..InstallNow=.......... ........InstallRecommend=......... %1..LicenseTps=. ........ . ...... ............ %1..LicenseClick=.......... EaseUS..CustomInstall=......... ...........Languge=......InstallationPath =.... ...........AgreeExperience=....... ....... . ......... ......... ..... custmer..Downloading=........, ............WaitTime= (......... ..... ........ %1m %2s.)..Installing =..............DownloadFailed=.... ... ..........CheckNet=......... ....... ..............DownloadOffline=....... .........Retry=...........StartNow=...... ........Later=.......StartNowTips=......... .........

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Spanish.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4495
Entropy (8bit):	4.949457770160705
Encrypted:	false
SSDEEP:	96:SBc+r7UFtIbJuLdswj6cXj0g1diD/riG+LyG5L:SBaTIbMBswOc0V0L
MD5:	BBB23BFC6347B444DC4E53D72988040B
SHA1:	ED205392DF5999EBBD0A36BEA3EBCA1A2F33D2C3
SHA-256:	8EBEB0AC321D81F5C5E5B5E157C554350CC224BB7222A1C97EFFC8FF987AC9C2
SHA-512:	6EA1B732B6AAEABEAAE47630768972448BB34CC548B4F19C70ADBCE1D27FC01647B85749D0CD31682B823339D775CD9F4A6DDB7F35A643526C052FB8982112B9
Malicious:	false
Preview:	[string]..InstallerName=Instalador de %1..ProductName=EaseUS Data Recovery Wizard..RecommendProductName=Mobimover..InstallNow=Instalar ahora..InstallRecommend=Instalar %1..LicenseTps=He le.do y acepto %1..LicenseClick=el acuerdo de licencia de EaseUS..CustomInstall=Configuraci.n de la instalaci.n..Languge=Idioma..InstallationPath =Ruta..AgreeExperience=Acepto unirme al Programa para la mejora de la experiencia del usuario..Downloading=Descargando, por favor espere.....WaitTime= (se espera %1m %2s.)..Installing =Instalando......DownloadFailed=Descarga fallida..CheckNet=Compruebe la conexi.n de red...DownloadOffline=Descargar fuera de l.nea..Retry=Reintentar..StartNow=Ejecutarlo ahora..Later=M.s tarde..StartNowTips=.Quiere abrir el programa ahora?..InstallFailed=Instalaci.n fallida..InstallFailedTips=Descargar sin conexi.n para obtener el paquete de instalaci.n completo o reiniciar el PC para intentarlo de nuevo...Restart=Reiniciar..btn_Restartnow=Reiniciar ahora..lb_RestartTex

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Swedish.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4333
Entropy (8bit):	5.034197413624276
Encrypted:	false
SSDEEP:	96:SZwHa+6hR1wQmZBdwRuypKAWSwjH6BFvbaQJsIWTAz/4QRPaW2/:SZwHa+YRSjBwRuI19wj6LPIArjPY/
MD5:	2C206DD32AAE28D37379B6C3996705F3
SHA1:	BA777AA9E71E6C9974785B6B5FF1BFE761F4938F
SHA-256:	E708764646CC998C00D5CB4A916E9EC28DBA59C1A9DFDFF39EC4214EC2A65DAF
SHA-512:	54B1589121AD89CEFBF62F512FE5C82DAC21342D3F27428AD9CF93B7A6B0CB2C7EC42658C8748F8F33B2DCE18E2D6079BEA33F53DED20D7A938C13B37C50DF80
Malicious:	false
Preview:	[string]..InstallerName=%1 Installer..ProductName=EaseUS Data Recovery Wizard..RecommendProductName=Mobimover..InstallNow=Installera nu..InstallRecommend=Installera %1..LicenseTps=Jag har l.st och godk.nt %1..LicenseClick=EaseUS licensavtal..CustomInstall=Installationsinst.llningar..Languge=Spr.k..InstallationPath =Installationsv.gen..AgreeExperience=Enas om att delta i programmet Customer Experience Improvement..Downloading=H.mtar, v.nligen v.nta.....WaitTime= (Det f.rv.ntas v.nta i %1m %2s.)..Installing =Installerar.....DownloadFailed=H.mtning misslyckades..CheckNet=Kontrollera n.tverksanslutningen...DownloadOffline=H.mta offline..Retry=F.rs.k..StartNow=B.rja nu..Later=Senare..StartNowTips=Vill du b.rja programmet nu?..InstallFailed=Installation misslyckades..InstallFailedTips=Ladda ner offline f.r att f. fullt installationspaket eller starta om datorn f.r att f.rs.ka igen...Restart=Omstart..btn_Restartnow=Starta om nu..lb_RestartText=.r du s.ker p. att star

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Thai.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	8489
Entropy (8bit):	4.542747482857118
Encrypted:	false
SSDEEP:	192:S2isCjfllQjHl5U5oG151wWeo5ysNkQd5f8F7ZtVIn3tyK/e+3Zvi+MyWWjwz8Is:UsC7lCjHl5U5oG151wWeo5ysGQd5f8FK
MD5:	6E1EDD82F7D13D4A811982392466C002
SHA1:	4A6F3C8C945D485E6EAAD7DE6F334CFC8033B352
SHA-256:	69394BA3B1F01C4218E169A6E16B56C2C857BA9B0D7B1FD57FA808249E68793B
SHA-512:	F19B3DC3D96F9E88A77BE9EB726DB353E803EDDCADB55072935FBCCD51DB6B9B34FFEAAE1EE294CC12E1FE9AF0BFC3B821E2ECF79DB63E46E0F86D30A79517A4
Malicious:	false
Preview:	[string]..InstallerName=.......... %1..ProductName=EaseUS Data Recovery Wizard..RecommendProductName=Mobimover..InstallNow=.................InstallRecommend=....... %1..LicenseTps=................... %1 ......LicenseClick=...................... EaseUS..CustomInstall=......................Languge=......InstallationPath=...................AgreeExperience=................................................Downloading=.............. ..................WaitTime=(.................. %1m %2s)..Installing=..............DownloadFailed=...........

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Turkish.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4661
Entropy (8bit):	5.247656049357231
Encrypted:	false
SSDEEP:	96:SRDS3w7OzmLmtnqEWAe/z4/8KGGrztkxwOhiT8HMHZaEATP5+eTu482+:SR23w6zLtnHWAF/8KGG/tkwa0sEukg+
MD5:	0A80A0D0AC19F97D6133DC156499DC0B
SHA1:	29F54F8925E47CA22EECC1E65A698F5331D76E53
SHA-256:	29499DA747B2FA0CC759DE34D085682256912F4AB27E3ED64ACEE2F2474E355E
SHA-512:	899C54C48C19E8E8966DB086737DBA3C4A04916A339239BD5D9D3A4682B65140E670AAC29B736E5ACFCC60C493E9A0ABD713756AEDA2F7C7E7972A3C58C7E679
Malicious:	false
Preview:	[string]..InstallerName=%1 Y.kleyicisi..ProductName=EaseUS Data Recovery Wizard..RecommendProductName=Mobimover..InstallNow=.imdi Y.kle..InstallRecommend=%1 Y.kle..LicenseTps=%1 okudum ve kabul ediyorum..LicenseClick=EaseUS Lisans S.zle.mesi'ni..CustomInstall=Y.kleme ayarlar...Languge=Dil..InstallationPath =Kurulum Yolu..AgreeExperience=M..teri Deneyimi .yile.tirme Program.na kat.lmay. kabul ediyorum..Downloading=.ndiriliyor, l.tfen bekleyin...WaitTime= (%1m %2s kadar beklenmesi bekleniyor.)..Installing =Y.kleniyor..DownloadFailed=.ndirme Ba.ar.s.z Oldu..CheckNet=L.tfen a. ba.lant.s.n. g.zden ge.irin...DownloadOffline=.evrimd... .ndir..Retry=Yeniden Dene..StartNow=.imdi Ba.lat..Later=Sonra..StartNowTips=.imdi Program. Ba.latmak .stiyor Musunuz?..InstallFailed=Kurulum Ba.ar.s.z Oldu..InstallFailedTips=Tam kurulum paketini almak i.in .evrimd... indirin veya tekrar denemek i.in PC'yi yeniden ba.lat.n...Restart=Yeniden Ba.lat..btn_Rest

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunConfig.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	1396
Entropy (8bit):	3.918776434151241
Encrypted:	false
SSDEEP:	24:Ql5qoJthHI/J+kgb2X9EpsCXp46VeWKsG2LjeAWv/613QMQsKZSqyE:jgoEkbX9ESYDG2LjeHujTgyE
MD5:	42CFF8F654B455F29054F6FC887D6A98
SHA1:	49284E5BCD85D5C4148C958132C04BC3A95F8377
SHA-256:	FDCF2A6B26CE55C7D3C9E2BBEC7983C732A46A3107E57A1C4A74C957F31D9426
SHA-512:	0A0F2751874C62F5C9400EB80212C9FF6731E9E1FDF6E62CE1B2392AB8BDDA0D89B1D461C29934A87634DF0D0D203A61F32A3B695CB955660FCBF65EC20FB4E1
Malicious:	false
Preview:	......[.C.o.n.f.i.g.].....L.O.G.E.N.D.P.O.I.N.T.=.W.k.Z.o.T.m.R.G.c.F.h.S.b.n.B.r.U.X.p.C.N.F.R.H.M.T.R.k.b.H.A.1.T.l.d.o.a.V.I.y.d.z.F.a.R.m.M.x.Y.W.1.O.N.U.5.X.c.G.l.N.a.k.E.5.....A.C.C.E.S.S.K.E.Y.I.D.=.V.k.V.a.U.1.F.s.T.l.Z.T.a.1.Z.U.U.0.d.S.T.l.V.6.Q.j.B.N.b.U.1.3.W.j.N.o.U.F.V.U.M.D.k.=.....A.C.C.E.S.S.K.E.Y.S.E.C.R.E.T.=.V.1.d.4.T.2.Q.w.O.U.d.a.R.n.B.O.U.k.V.a.T.1.d.q.T.m.9.T.b.E.Z.1.V.G.p.G.U.2.V.r.W.k.t.Z.M.V.J.D.Y.z.A.x.W.G.F.G.T.l.d.h.b.V.J.o.V.1.d.0.T.m.V.R.P.T.0.=.....P.R.O.J.E.C.T.N.A.M.E.=.V.2.x.k.R.2.V.s.c.F.l.W.b.n.B.o.V.n.p.W.d.F.l.u.Y.z.l.Q.U.T.0.9.....L.O.G.S.T.O.R.E.N.A.M.E.=.W.W.t.j.N.W.J.t.T.X.p.V.b.l.p.q.Y.l.Z.a.b.V.d.r.a.E.t.N.M.W.d.5.Y.k.h.j.P.Q.=.=.....L.O.G.S.T.O.R.E.N.A.M.E.2.=.W.W.t.j.N.W.J.t.T.X.p.V.b.l.p.q.Y.l.Z.a.b.V.d.r.a.E.t.N.M.W.d.5.T.l.h.a.a.F.d.F.R.T.k.=.....b.A.l.l.o.w.S.e.n.d.I.n.f.o.=.1.....b.A.u.t.o.A.d.d.U.i.d.=.1.....b.A.u.t.o.A.d.d.T.i.m.e.s.t.a.m.p.=.1.....b.G.e.n.e.r.a.t.e.T.e.s.t.I.n.f.o.=.1.....n.b.L.i.m.i.t.K.e.y.v.a.l.u.e.M.a.x.L.e.n.

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrap.dll

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	494088
Entropy (8bit):	6.701938599658677
Encrypted:	false
SSDEEP:	12288:YaK0OuDBlYPIj/q9DQsEfExtrlp87pMaIPuboWMlyF0Ps:W9DeuBc/IPu8WMAF0Ps
MD5:	58968E221F2522D98DBFE7574D0C44AA
SHA1:	424B55216F2C832202C01363E013546380F5312A
SHA-256:	265170E701EC453B13249E7A4E4F401B87FAE79442CCE77060213EBCD03828C0
SHA-512:	9BBA6FFBEC9B6D3DE7B530B056098465A54B66494DB7E7CA82E8C98802FB5A1CB500F5D505387F2A33FB9A42A533D5838B1125EF14AFAD11285410652C6F07B5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[@...!.K.!.K.!.K.nfK.!.K.YtK_!.K.YeK.!.K8.K.!.K.!.K.!.K.YsK. .K.YzK.!.K.YbK.!.K.YaK.!.KRich.!.K........PE..L......]...........!.........>......)........0......................................p.....@.................................H........`...............`...*...p..07.. 3..................................@............0...............................text............................... ..`.rdata.......0......."..............@..@.data....E..........................@....rsrc........`......................@..@.reloc...D...p...F..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	110088
Entropy (8bit):	6.438187182004648
Encrypted:	false
SSDEEP:	1536:A554a+kMgHZ73LkUluTbDJgX+oLENoN2CraI9WkF1X8OEdlg5BaAUH7jfrxZM:TswTbD6LLraInhEdlg5BJUHXf8
MD5:	F3B9A2D94682FEE26FC079BA1E0FB040
SHA1:	FF9E89FBCB6939095ECFA34438D9E6EBF9AD6FB4
SHA-256:	CDC9EE419589B8E378B030A5180B12CF4E1FC2FA132DBAF0E961ADBE3C782E55
SHA-512:	40BAA3D59EB931EEAB583ECBD4526031BC8D455192D69C3F87B9220EBAAB194A2922E4A3E9E36DB3A587F56961C0686B81BCEC8382AC02F968F31B566581BBBD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i....,...,...,...,...,...,...,...,...,...,...,.2\|,...,...,...,...,...,...,...,Rich...,................PE..L......].....................l.......z.......0....@.......................................@.................................0e..x........................*...........1..............................`V..@............0..l............................text............................... ..`.rdata...=...0...>..................@..@.data...`-...p.......V..............@....rsrc................h..............@..@.reloc...............j..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\DataFile.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	88
Entropy (8bit):	3.173026079624601
Encrypted:	false
SSDEEP:	3:QMk7lOLGZlx+lLmlqqxxQXxlEr7lgl4e9:QlsWlYJmwq3QXjElgl4Q
MD5:	2BA1128174977822E604DB728E8BE71C
SHA1:	414E06CFD3A747A4B6CB315FB8318FD57C989D82
SHA-256:	8AC9C8EACF08C21B37F83663DD54F6625A500A0F40826DBE9F2137923E4DD87B
SHA-512:	C873C844317606F6EB11B33A459CFD0A1A610A2DBD0EC8E0E76BD9E9B262953657C42FAC797B3E6E737F90604A31213577FAC1DBA8359AD42F8F0A8C00FF9C30
Malicious:	false
Preview:	......[.H.E.A.D._.D.A.T.A.].....T.O.T.A.L.C.O.U.N.T.=.1.....S.T.A.R.T.I.N.D.E.X.=.0.....

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	67592
Entropy (8bit):	6.539401493696455
Encrypted:	false
SSDEEP:	768:CVyp8XwXEXrjOgRXvLH4IE3jDnIoiiBbIADgykhUMId50BLbCYiHDLlGAMxkEy/:CECwXShvLYIE3nnInie2khc50k7jex2/
MD5:	99891AAA0E15B2A514A4FF5C9EC03F4D
SHA1:	FAF215763908A9A6B8413C7E40293FE4BE9BFE7B
SHA-256:	505AB42F0F376A4D8576BBEC9CFDCE43DEABE168356DEE760000319A73E72611
SHA-512:	36F6D66987506A938FAA7503E0FA3A6CF76AA9CA6A30EA7CB7E80D058CF203EAE152EF97B2329BA83BB18FC70430A2E00E9AA1F408E94B132813B4BF741697DE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......@.....S..S..S..:S!.S..+S..S..=ST.S#..S..S..SJ.S..4S..S../S..SRich..S........PE..L......].....................N......M'............@.......................... .......7....@.................................t...<..................................@...................................@............................................text............................... ..`.rdata..@(.........................@..@.data...............................@....rsrc...............................@..@.reloc.."...........................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\tempInfo.web

Download File

Process:	C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\downloader.ico

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	MS Windows icon resource - 10 icons, 16x16, 16 colors, 4 bits/pixel, 32x32, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	66622
Entropy (8bit):	7.200049591188769
Encrypted:	false
SSDEEP:	1536:PEJFQHJXdXtM6LJWEXIVUpjSICCIV1A7vku:PEJFQHFltM6sEXIVUpjfIA7vN
MD5:	E7BA7ED202773284C3DD85E4162C38D3
SHA1:	7467DA2D1455C5AF1419DA18FEAE2CB5C3558A3D
SHA-256:	AA4DF8B6F5BC456121EAFD03857098E56A4357A2BAE7CDD651CAFD2CFD78AC7D
SHA-512:	87DCA3BCEF8B309A501FFE3EEFB5B20194DCF3B9729F024577F3D57DC025643E556C5C01797606483590E5DBD28502425C5F603A0077CC2E4561DDDD0322EFC1
Malicious:	false
Preview:	..............(....... ..............00......h...............h....... ..............00.................... .h....'.. .... .....>,..00.... ..%...<........ ......b..(....... ..........................................................................................................FF.....F.lf@...l\|f.........`...............f..~~...@...~....g..w..`.....@......@....n`.......@....FFF...............?..........................................................(... ...@......................................................................................................................d..............g.t`............llf.d..........g..lf.F@.......~..v.lln.@.....N..l.v.f\|f@..........ll.l.`...........lf.\|`..........\|...f@.......g.n.l\|\|.`......\|.\|l~.n.@........n.n...p...........~...V............`.g...........@.......w\|..f`..h.........t....F....y..x...V............`............~..............@.....~........`.........................~.~............................p.....

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\english.ini

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	4030
Entropy (8bit):	4.974804558492645
Encrypted:	false
SSDEEP:	96:SZ6f0DyqeVb0WLgWSwjzRipWaP3TtIW5aJx6dxkBEs2W2:SZ6f0DylqW09wvUp/vBogUuW2
MD5:	514C7CFA0101EAE70994AFD3FA7801C3
SHA1:	BD6249FE023542C5BE1180B76343E4E220BE7148
SHA-256:	A6237A06959F1BF65FC2B3E77AE509D3BCA1713340227B7FBB66E28DA4F84404
SHA-512:	D889FFD4495EC023394D1170B97BF40FAD9FF202B36500FE85D6620CC08E3C42580CAF6992C09817646A93D253CFECE8E94B66B14E6EEE5CEFCE3F91B5FA4919
Malicious:	false
Preview:	[string]..InstallerName=%1 Installer..ProductName=EaseUS Data Recovery Wizard..RecommendProductName=Mobimover..InstallNow=Install Now..InstallRecommend=Install %1..LicenseTps=I have read and accepted %1..LicenseClick=EaseUS License Agreement..CustomInstall=Installation settings..Languge=Language..InstallationPath =Installation Path..AgreeExperience=Agree to participate in Customer Experience Improvement Program..Downloading=Downloading, please wait...WaitTime= (It is expected to wait for %1m %2s.)..Installing =Installing, please wait...DownloadFailed=Download Failed..CheckNet=Please check the network connection...DownloadOffline=Download Offline..Retry=Retry..StartNow=Start Now..Later=Later..StartNowTips=Want To Start Program Now?..InstallFailed=Installation Failed..InstallFailedTips=Download offline to get full installation package or restart PC to try again...Restart=Restart PC..btn_Restartnow=Restart now..lb_RestartText=Sure to Restart PC Now?..lb_RestartTip=In most cases, progr

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\skin.zip

Download File

Process:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1499226
Entropy (8bit):	7.9845663401363405
Encrypted:	false
SSDEEP:	24576:ieUyKyJthS35e64nQFQBKkou5O7lvEqY97Xk+8rgbSQj/4DTFHtkr68ft8Zpy:5U5ypEd4QAKkA5R+AgmU/4HFNkr18O
MD5:	784C6F9B53521F4CB115532F49B67A36
SHA1:	7DCD0E24B7940156FC5BE4EDB185A57A030B45EF
SHA-256:	A0951464134E2AF94ECD389EA9C0F3D784BAE909F60EB2F45D7764B4DBDE7A73
SHA-512:	88851E60A1EC3974558B45E422B2A6B412A2A87603E9A1A61BA5491D2C8475C269F29164DD25AC7A3C72D0AD190437E0DC93C02C6A9F2C85BA599C89ED315F21
Malicious:	false
Preview:	PK.........Y.W..1Pd...........bg.png..+.q..?....lY!...Nd..V+.g=...rP..F6R.Ma.\.EqQ..\...J..v..\...F).G.......O.....\|?..j..e2...`R......W..&.......\NHd..i#...1...).@V&@.Fh.i..q.<KX..J.m..%f...K...@.]....y...8.V..,F.'.s.\|.So..k...r........U.Q..X...T..D.c.wj#d....gDTS.=z...G..=z......>.q9.;a..2..n.A...CR.~.\......8b..........E.BG...9..# ..K.g.7.H.SG@......OPK.........Y.W..W7............configpage.xml.X...@.^.S.u.... &?...D..1!.....i.......nbt.eaL...x{.Q\....B.......7....x.ym..2.il;..T.$K.S.i..:....mi[..v.P..q.U,....K.....7......o...........6'.b.W.2...)....H.../.1;C4nt...A............`c...S..6..,0.d'..ff..nH.....G&.FKB`"l.2.......,.M.v..._.c.!?..q.f6.........{.Ug..3..8.&u9.&.J....-.6(H@..Y..d.;J....J-q......x*.......t........Y.hn..u0.e0.8....>.@.&..EQ........j1n.p9g....s....k.l..6s..>r.&....Eh..j..S.Gz..e...)...I.}/..b.K!..[..6./.d0.4..EC.1.V.khc...4.(}.._`.{.D..Rv,.G.g.......r....UfY.j......c).,Mq..(..>...n._..s.Y..U.S.`

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.99146778985103
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	drw_free_installer.17163939163819b153.exe
File size:	2'654'624 bytes
MD5:	6e3bc255dc7b79e452c66610c741eb95
SHA1:	972d9adbec19dd1277b4329fa13641847ca18c87
SHA256:	bdb74a31956e7c2ce7a3c6344ac7265d84b735c1038a390168f01d6d9fa43b3a
SHA512:	8f79aff54a92394ee1098c92b7bb0880369cdacf0aa482475edb47857838687eb06ec2f33075eb2343c54284d8cf8ccf6e50cbe4a96ed36f63321796eb1f8562
SSDEEP:	49152:e/jU67vjsddEhjFGNS9LXQOjOQKK6bxM1vehddPa46JFUxkVxq6ZBcMucAtL:2U67vYUhjjV5OdbOUhDPWTUq9cMPOL
TLSH:	F2C533092380D11BEC8484318FDD34B52A966D234CE65E53A305FFAC73956DABC52BAF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pf..Pf..Pf._9..Pf..Pg.LPf._;..Pf..sV..Pf..V`..Pf.Rich.Pf.........................PE..L...<.oZ.................h.........

File Icon


Icon Hash:	33336d693b2b1f0e

Static PE Info

General

Entrypoint:	0x40338f
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x5A6FED3C [Tue Jan 30 03:57:48 2018 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b34f154ec913d2d2c435cbd644e91687

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	21/09/2022 01:00:00 02/12/2024 23:59:59
Subject Chain	CN="CHENGDU YIWO Tech Development Co., Ltd.", O="CHENGDU YIWO Tech Development Co., Ltd.", L=\u6210\u90fd\u5e02, S=\u56db\u5ddd\u7701, C=CN, SERIALNUMBER=91510107765360104N, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.1=\u6b66\u4faf\u533a, OID.1.3.6.1.4.1.311.60.2.1.2=\u56db\u5ddd\u7701, OID.1.3.6.1.4.1.311.60.2.1.3=CN
Version:	3
Thumbprint MD5:	65C6F555EF8DAC075EB0C1097C43862C
Thumbprint SHA-1:	E044E920D56ECE15D7A21DD058651A3F2166CFD6
Thumbprint SHA-256:	65178EE438BD0ECB878802F6229C71E6497627671344247DA9FCF37C1DAF74BC
Serial:	03BD221937F2D796FA7029547B190301

Entrypoint Preview

Instruction
sub esp, 000002D4h
push ebx
push esi
push edi
push 00000020h
pop edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+14h], ebx
mov dword ptr [esp+10h], 0040A2E0h
mov dword ptr [esp+1Ch], ebx
call dword ptr [004080A8h]
call dword ptr [004080A4h]
and eax, BFFFFFFFh
cmp ax, 00000006h
mov dword ptr [00434EECh], eax
je 00007FBEBC9171D3h
push ebx
call 00007FBEBC91A485h
cmp eax, ebx
je 00007FBEBC9171C9h
push 00000C00h
call eax
mov esi, 004082B0h
push esi
call 00007FBEBC91A3FFh
push esi
call dword ptr [00408150h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], 00000000h
jne 00007FBEBC9171ACh
push 0000000Ah
call 00007FBEBC91A458h
push 00000008h
call 00007FBEBC91A451h
push 00000006h
mov dword ptr [00434EE4h], eax
call 00007FBEBC91A445h
cmp eax, ebx
je 00007FBEBC9171D1h
push 0000001Eh
call eax
test eax, eax
je 00007FBEBC9171C9h
or byte ptr [00434EEFh], 00000040h
push ebp
call dword ptr [00408044h]
push ebx
call dword ptr [004082A0h]
mov dword ptr [00434FB8h], eax
push ebx
lea eax, dword ptr [esp+34h]
push 000002B4h
push eax
push ebx
push 0042B208h
call dword ptr [00408188h]
push 0040A2C8h

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8608	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x45000	0x10d40	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x285798	0x2a08
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x8000	0x2b0	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6627	0x6800	8c030dfed318c62753a7b0d60218279b	False	0.6642503004807693	data	6.452235553722483	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x8000	0x149a	0x1600	966a3835fd2d9407261ae78460c26dcc	False	0.43803267045454547	data	5.007075185851696	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa000	0x2aff8	0x600	939516377e7577b622eb1ffdc4b5db4a	False	0.517578125	data	4.03532418489749	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x35000	0x10000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x45000	0x10d40	0x10e00	7bbd1f2fb3b11360c391d2f92105e8b7	False	0.7578559027777778	data	7.140371794785311	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x45340	0xa1b0	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.9976323927328953
RT_ICON	0x4f4f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.3817427385892116
RT_ICON	0x51a98	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.4978893058161351
RT_ICON	0x52b40	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.3744669509594883
RT_ICON	0x539e8	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.45126353790613716
RT_ICON	0x54290	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1536	English	United States	0.43353658536585366
RT_ICON	0x548f8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.5086705202312138
RT_ICON	0x54e60	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.6640070921985816
RT_ICON	0x552c8	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.5389784946236559
RT_ICON	0x555b0	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.6351351351351351
RT_DIALOG	0x556d8	0x100	data	English	United States	0.5234375
RT_DIALOG	0x557d8	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x558f8	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x55958	0x92	data	English	United States	0.6232876712328768
RT_MANIFEST	0x559f0	0x349	XML 1.0 document, ASCII text, with very long lines (841), with no line terminators	English	United States	0.5517241379310345

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableW, SetFileAttributesW, Sleep, GetTickCount, GetFileSize, GetModuleFileNameW, GetCurrentProcess, CopyFileW, SetCurrentDirectoryW, GetFileAttributesW, GetWindowsDirectoryW, GetTempPathW, GetCommandLineW, GetVersion, SetErrorMode, lstrlenW, lstrcpynW, GetDiskFreeSpaceW, ExitProcess, GetShortPathNameW, CreateThread, GetLastError, CreateDirectoryW, CreateProcessW, RemoveDirectoryW, lstrcmpiA, CreateFileW, GetTempFileNameW, WriteFile, lstrcpyA, MoveFileExW, lstrcatW, GetSystemDirectoryW, GetProcAddress, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, lstrcmpiW, MoveFileW, GetFullPathNameW, SetFileTime, SearchPathW, CompareFileTime, lstrcmpW, CloseHandle, ExpandEnvironmentStringsW, GlobalFree, GlobalLock, GlobalUnlock, GlobalAlloc, FindFirstFileW, FindNextFileW, DeleteFileW, SetFilePointer, ReadFile, FindClose, lstrlenA, MulDiv, MultiByteToWideChar, WideCharToMultiByte, GetPrivateProfileStringW, WritePrivateProfileStringW, FreeLibrary, LoadLibraryExW, GetModuleHandleW
USER32.dll	GetSystemMenu, SetClassLongW, EnableMenuItem, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongW, SetCursor, LoadCursorW, CheckDlgButton, GetMessagePos, LoadBitmapW, CallWindowProcW, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, OpenClipboard, ScreenToClient, GetWindowRect, GetDlgItem, GetSystemMetrics, SetDlgItemTextW, GetDlgItemTextW, MessageBoxIndirectW, CharPrevW, CharNextA, wsprintfA, DispatchMessageW, PeekMessageW, ReleaseDC, EnableWindow, InvalidateRect, SendMessageW, DefWindowProcW, BeginPaint, GetClientRect, FillRect, DrawTextW, EndDialog, RegisterClassW, SystemParametersInfoW, CreateWindowExW, GetClassInfoW, DialogBoxParamW, CharNextW, ExitWindowsEx, DestroyWindow, GetDC, SetTimer, SetWindowTextW, LoadImageW, SetForegroundWindow, ShowWindow, IsWindow, SetWindowLongW, FindWindowExW, TrackPopupMenu, AppendMenuW, CreatePopupMenu, EndPaint, CreateDialogParamW, SendMessageTimeoutW, wsprintfW, PostQuitMessage
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectW, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, ShellExecuteExW, SHGetPathFromIDListW, SHBrowseForFolderW, SHGetFileInfoW, SHFileOperationW
ADVAPI32.dll	AdjustTokenPrivileges, RegCreateKeyExW, RegOpenKeyExW, SetFileSecurityW, OpenProcessToken, LookupPrivilegeValueW, RegEnumValueW, RegDeleteKeyW, RegDeleteValueW, RegCloseKey, RegSetValueExW, RegQueryValueExW, RegEnumKeyW
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 22, 2024 18:06:57.971183062 CEST	49731	80	192.168.2.4	163.171.128.150
May 22, 2024 18:06:57.976280928 CEST	80	49731	163.171.128.150	192.168.2.4
May 22, 2024 18:06:57.976356983 CEST	49731	80	192.168.2.4	163.171.128.150
May 22, 2024 18:06:57.981725931 CEST	49731	80	192.168.2.4	163.171.128.150
May 22, 2024 18:06:58.032262087 CEST	80	49731	163.171.128.150	192.168.2.4
May 22, 2024 18:07:00.235943079 CEST	80	49731	163.171.128.150	192.168.2.4
May 22, 2024 18:07:00.236167908 CEST	49731	80	192.168.2.4	163.171.128.150
May 22, 2024 18:07:00.315388918 CEST	49732	80	192.168.2.4	47.252.97.212
May 22, 2024 18:07:00.320439100 CEST	80	49732	47.252.97.212	192.168.2.4
May 22, 2024 18:07:00.320518970 CEST	49732	80	192.168.2.4	47.252.97.212
May 22, 2024 18:07:00.321517944 CEST	49732	80	192.168.2.4	47.252.97.212
May 22, 2024 18:07:00.379908085 CEST	80	49732	47.252.97.212	192.168.2.4
May 22, 2024 18:07:00.814599037 CEST	80	49732	47.252.97.212	192.168.2.4
May 22, 2024 18:07:00.814964056 CEST	49732	80	192.168.2.4	47.252.97.212
May 22, 2024 18:07:00.820382118 CEST	80	49732	47.252.97.212	192.168.2.4
May 22, 2024 18:07:00.820452929 CEST	49732	80	192.168.2.4	47.252.97.212
May 22, 2024 18:08:00.235618114 CEST	80	49731	163.171.128.150	192.168.2.4
May 22, 2024 18:08:00.235713005 CEST	49731	80	192.168.2.4	163.171.128.150
May 22, 2024 18:08:47.686907053 CEST	49731	80	192.168.2.4	163.171.128.150
May 22, 2024 18:08:47.773823977 CEST	80	49731	163.171.128.150	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 22, 2024 18:06:57.853413105 CEST	49152	53	192.168.2.4	1.1.1.1
May 22, 2024 18:06:57.891168118 CEST	53	49152	1.1.1.1	192.168.2.4
May 22, 2024 18:07:00.295173883 CEST	51266	53	192.168.2.4	1.1.1.1
May 22, 2024 18:07:00.304367065 CEST	53	51266	1.1.1.1	192.168.2.4
May 22, 2024 18:07:26.479660988 CEST	53	63150	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 22, 2024 18:06:57.853413105 CEST	192.168.2.4	1.1.1.1	0x106b	Standard query (0)	track.easeus.com	A (IP address)	IN (0x0001)	false
May 22, 2024 18:07:00.295173883 CEST	192.168.2.4	1.1.1.1	0x28f2	Standard query (0)	easeusinfo.us-east-1.log.aliyuncs.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 22, 2024 18:06:57.891168118 CEST	1.1.1.1	192.168.2.4	0x106b	No error (0)	track.easeus.com	track.easeus.com.whecloud.com		CNAME (Canonical name)	IN (0x0001)	false
May 22, 2024 18:06:57.891168118 CEST	1.1.1.1	192.168.2.4	0x106b	No error (0)	track.easeus.com.whecloud.com		163.171.128.150	A (IP address)	IN (0x0001)	false
May 22, 2024 18:06:57.891168118 CEST	1.1.1.1	192.168.2.4	0x106b	No error (0)	track.easeus.com.whecloud.com		163.171.128.241	A (IP address)	IN (0x0001)	false
May 22, 2024 18:07:00.304367065 CEST	1.1.1.1	192.168.2.4	0x28f2	No error (0)	easeusinfo.us-east-1.log.aliyuncs.com		47.252.97.212	A (IP address)	IN (0x0001)	false
May 22, 2024 18:07:00.304367065 CEST	1.1.1.1	192.168.2.4	0x28f2	No error (0)	easeusinfo.us-east-1.log.aliyuncs.com		47.252.97.15	A (IP address)	IN (0x0001)	false
May 22, 2024 18:07:00.304367065 CEST	1.1.1.1	192.168.2.4	0x28f2	No error (0)	easeusinfo.us-east-1.log.aliyuncs.com		47.252.97.9	A (IP address)	IN (0x0001)	false
May 22, 2024 18:07:00.304367065 CEST	1.1.1.1	192.168.2.4	0x28f2	No error (0)	easeusinfo.us-east-1.log.aliyuncs.com		47.252.97.13	A (IP address)	IN (0x0001)	false
May 22, 2024 18:07:00.304367065 CEST	1.1.1.1	192.168.2.4	0x28f2	No error (0)	easeusinfo.us-east-1.log.aliyuncs.com		47.252.97.12	A (IP address)	IN (0x0001)	false
May 22, 2024 18:07:00.304367065 CEST	1.1.1.1	192.168.2.4	0x28f2	No error (0)	easeusinfo.us-east-1.log.aliyuncs.com		47.252.97.8	A (IP address)	IN (0x0001)	false
May 22, 2024 18:07:00.304367065 CEST	1.1.1.1	192.168.2.4	0x28f2	No error (0)	easeusinfo.us-east-1.log.aliyuncs.com		47.252.97.10	A (IP address)	IN (0x0001)	false
May 22, 2024 18:07:00.304367065 CEST	1.1.1.1	192.168.2.4	0x28f2	No error (0)	easeusinfo.us-east-1.log.aliyuncs.com		47.252.97.14	A (IP address)	IN (0x0001)	false
May 22, 2024 18:07:00.304367065 CEST	1.1.1.1	192.168.2.4	0x28f2	No error (0)	easeusinfo.us-east-1.log.aliyuncs.com		47.252.97.11	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

track.easeus.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49731	163.171.128.150	80	7504	C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe

Timestamp	Bytes transferred	Direction	Data
May 22, 2024 18:06:57.981725931 CEST	317	OUT	GET /product/index.php?c=main&a=getstatus&pid=2 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: track.easeus.com Connection: Keep-Alive
May 22, 2024 18:07:00.235943079 CEST	330	IN	HTTP/1.1 200 OK Date: Wed, 22 May 2024 16:07:00 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 21 Connection: keep-alive Server: Apache Content-Encoding: gzip X-Via: 1.1 luoshan65:1 (Cdn Cache Server V2.0), 1.1 fra13:1 (Cdn Cache Server V2.0) X-Ws-Request-Id: 664e1822_kf98_16929-13800 Data Raw: 1f 8b 08 00 00 00 00 00 00 03 33 00 00 21 df db f4 01 00 00 00 Data Ascii: 3!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49732	47.252.97.212	80	7504	C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe

Timestamp	Bytes transferred	Direction	Data
May 22, 2024 18:07:00.321517944 CEST	697	OUT	POST /logstores/logstore_drw_ip/shards/lb HTTP/1.1 Host:easeusinfo.us-east-1.log.aliyuncs.com User-Agent: log-c-lite_0.1.0 Accept: / Content-Type:application/x-protobuf x-log-apiversion:0.6.0 x-log-compresstype:lz4 x-log-signaturemethod:hmac-sha1 Date:Wed, 22 May 2024 16:06:59 GMT Content-MD5:A1955387E255B9FDEE28F34DF281DDF5 Content-Length:248 x-log-bodyrawsize:255 Authorization:LOG LTAIBDHwLKKvsH19:wEJEW14HDW8fOSJPTmTMg59xCU0= Data Raw: f7 44 0a b7 01 08 a3 b0 b8 b2 06 12 17 0a 09 54 69 6d 65 73 74 61 6d 70 12 0a 31 37 31 36 33 39 34 30 31 35 12 17 0a 06 57 69 6e 64 6f 77 12 0d 57 65 62 5f 49 6e 73 74 61 6c 6c 65 72 12 20 0a 08 41 63 74 69 76 69 74 79 12 14 52 65 73 75 6c 74 5f 52 75 6e 22 00 f2 22 5b 0a 09 41 74 74 72 69 62 75 74 65 12 4e 7b 22 43 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 50 61 67 65 69 64 22 3a 22 77 00 f0 00 33 39 31 36 33 38 31 39 62 31 35 33 22 2c 22 97 00 f0 48 7a 6f 6e 65 22 3a 22 47 4d 54 2d 30 35 3a 30 30 22 7d 1a 2e 53 2d 31 2d 35 2d 32 31 2d 32 32 34 36 31 32 32 36 35 38 2d 33 36 39 33 34 30 35 31 31 37 2d 32 34 37 36 37 35 36 36 33 34 2d 31 30 30 32 32 13 0a 0c 50 72 6f 64 75 63 74 00 62 61 64 20 12 03 64 72 77 Data Ascii: DTimestamp1716394015WindowWeb_Installer ActivityResult_Run""[AttributeN{"Country":"Switzerland","Pageid":"w39163819b153","Hzone":"GMT-05:00"}.S-1-5-21-2246122658-3693405117-2476756634-10022Productbad drw
May 22, 2024 18:07:00.814599037 CEST	242	IN	HTTP/1.1 200 OK Server: AliyunSLS Content-Length: 0 Connection: keep-alive Access-Control-Allow-Origin: * Date: Wed, 22 May 2024 16:07:00 GMT x-log-append-meta: true x-log-time: 1716394020 x-log-requestid: 664E1824168D3193949D30DC

Target ID:	0
Start time:	12:06:52
Start date:	22/05/2024
Path:	C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\drw_free_installer.17163939163819b153.exe"
Imagebase:	0x400000
File size:	2'654'624 bytes
MD5 hash:	6E3BC255DC7B79E452C66610C741EB95
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:06:52
Start date:	22/05/2024
Path:	C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop \|\|\| EXENAME=drw_free_installer.17163939163819b153.exe \|\|\| DOWNLOAD_VERSION=free \|\|\| PRODUCT_VERSION=2.0.0 \|\|\| INSTALL_TYPE=0
Imagebase:	0xf10000
File size:	1'263'112 bytes
MD5 hash:	8A250A75859FE52116E706A640E6D77C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	12:06:53
Start date:	22/05/2024
Path:	C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe
Wow64 process (32bit):	true
Commandline:	/Uid "S-1-5-21-2246122658-3693405117-2476756634-1002"
Imagebase:	0x340000
File size:	67'592 bytes
MD5 hash:	99891AAA0E15B2A514A4FF5C9EC03F4D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	12:06:55
Start date:	22/05/2024
Path:	C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe
Wow64 process (32bit):	true
Commandline:	/SendInfo Window "Web_Installer" Activity "Result_Run_Installer" Attribute "{\"Country\":\"Switzerland\",\"Pageid\":\"17163939163819b153\",\"Timezone\":\"GMT-05:00\"}"
Imagebase:	0x340000
File size:	67'592 bytes
MD5 hash:	99891AAA0E15B2A514A4FF5C9EC03F4D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	12:06:55
Start date:	22/05/2024
Path:	C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\AliyunWrapExe.Exe
Imagebase:	0xa30000
File size:	110'088 bytes
MD5 hash:	F3B9A2D94682FEE26FC079BA1E0FB040
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	12.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	20.7%
Total number of Nodes:	1315
Total number of Limit Nodes:	18

Executed Functions

Function 0040338F Relevance: 84.4, APIs: 33, Strings: 15, Instructions: 410
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004033B2
GetVersion.KERNEL32 ref: 004033B8
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 004033EB
#17.COMCTL32(?,00000006,00000008,0000000A), ref: 00403428
OleInitialize.OLE32(00000000), ref: 0040342F
SHGetFileInfoW.SHELL32(0042B208,00000000,?,000002B4,00000000), ref: 0040344B
GetCommandLineW.KERNEL32(downloader_easeus 2.0.0 Setup,NSIS Error,?,00000006,00000008,0000000A), ref: 00403460
CharNextW.USER32(00000000,0043F000,00000020,0043F000,00000000,?,00000006,00000008,0000000A), ref: 00403498

Part of subcall function 00406694: GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
Part of subcall function 00406694: GetProcAddress.KERNEL32(00000000,?), ref: 004066C1

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 004035D2
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB,?,00000006,00000008,0000000A), ref: 004035E3
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004035EF
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp,?,00000006,00000008,0000000A), ref: 00403603
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 0040360B
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low,?,00000006,00000008,0000000A), ref: 0040361C
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 00403624
DeleteFileW.KERNELBASE(1033,?,00000006,00000008,0000000A), ref: 00403638

Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00000400,00403460,downloader_easeus 2.0.0 Setup,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7

ExitProcess.KERNEL32(00000006,?,00000006,00000008,0000000A), ref: 004036FE
OleUninitialize.OLE32(00000006,?,00000006,00000008,0000000A), ref: 00403703
ExitProcess.KERNEL32 ref: 00403724
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu), ref: 00403737
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A26C), ref: 00403746
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp), ref: 00403751
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\Desktop,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,0043F000,00000000,00000006,?,00000006,00000008,0000000A), ref: 0040375D
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,?,00000006,00000008,0000000A), ref: 00403779
DeleteFileW.KERNEL32(0042AA08,0042AA08,?,00435000,00000008,?,00000006,00000008,0000000A), ref: 004037D3
CopyFileW.KERNEL32(00442800,0042AA08,00000001,?,00000006,00000008,0000000A), ref: 004037E7
CloseHandle.KERNEL32(00000000,0042AA08,0042AA08,?,0042AA08,00000000,?,00000006,00000008,0000000A), ref: 00403814
GetCurrentProcess.KERNEL32(00000028,0000000A,00000006,00000008,0000000A), ref: 00403843
OpenProcessToken.ADVAPI32(00000000), ref: 0040384A
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 0040385F
AdjustTokenPrivileges.ADVAPI32 ref: 00403882
ExitWindowsEx.USER32(00000002,80040002), ref: 004038A7
ExitProcess.KERNEL32 ref: 004038CA

Strings

~nsu, xrefs: 0040372F
TMP, xrefs: 0040361F
C:\Users\user\Desktop, xrefs: 00403756, 0040375B, 00403788
UXTHEME, xrefs: 004033DF, 004033E4, 004033EA
C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free, xrefs: 004036E0
TEMP, xrefs: 00403617
Low, xrefs: 00403605
downloader_easeus 2.0.0 Setup, xrefs: 00403456
.tmp, xrefs: 0040374B
SeShutdownPrivilege, xrefs: 00403859
1033, xrefs: 00403633
\Temp, xrefs: 004035E9
Error launching installer, xrefs: 004036BA
C:\Users\user\AppData\Local\Temp\, xrefs: 004035C7, 004035CC, 004035E2, 004035EE, 004035FD, 0040360A, 00403616, 0040361E, 00403734, 00403745, 00403750, 0040375C, 00403769, 00403778, 00403829
NSIS Error, xrefs: 00403451

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: Processlstrcat$ExitFile$CurrentDeleteDirectoryEnvironmentHandlePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeModuleNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: .tmp$1033$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free$C:\Users\user\Desktop$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$downloader_easeus 2.0.0 Setup$~nsu
API String ID: 424501083-3762088908
Opcode ID: e25c0d018259e07605f9805bbd7d976b452919055f5c700ceff59a909ae8efef
Instruction ID: 34b402965a056e7880f406cddf034ee68ffb155d70387f36a3cc73b0da0a8952
Opcode Fuzzy Hash: e25c0d018259e07605f9805bbd7d976b452919055f5c700ceff59a909ae8efef
Instruction Fuzzy Hash: FBD11571500310ABE720BF659D45B2B3AACEB4074AF10447FF881B62E1DBBD9E45876E

Function 004065FD Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE(?,00430298,0042FA50,00405CE0,0042FA50,0042FA50,00000000,0042FA50,0042FA50,?,?,74DF3420,004059EC,?,C:\Users\user\AppData\Local\Temp\,74DF3420), ref: 00406608
FindClose.KERNEL32(00000000), ref: 00406614

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 09a722932e0a1bea88283b0440f714d8f88131f4b1bd488506181814d844a3ce
Instruction ID: 1ab566c2093321911261fd6ef708f8cedd572ce36bb67071c96f4f7979b88ecc
Opcode Fuzzy Hash: 09a722932e0a1bea88283b0440f714d8f88131f4b1bd488506181814d844a3ce
Instruction Fuzzy Hash: 3AD012315051205BC3401B386E0C85B7A599F55331B159F37F86AF51E0DB758C72869C

Function 004039AA Relevance: 44.0, APIs: 14, Strings: 11, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406694: GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
Part of subcall function 00406694: GetProcAddress.KERNEL32(00000000,?), ref: 004066C1

GetUserDefaultUILanguage.KERNELBASE(00000002,C:\Users\user\AppData\Local\Temp\,74DF3420,0043F000,00000000), ref: 004039C4

Part of subcall function 00406201: wsprintfW.USER32 ref: 0040620E

lstrcatW.KERNEL32(1033,0042D248), ref: 00403A2B
lstrlenW.KERNEL32("C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr,?,?,?,"C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr,00000000,0043F800,1033,0042D248,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D248,00000000,00000002,C:\Users\user\AppData\Local\Temp\), ref: 00403AAB
lstrcmpiW.KERNEL32(?,.exe,"C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr,?,?,?,"C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr,00000000,0043F800,1033,0042D248,80000001,Control Panel\Desktop\ResourceLocale,00000000,0042D248,00000000), ref: 00403ABE
GetFileAttributesW.KERNEL32("C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr), ref: 00403AC9
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,0043F800), ref: 00403B12
RegisterClassW.USER32(00433E80), ref: 00403B4F
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B67
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403B9C
ShowWindow.USER32(00000005,00000000), ref: 00403BD2
GetClassInfoW.USER32(00000000,RichEdit20W,00433E80), ref: 00403BFE
GetClassInfoW.USER32(00000000,RichEdit,00433E80), ref: 00403C0B
RegisterClassW.USER32(00433E80), ref: 00403C14
DialogBoxParamW.USER32(?,00000000,00403D58,00000000), ref: 00403C33

Strings

RichEdit20W, xrefs: 00403BF6, 00403BFC
Control Panel\Desktop\ResourceLocale, xrefs: 004039DE
1033, xrefs: 004039CA, 00403A26
_Nb, xrefs: 00403B2E, 00403B96
RichEd32, xrefs: 00403BE6
C:\Users\user\AppData\Local\Temp\, xrefs: 004039B6
RichEdit, xrefs: 00403C05
.exe, xrefs: 00403AB8
"C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr, xrefs: 00403A72, 00403A7B, 00403A89, 00403AD8, 00403ADE
.DEFAULT\Control Panel\International, xrefs: 00403A16
RichEd20, xrefs: 00403BD8

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDefaultDialogFileHandleImageLanguageLoadModuleParamParametersProcShowSystemUserlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr$.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 606308-828663631
Opcode ID: 2bcee5a68d5e04946ac8458ff7df2bb227cdd7c20c4429e934e38d678995b33b
Instruction ID: 064cc6771aa4ec85c149aa806f0e8f7fc9ed350ba8b4bb786133750ec3f232c3
Opcode Fuzzy Hash: 2bcee5a68d5e04946ac8458ff7df2bb227cdd7c20c4429e934e38d678995b33b
Instruction Fuzzy Hash: 9061A7312007007ED720AF669D46E2B3A6CEB85B4AF40157FF945B51E2CBBDA941CB2D

Function 00402EDD Relevance: 21.2, APIs: 5, Strings: 7, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402EEE
GetModuleFileNameW.KERNEL32(00000000,00442800,00000400,?,00000006,00000008,0000000A), ref: 00402F0A

Part of subcall function 00405DB0: GetFileAttributesW.KERNELBASE(00442800,00402F1D,00442800,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
Part of subcall function 00405DB0: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6

GetFileSize.KERNEL32(00000000,00000000,00443000,00000000,C:\Users\user\Desktop,C:\Users\user\Desktop,00442800,00442800,80000000,00000003,?,00000006,00000008,0000000A), ref: 00402F56

Strings

C:\Users\user\Desktop, xrefs: 00402F38, 00402F3D, 00402F43
Inst, xrefs: 00402FC2
Error launching installer, xrefs: 00402F2D
C:\Users\user\AppData\Local\Temp\, xrefs: 00402EE7
Null, xrefs: 00402FD4
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 004030B5
soft, xrefs: 00402FCB

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\Desktop$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 4283519449-2162933095
Opcode ID: 9da78bb69fdb731252d5033ab884fa182416324aee7ddcf9fc3f40609bcd7e9e
Instruction ID: dd9ea635540f9dffb1b2b479f8e1e5c18960c1b6140bd96a969558b27d112ec4
Opcode Fuzzy Hash: 9da78bb69fdb731252d5033ab884fa182416324aee7ddcf9fc3f40609bcd7e9e
Instruction Fuzzy Hash: C151F471901205ABDB20AF60DD85B9F7FA8FB0431AF15403BF910B62D5C7789E408BAD

Function 0040176F Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000), ref: 004017B0
CompareFileTime.KERNEL32(-00000014,?,"C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr,"C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr,00000000,00000000,"C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr,C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free,?,?,00000031), ref: 004017D5

Part of subcall function 004062BA: lstrcpynW.KERNEL32(?,?,00000400,00403460,downloader_easeus 2.0.0 Setup,NSIS Error,?,00000006,00000008,0000000A), ref: 004062C7

Part of subcall function 00405322: lstrlenW.KERNEL32(0042C228,00000000,0041BEF6,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
Part of subcall function 00405322: lstrlenW.KERNEL32(0040327A,0042C228,00000000,0041BEF6,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
Part of subcall function 00405322: lstrcatW.KERNEL32(0042C228,0040327A), ref: 0040537D
Part of subcall function 00405322: SetWindowTextW.USER32(0042C228,0042C228), ref: 0040538F
Part of subcall function 00405322: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
Part of subcall function 00405322: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
Part of subcall function 00405322: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD

Strings

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free, xrefs: 0040179E
"C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr, xrefs: 0040178D, 00401796, 004017A3, 004017B5, 004017C1, 004017F7, 0040180D, 0040182B, 00401867, 004018E8, 004018F1, 004018FB, 00401906
C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free, xrefs: 00401835, 00401851

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: "C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr$C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free$C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free
API String ID: 1941528284-3037119332
Opcode ID: 6e9a8046af19eb094d6abfdf57eef79a3d41af2fa463d12146f877a34a213090
Instruction ID: 24a82d921ca393d09b0f70664e9a68f54f64900ed4cc6ef124b6c19d11fe7a64
Opcode Fuzzy Hash: 6e9a8046af19eb094d6abfdf57eef79a3d41af2fa463d12146f877a34a213090
Instruction Fuzzy Hash: 12419371900518BACF107BA5DD46DAF3A79EF45368F20423FF422B10E1DA3C8A519A6D

Function 00403116 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 166
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403180
GetTickCount.KERNEL32 ref: 00403227
MulDiv.KERNEL32(7FFFFFFF,00000064,00000000), ref: 00403250
wsprintfW.USER32 ref: 00403263

Strings

... %d%%, xrefs: 0040325D
yA, xrefs: 004031ED, 004031FF
@, xrefs: 0040319A

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%$yA$@
API String ID: 551687249-95529746
Opcode ID: 9edc88f8172c04292c3df671f1e4f215f71192327047457aae68a0603d3020a5
Instruction ID: 5c504835c6c52170eea8577a9cac8da2a2598cbf1b76cdbdeb728d3f56fa2377
Opcode Fuzzy Hash: 9edc88f8172c04292c3df671f1e4f215f71192327047457aae68a0603d3020a5
Instruction Fuzzy Hash: AA517A71900219DBCB10DFA5DA84A9E7BB8AF04366F14417BEC14B72C0CB78DA40CBA9

Function 00406624 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040663B
wsprintfW.USER32 ref: 00406676
LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 0040668A

Strings

\, xrefs: 0040664C
UXTHEME, xrefs: 0040662D
%s%S.dll, xrefs: 00406670

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction ID: 9fa172bba6ca99a644905d2b6d7ed641771312ed853c50fe9922007c80c3d461
Opcode Fuzzy Hash: fcd04411c5a1f64f7e9219edfc5ac0d332aa1f587fd7b062781a7321f30925af
Instruction Fuzzy Hash: 7CF0FC70501119A6CF10BB64DD0EF9B365CA700304F10447AA54AF10D1EBB9DB64CB99

Function 00405DDF Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405DFD
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,0043F000,0040338D,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035D9), ref: 00405E18

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405DE4, 00405DE8
nsa, xrefs: 00405DEC

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-678247507
Opcode ID: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction ID: af8b6ba947558e1b0daa3aed001b6e0f80e178ffca66ecedc63f3e0829e9a41e
Opcode Fuzzy Hash: 579317ece081e1c49d3b274132234632dc0f80c8b4471fc5797a0d742f25062f
Instruction Fuzzy Hash: 61F03076A00304FBEB009F69ED05E9FB7BCEB95710F10803AE941E7250E6B09A548B64

Function 004015C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405C3A: CharNextW.USER32(?,?,0042FA50,?,00405CAE,0042FA50,0042FA50,?,?,74DF3420,004059EC,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405C48
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C4D
Part of subcall function 00405C3A: CharNextW.USER32(00000000), ref: 00405C65

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 0040161A

Part of subcall function 004057F1: CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405834

SetCurrentDirectoryW.KERNELBASE(?,C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free,?,00000000,000000F0), ref: 0040164D

Strings

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free, xrefs: 00401640

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free
API String ID: 1892508949-120379331
Opcode ID: 8b332d4b5b69e44390726f1312c4fe6c92a9be31ccf189f14f32e7c9e624f66a
Instruction ID: 4927223e19ece6e176e0ab471dddb7e32c8def581d8881840bcbc1854d235eeb
Opcode Fuzzy Hash: 8b332d4b5b69e44390726f1312c4fe6c92a9be31ccf189f14f32e7c9e624f66a
Instruction Fuzzy Hash: 9711E231504505EBCF30AFA1CD0159F36A0EF14369B29493BFA45B22F1DB3E89519B5E

Function 004058A3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430250,Error launching installer), ref: 004058CC
CloseHandle.KERNEL32(?), ref: 004058D9

Strings

Error launching installer, xrefs: 004058B6

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 26b27946013451d7cc559816144a6cf351020ce627575371dc693c6ec487af4b
Instruction ID: eef1ad79794a30a774d0e472c728ed5028324d39c85b098150df6d3db2f5c38f
Opcode Fuzzy Hash: 26b27946013451d7cc559816144a6cf351020ce627575371dc693c6ec487af4b
Instruction Fuzzy Hash: 93E092B5600209BFEB00AB64ED49F7BBBACEB04704F508565BD51F2290D778EC148A78

Function 00401B77 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalFree.KERNEL32(00000000), ref: 00401BE7
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BF9

Strings

"C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr, xrefs: 00401B9E, 00401BA4, 00401BBE

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: Global$AllocFree
String ID: "C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr
API String ID: 3394109436-944021693
Opcode ID: 940c73acf1eca21ab85db0ba256d73d499bf0a09b1c427e47b8dae174865ef7c
Instruction ID: fc266f0b09462df108d5b450fd3a6dc377bab1f5c412968f7868140de6343470
Opcode Fuzzy Hash: 940c73acf1eca21ab85db0ba256d73d499bf0a09b1c427e47b8dae174865ef7c
Instruction Fuzzy Hash: 4521A572610100EBCB10EB94DEC995E73A9EB49318B25013FF106F32D0DBB9A8519BAD

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 819fad79445c3595f7b9f28f54206bfd84f40695cc559c75429dbb5a445ae89f
Instruction ID: eaafb4699c1cdf5c6f59fde68eca766a765a16907ebce13606274643e5ac5f14
Opcode Fuzzy Hash: 819fad79445c3595f7b9f28f54206bfd84f40695cc559c75429dbb5a445ae89f
Instruction Fuzzy Hash: 8D0128316242209FE7095B789D05B6A3698E710715F14463FF851F62F1D678CC429B4C

Function 00406694 Relevance: 3.0, APIs: 2, Instructions: 22
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,00403401,0000000A), ref: 004066A6
GetProcAddress.KERNEL32(00000000,?), ref: 004066C1

Part of subcall function 00406624: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 0040663B
Part of subcall function 00406624: wsprintfW.USER32 ref: 00406676
Part of subcall function 00406624: LoadLibraryExW.KERNELBASE(?,00000000,00000008), ref: 0040668A

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: c77725e8978f6dbc308834741f2b8f5018f4a929a6ea22720db737a721ff7b5c
Instruction ID: 155b38c425e345f43688a0673e138072f65e923c2ca09dacbbabb210d44f0fbf
Opcode Fuzzy Hash: c77725e8978f6dbc308834741f2b8f5018f4a929a6ea22720db737a721ff7b5c
Instruction Fuzzy Hash: 50E0863250461156D31197709E4487762EC9B95750307483EF946F2091DB399C36A66D

Function 00405DB0 Relevance: 3.0, APIs: 2, Instructions: 16
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE(00442800,00402F1D,00442800,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction ID: 684cdbd871a87963be1dc25f749e3f1c2e3aca1a790447dc63e6e481d8426dbe
Opcode Fuzzy Hash: e3266cf20b616526e148e4639a7b0fb2c73eec3b674a7d239963b130731368bc
Instruction Fuzzy Hash: 5DD09E31254301AFEF098F20DE16F2EBBA2EB84B05F11552CB786940E0DA7158199B15

Function 0040586E Relevance: 3.0, APIs: 2, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,00000000,00403382,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 00405874
GetLastError.KERNEL32(?,00000006,00000008,0000000A), ref: 00405882

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction ID: b5712d1dc6f90c91938fb9970759bfac189bcafefc635788875416fd9ee2894b
Opcode Fuzzy Hash: 5aaa147db34fee021f71137ce00f1128120fffe197b4e0338bd4cd09c611a0b2
Instruction Fuzzy Hash: 2FC04C712155019ED7546F619F08B277A50EB60781F158839A946E10E0DB348465ED2D

Function 00405E62 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,004032FA,000000FF,00416A00,?,00416A00,?,?,00000004,00000000), ref: 00405E76

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction ID: 8754e0b6f25d564075f0081c534dd79b85a2df0f0bc88b3642164a4a3ec1e455
Opcode Fuzzy Hash: 02dc4867d73beddbae7b6aa94ca18310df5187db1130d79069d379e72bcbc858
Instruction Fuzzy Hash: FDE0B63221065AAFDF109F95DC00AAB7B6CEB052A0F044437FD59E7150D671EA21DAE4

Function 00405E33 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,?,?,00403344,00000000,00000000,00403168,?,00000004,00000000,00000000,00000000), ref: 00405E47

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction ID: bd732019988057c431ec21c3a2c50b1292625b962aa4d7912315599e48db2a91
Opcode Fuzzy Hash: 7739e01b11ed9e02f3c754170f73e593db9a2046c62570b976e55369a775b70d
Instruction Fuzzy Hash: A9E08C3220021AABCF20AF54DC00FEB3B6CEB05760F004832FD65E6040E230EA219BE8

Function 00403347 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,004030A4,?,?,00000006,00000008,0000000A), ref: 00403355

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction ID: c7266a3154837caca095f11e7777f6dda2278cbf6cff4ee7664d3894fc3aa091
Opcode Fuzzy Hash: d5a77a7b91dde00220c09aa0a832f43c90240fc94845358d4caa889c1b96a79f
Instruction Fuzzy Hash: ECB01271240300BFDA214F00DF09F057B21AB90700F10C034B348380F086711035EB0D

Function 00401F06 Relevance: 1.3, APIs: 1, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00405322: lstrlenW.KERNEL32(0042C228,00000000,0041BEF6,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
Part of subcall function 00405322: lstrlenW.KERNEL32(0040327A,0042C228,00000000,0041BEF6,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
Part of subcall function 00405322: lstrcatW.KERNEL32(0042C228,0040327A), ref: 0040537D
Part of subcall function 00405322: SetWindowTextW.USER32(0042C228,0042C228), ref: 0040538F
Part of subcall function 00405322: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
Part of subcall function 00405322: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
Part of subcall function 00405322: SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD

Part of subcall function 004058A3: CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00430250,Error launching installer), ref: 004058CC
Part of subcall function 004058A3: CloseHandle.KERNEL32(?), ref: 004058D9

CloseHandle.KERNEL32(?,?,?,?,?,?), ref: 00401F4D

Part of subcall function 00406745: WaitForSingleObject.KERNEL32(?,00000064), ref: 00406756
Part of subcall function 00406745: GetExitCodeProcess.KERNEL32(?,?), ref: 00406778

Part of subcall function 00406201: wsprintfW.USER32 ref: 0040620E

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcatwsprintf
String ID:
API String ID: 2972824698-0
Opcode ID: 5a28121f2258d33dec22efc4f0f8398db0f945c4b774a67d481a18083085a5c0
Instruction ID: 9073c6adce58ff193a4fc3832a7f1d33e0b572ffc6e746f3319226a0f770ccba
Opcode Fuzzy Hash: 5a28121f2258d33dec22efc4f0f8398db0f945c4b774a67d481a18083085a5c0
Instruction Fuzzy Hash: 24F0F0329090219BDB20FBA189885DE72A49F44318B2441BBF902B20D1CBBC0E409A6E

Function 004038D0 Relevance: 1.3, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00403703,00000006,?,00000006,00000008,0000000A), ref: 004038DB

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: e8572cf52f1277920d32385407c6d748d2cc2d24b6f11499ea36587d3a9df684
Instruction ID: 1d93f2d4e3952ef003524c02ff0619ab5efb0f82ec005edec18b282fc718bfed
Opcode Fuzzy Hash: e8572cf52f1277920d32385407c6d748d2cc2d24b6f11499ea36587d3a9df684
Instruction Fuzzy Hash: C7C0127054070496D1206F749E4F6193E54AB8173ABA04336B0B8B00F1C77C4A59555E

Non-executed Functions

Function 00405461 Relevance: 65.0, APIs: 36, Strings: 1, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004054BF
GetDlgItem.USER32(?,000003EE), ref: 004054CE
GetClientRect.USER32(?,?), ref: 0040550B
GetSystemMetrics.USER32(00000002), ref: 00405512
SendMessageW.USER32(?,00001061,00000000,?), ref: 00405533
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 00405544
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405557
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405565
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405578
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 0040559A
ShowWindow.USER32(?,00000008), ref: 004055AE
GetDlgItem.USER32(?,000003EC), ref: 004055CF
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 004055DF
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055F8
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 00405604
GetDlgItem.USER32(?,000003F8), ref: 004054DD

Part of subcall function 00404266: SendMessageW.USER32(00000028,?,00000001,00404091), ref: 00404274

GetDlgItem.USER32(?,000003EC), ref: 00405621
CreateThread.KERNEL32(00000000,00000000,Function_000053F5,00000000), ref: 0040562F
CloseHandle.KERNEL32(00000000), ref: 00405636
ShowWindow.USER32(00000000), ref: 0040565A
ShowWindow.USER32(00000000,00000008), ref: 0040565F
ShowWindow.USER32(00000008), ref: 004056A9
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004056DD
CreatePopupMenu.USER32 ref: 004056EE
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 00405702
GetWindowRect.USER32(?,?), ref: 00405722
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 0040573B
SendMessageW.USER32(?,00001073,00000000,?), ref: 00405773
OpenClipboard.USER32(00000000), ref: 00405783
EmptyClipboard.USER32 ref: 00405789
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405795
GlobalLock.KERNEL32(00000000), ref: 0040579F
SendMessageW.USER32(?,00001073,00000000,?), ref: 004057B3
GlobalUnlock.KERNEL32(00000000), ref: 004057D3
SetClipboardData.USER32(0000000D,00000000), ref: 004057DE
CloseClipboard.USER32 ref: 004057E4

Strings

{, xrefs: 004056C7

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: {
API String ID: 590372296-366298937
Opcode ID: b747a118dcd76f797ac229e86f31520b95951f9f2fd18a8a10ba66df94a6a7c7
Instruction ID: 0d33ea325d25f8e5d5623e6ebdd73ca6fcd7ab1b09301a5b30cdd6c49ec902ff
Opcode Fuzzy Hash: b747a118dcd76f797ac229e86f31520b95951f9f2fd18a8a10ba66df94a6a7c7
Instruction Fuzzy Hash: D7B15770900608FFDB119FA0DD89AAE7BB9FB48355F00403AFA41BA1A0CB755E51DF68

Function 00404C9E Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404CB6
GetDlgItem.USER32(?,00000408), ref: 00404CC1
GlobalAlloc.KERNEL32(00000040,?), ref: 00404D0B
LoadBitmapW.USER32(0000006E), ref: 00404D1E
SetWindowLongW.USER32(?,000000FC,00405296), ref: 00404D37
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D4B
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D5D
SendMessageW.USER32(?,00001109,00000002), ref: 00404D73
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D7F
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D91
DeleteObject.GDI32(00000000), ref: 00404D94
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404DBF
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404DCB
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E61
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E8C
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404EA0
GetWindowLongW.USER32(?,000000F0), ref: 00404ECF
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404EDD
ShowWindow.USER32(?,00000005), ref: 00404EEE
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FEB
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 00405050
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405065
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405089
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 004050A9
ImageList_Destroy.COMCTL32(?), ref: 004050BE
GlobalFree.KERNEL32(?), ref: 004050CE
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405147
SendMessageW.USER32(?,00001102,?,?), ref: 004051F0
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051FF
InvalidateRect.USER32(?,00000000,00000001), ref: 0040521F
ShowWindow.USER32(?,00000000), ref: 0040526D
GetDlgItem.USER32(?,000003FE), ref: 00405278
ShowWindow.USER32(00000000), ref: 0040527F

Strings

M, xrefs: 00404E48
N, xrefs: 00404F29
, xrefs: 00405257

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 38e67d642b103c863e09d225da822fb6d69acbe0d816e4b8de2aebeebed4de2d
Instruction ID: f888d98cc81d7f01a919363da6f821789f230268a52e2f70c0503caf05bd5b25
Opcode Fuzzy Hash: 38e67d642b103c863e09d225da822fb6d69acbe0d816e4b8de2aebeebed4de2d
Instruction Fuzzy Hash: BB026FB0900209EFDB109FA4DD85AAE7BB5FB84314F14857AF610BA2E0C7799D52CF58

Function 00404722 Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 00404771
SetWindowTextW.USER32(00000000,?), ref: 0040479B
SHBrowseForFolderW.SHELL32(?), ref: 0040484C
CoTaskMemFree.OLE32(00000000), ref: 00404857
lstrcmpiW.KERNEL32("C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr,0042D248,00000000,?,?), ref: 00404889
lstrcatW.KERNEL32(?,"C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr), ref: 00404895
SetDlgItemTextW.USER32(?,000003FB,?), ref: 004048A7

Part of subcall function 00405904: GetDlgItemTextW.USER32(?,?,00000400,004048DE), ref: 00405917

Part of subcall function 0040654E: CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0043F000,0040336A,C:\Users\user\AppData\Local\Temp\,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065B1
Part of subcall function 0040654E: CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004065C0
Part of subcall function 0040654E: CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0043F000,0040336A,C:\Users\user\AppData\Local\Temp\,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065C5
Part of subcall function 0040654E: CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0043F000,0040336A,C:\Users\user\AppData\Local\Temp\,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065D8

GetDiskFreeSpaceW.KERNEL32(0042B218,?,?,0000040F,?,0042B218,0042B218,?,00000001,0042B218,?,?,000003FB,?), ref: 0040496A
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404985

Part of subcall function 00404ADE: lstrlenW.KERNEL32(0042D248,0042D248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B7F
Part of subcall function 00404ADE: wsprintfW.USER32 ref: 00404B88
Part of subcall function 00404ADE: SetDlgItemTextW.USER32(?,0042D248), ref: 00404B9B

Strings

A, xrefs: 00404845
"C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr, xrefs: 00404883, 00404888, 00404893

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr$A
API String ID: 2624150263-911722758
Opcode ID: 0e7a3ef283d1d7ec7faeb562c0eda326dd22e556ee24bddd125c463040a43afb
Instruction ID: 9ce2ccc5872d7715d19bac2dec5c0444f9ce2fea2c0a51142092d54e0f15b7c0
Opcode Fuzzy Hash: 0e7a3ef283d1d7ec7faeb562c0eda326dd22e556ee24bddd125c463040a43afb
Instruction Fuzzy Hash: F8A165B1A00208ABDB11AFA5CD45AAFB7B8EF84314F10847BF601B62D1D77C99418F6D

Function 004059CC Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 148filestringCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 004059F5
lstrcatW.KERNEL32(0042F250,\*.*), ref: 00405A3D
lstrcatW.KERNEL32(?,0040A014), ref: 00405A60
lstrlenW.KERNEL32(?,?,0040A014,?,0042F250,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A66
FindFirstFileW.KERNEL32(0042F250,?,?,?,0040A014,?,0042F250,?,?,C:\Users\user\AppData\Local\Temp\,74DF3420,00000000), ref: 00405A76
FindNextFileW.KERNEL32(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405B16
FindClose.KERNEL32(00000000), ref: 00405B25

Strings

\*.*, xrefs: 00405A37
C:\Users\user\AppData\Local\Temp\, xrefs: 004059DA

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-3042786806
Opcode ID: bcbc2a7ac1b1f3fb7d07acde4e2512b3450779b38a1d7279aa7c3219c953243e
Instruction ID: 87b7c1c15068e6398432f2de95375e915c3ae258b511550e47b187391169d043
Opcode Fuzzy Hash: bcbc2a7ac1b1f3fb7d07acde4e2512b3450779b38a1d7279aa7c3219c953243e
Instruction Fuzzy Hash: EE41E430900914BACB21AB618C89ABF7778EF45768F50427FF801B11D1D77CA982DE6E

Function 00402104 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 129comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(004085E8,?,00000001,004085D8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402183

Strings

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free, xrefs: 004021C3

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: CreateInstance
String ID: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free
API String ID: 542301482-120379331
Opcode ID: 0bf3dfc2339aa7d15c11075db74036d96aed453b0273c78684b575aae048cbb1
Instruction ID: d410e27007f87fae541732bdb1cbefdb239a2090c9e466904aadd755c5c79360
Opcode Fuzzy Hash: 0bf3dfc2339aa7d15c11075db74036d96aed453b0273c78684b575aae048cbb1
Instruction Fuzzy Hash: 0D413A71A00208AFCF04DFE4C988A9D7BB5FF48314B24457AF915EB2E0DBB99981CB54

Function 004072EC Relevance: 2.8, Strings: 2, Instructions: 300COMMON

Download Yara Rule

Strings

p!C, xrefs: 00407520
p!C, xrefs: 0040743C, 0040745E, 0040750E, 004074E0, 00407463

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID:
String ID: p!C$p!C
API String ID: 0-3125587631
Opcode ID: b391703ce6aa9d184f83615265780e2503839b4fa6daee6685a5ac04655da8ea
Instruction ID: 7c26ffe8835462b5285d43e9ad3b72979f058f3642fe5300250d3649f4ae0bba
Opcode Fuzzy Hash: b391703ce6aa9d184f83615265780e2503839b4fa6daee6685a5ac04655da8ea
Instruction Fuzzy Hash: 9BC15831E04219DBDF18CF68C8905EEBBB2BF88314F25866AC85677380D734A942CF95

Function 00402868 Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(00000000,?,00000002), ref: 00402877

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 115c5d433e14c96260f9e46262acef96b25dd7cb937b0ec189ae6923d83c572a
Instruction ID: 0cd4a400be5c1b2ce6ea5bbb35e8853c3f48bcc8ff45a2cab7902aaadd26400c
Opcode Fuzzy Hash: 115c5d433e14c96260f9e46262acef96b25dd7cb937b0ec189ae6923d83c572a
Instruction Fuzzy Hash: C8F08271A14104EFDB00EBA4DA499ADB378EF04314F6045BBF515F21D1DBB45D409B29

Function 00406B15 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a4ae33423394c5bea169515a796ff1213356ce6b05ba1201df3d6212e3a5333
Instruction ID: dcc2b246e3e85771245330633344c28aad3b6f2e7effc766acd5add5c88cb85a
Opcode Fuzzy Hash: 5a4ae33423394c5bea169515a796ff1213356ce6b05ba1201df3d6212e3a5333
Instruction Fuzzy Hash: DBE18A7190470ADFDB24CF99C880BAAB7F5FF44305F15852EE497A7291E378AA91CB04

Function 00403D58 Relevance: 48.3, APIs: 32, Instructions: 346windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403D94
ShowWindow.USER32(?), ref: 00403DB1
DestroyWindow.USER32 ref: 00403DC5
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DE1
GetDlgItem.USER32(?,?), ref: 00403E02
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403E16
IsWindowEnabled.USER32(00000000), ref: 00403E1D
GetDlgItem.USER32(?,00000001), ref: 00403ECB
GetDlgItem.USER32(?,00000002), ref: 00403ED5
SetClassLongW.USER32(?,000000F2,?), ref: 00403EEF
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F40
GetDlgItem.USER32(?,00000003), ref: 00403FE6
ShowWindow.USER32(00000000,?), ref: 00404007
EnableWindow.USER32(?,?), ref: 00404019
EnableWindow.USER32(?,?), ref: 00404034
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040404A
EnableMenuItem.USER32(00000000), ref: 00404051
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 00404069
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040407C
lstrlenW.KERNEL32(0042D248,?,0042D248,00000000), ref: 004040A6
SetWindowTextW.USER32(?,0042D248), ref: 004040BA
ShowWindow.USER32(?,0000000A), ref: 004041EE

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 0b7b1c17639b6d1c33985b6847ccd2c8cf6276db4693f940084e8c077b1e5a4a
Instruction ID: e03fc219ec92158800d4d40d681534e4389e9639ccb8e5563fa4604b390d03ca
Opcode Fuzzy Hash: 0b7b1c17639b6d1c33985b6847ccd2c8cf6276db4693f940084e8c077b1e5a4a
Instruction Fuzzy Hash: 29C1D171600300ABDB216F61ED89E2B3AB8FB95746F04053EF641B51F0CB799982DB6D

Function 004043F0 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 204windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040448E
GetDlgItem.USER32(?,000003E8), ref: 004044A2
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004044BF
GetSysColor.USER32(?), ref: 004044D0
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044DE
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044EC
lstrlenW.KERNEL32(?), ref: 004044F1
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044FE
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404513
GetDlgItem.USER32(?,0000040A), ref: 0040456C
SendMessageW.USER32(00000000), ref: 00404573
GetDlgItem.USER32(?,000003E8), ref: 0040459E
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045E1
LoadCursorW.USER32(00000000,00007F02), ref: 004045EF
SetCursor.USER32(00000000), ref: 004045F2
LoadCursorW.USER32(00000000,00007F00), ref: 0040460B
SetCursor.USER32(00000000), ref: 0040460E
SendMessageW.USER32(00000111,00000001,00000000), ref: 0040463D
SendMessageW.USER32(00000010,00000000,00000000), ref: 0040464F

Strings

N, xrefs: 0040458C
"C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr, xrefs: 004045CD
gC@, xrefs: 004045FA

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr$N$gC@
API String ID: 3103080414-3976289358
Opcode ID: 353f568027e9435f0b10a007412a0fb7b671a4650aedb506db2b7bc5b58b0be6
Instruction ID: 67960cbe9d5dd80a83daf25f2437327cccbb0fafcef4e9f4d39b28ee92a42e65
Opcode Fuzzy Hash: 353f568027e9435f0b10a007412a0fb7b671a4650aedb506db2b7bc5b58b0be6
Instruction Fuzzy Hash: ED618FB1900209BFDB109F60DD85EAA7B79FB84345F00853AF605B62D0D77DA951CFA8

Function 00401000 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,downloader_easeus 2.0.0 Setup,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C
downloader_easeus 2.0.0 Setup, xrefs: 00401150

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F$downloader_easeus 2.0.0 Setup
API String ID: 941294808-3134015408
Opcode ID: e215112caf94b1f54c3d659d29471f2010c28c8ad64a223ce82802b434a3cd12
Instruction ID: 68187ad06c86d7515f13608b457f8be07a0117cb3bcf177897c910b083aea3f1
Opcode Fuzzy Hash: e215112caf94b1f54c3d659d29471f2010c28c8ad64a223ce82802b434a3cd12
Instruction Fuzzy Hash: 9A418C71800209AFCF058F95DE459AF7BB9FF44315F00842AF591AA1A0C778EA54DFA4

Function 00405F06 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 130memorystringCOMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,?,?,004060A1,?,?), ref: 00405F41
GetShortPathNameW.KERNEL32(?,004308E8,00000400), ref: 00405F4A

Part of subcall function 00405D15: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D25
Part of subcall function 00405D15: lstrlenA.KERNEL32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D57

GetShortPathNameW.KERNEL32(?,004310E8,00000400), ref: 00405F67
wsprintfA.USER32 ref: 00405F85
GetFileSize.KERNEL32(00000000,00000000,004310E8,C0000000,00000004,004310E8,?,?,?,?,?), ref: 00405FC0
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405FCF
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00406007
SetFilePointer.KERNEL32(0040A560,00000000,00000000,00000000,00000000,004304E8,00000000,-0000000A,0040A560,00000000,[Rename],00000000,00000000,00000000), ref: 0040605D
GlobalFree.KERNEL32(00000000), ref: 0040606E
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406075

Part of subcall function 00405DB0: GetFileAttributesW.KERNELBASE(00442800,00402F1D,00442800,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405DB4
Part of subcall function 00405DB0: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000,?,00000006,00000008,0000000A), ref: 00405DD6

Strings

[Rename], xrefs: 00405FEF, 00406001
%ls=%ls, xrefs: 00405F7B

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrlen$AllocAttributesCreateFreePointerSizelstrcpywsprintf
String ID: %ls=%ls$[Rename]
API String ID: 2171350718-461813615
Opcode ID: 83696b653ec3a1efa3543d3077539b31fe4808eb9cc4cf445683fb08cbafc385
Instruction ID: 4536b0422d5dde00314373cba87b6dc9e05edcb010d47b65b9eea0f1bfd6f862
Opcode Fuzzy Hash: 83696b653ec3a1efa3543d3077539b31fe4808eb9cc4cf445683fb08cbafc385
Instruction Fuzzy Hash: 5A313531641B04BBC220AB659D48F6B3AACEF45744F15003FFA46F62D2DB7C98118ABD

Function 004062DC Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 209stringCOMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32("C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr,00000400), ref: 0040641D
GetWindowsDirectoryW.KERNEL32("C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr,00000400,00000000,0042C228,?,00405359,0042C228,00000000), ref: 00406430
SHGetSpecialFolderLocation.SHELL32(00405359,0041BEF6,00000000,0042C228,?,00405359,0042C228,00000000), ref: 0040646C
SHGetPathFromIDListW.SHELL32(0041BEF6,"C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr), ref: 0040647A
CoTaskMemFree.OLE32(0041BEF6), ref: 00406485
lstrcatW.KERNEL32("C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr,\Microsoft\Internet Explorer\Quick Launch), ref: 004064AB
lstrlenW.KERNEL32("C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr,00000000,0042C228,?,00405359,0042C228,00000000), ref: 00406503

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004063ED
"C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr, xrefs: 00406306, 004063E1, 004063E8, 004063EC, 00406406, 00406407, 0040641C, 0040642F, 0040644B, 00406476, 004064AA, 004064B0, 004064CC, 004064DF, 004064FC, 00406502, 0040650E, 00406541
\Microsoft\Internet Explorer\Quick Launch, xrefs: 004064A5

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskWindowslstrcatlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 717251189-1532523090
Opcode ID: 55be7f4316b30cf13c4370b5612eea0ce10ea7aa58c3089d9c737aa3649c70f7
Instruction ID: 9562dd14d952d55a61127842092d6448be61ccc4685f782e3002b21b8a961bfb
Opcode Fuzzy Hash: 55be7f4316b30cf13c4370b5612eea0ce10ea7aa58c3089d9c737aa3649c70f7
Instruction Fuzzy Hash: 38611171A00111ABDF209F54DC41AAE37A9EF45318F26803FE943BA2D0D77D9AA1C79D

Function 00404298 Relevance: 12.1, APIs: 8, Instructions: 68COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004042B5
GetSysColor.USER32(00000000), ref: 004042F3
SetTextColor.GDI32(?,00000000), ref: 004042FF
SetBkMode.GDI32(?,?), ref: 0040430B
GetSysColor.USER32(?), ref: 0040431E
SetBkColor.GDI32(?,?), ref: 0040432E
DeleteObject.GDI32(?), ref: 00404348
CreateBrushIndirect.GDI32(?), ref: 00404352

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction ID: a3c6a1d12b74a4a342abaca89036a15a37f51972f1e3113ed1cbee018e9c0b42
Opcode Fuzzy Hash: cedac81959eb3ef19a74f908d68e4e703a61b794166ebd5b231b869c6a402091
Instruction Fuzzy Hash: 772156716007059BC724DF78D948B5B77F4AF81710B04893DED96A26E0D734E544CB54

Function 0040264A Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 153fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 004026B6
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 004026F1
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 00402714
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 0040272A

Part of subcall function 00405E91: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405EA7

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 004027D6

Strings

9, xrefs: 00402699

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 19438e2e62ba8aece1a895eee3c3762f252ce0cb36923fbe756b3879527f42a2
Instruction ID: 0a1b8613d15e357d59cabb4a84863d73d9dad353ca9b6e0785da3ca47288b3a0
Opcode Fuzzy Hash: 19438e2e62ba8aece1a895eee3c3762f252ce0cb36923fbe756b3879527f42a2
Instruction Fuzzy Hash: 42511974D00219AEDF219F95DA88AAEB779FF04304F10443BE901B72D0DBB89982CB18

Function 00405322 Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042C228,00000000,0041BEF6,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000,?), ref: 0040535A
lstrlenW.KERNEL32(0040327A,0042C228,00000000,0041BEF6,74DF23A0,?,?,?,?,?,?,?,?,?,0040327A,00000000), ref: 0040536A
lstrcatW.KERNEL32(0042C228,0040327A), ref: 0040537D
SetWindowTextW.USER32(0042C228,0042C228), ref: 0040538F
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 004053B5
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 004053CF
SendMessageW.USER32(?,00001013,?,00000000), ref: 004053DD

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 165d7cb729b0b1d8dbd40609dc1f72fd4c041b11e62b4558e2d47e9179cb1f78
Instruction ID: 851cb2e595d07e8670ef4c489cf40fd5108cb81fe88e509cf6dd9e4b353e565e
Opcode Fuzzy Hash: 165d7cb729b0b1d8dbd40609dc1f72fd4c041b11e62b4558e2d47e9179cb1f78
Instruction Fuzzy Hash: 20218371900518BACF11AFA5DD859CFBFB9EF45350F14807AF904B62A0C7B94A40DFA8

Function 0040654E Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0043F000,0040336A,C:\Users\user\AppData\Local\Temp\,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065B1
CharNextW.USER32(?,?,?,00000000,?,00000006,00000008,0000000A), ref: 004065C0
CharNextW.USER32(?,00000000,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0043F000,0040336A,C:\Users\user\AppData\Local\Temp\,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065C5
CharPrevW.USER32(?,?,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,0043F000,0040336A,C:\Users\user\AppData\Local\Temp\,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 004065D8

Strings

*?|<>/":, xrefs: 004065A0
C:\Users\user\AppData\Local\Temp\, xrefs: 0040654F, 00406554

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: Char$Next$Prev
String ID: *?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-4010320282
Opcode ID: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction ID: 36fae6fd7d65e337959ab81909abbfc549fe516cf0b4c9ff473ab524d2c4c229
Opcode Fuzzy Hash: f2dbc7d310367101a7bf5127f564121aa95c210a65fb008c6410ea5a4ac792ac
Instruction Fuzzy Hash: B611B65580061279DB302B14BC40EB762F8EF54764F56403FED86732C8EBBC5C9292AD

Function 00404BEC Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404C07
GetMessagePos.USER32 ref: 00404C0F
ScreenToClient.USER32(?,?), ref: 00404C29
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404C3B
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C61

Strings

f, xrefs: 00404C3D

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction ID: 457ccdd811883e010b73e4973708530e0d9e00004b69c5e73a61d7a3cd07de8f
Opcode Fuzzy Hash: e2d2d6aa42d138b4bf43a857dc2fb8cfa63f2fbdf5f441295addbf44c9bf4daa
Instruction Fuzzy Hash: CF015271900218BAEB10DBA4DD85BFEBBBCAF95711F10412BBA50B71D0D7B499018BA4

Function 00402DF3 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402E11
MulDiv.KERNEL32(00019600,00000064,002881A0), ref: 00402E3C
wsprintfW.USER32 ref: 00402E4C
SetWindowTextW.USER32(?,?), ref: 00402E5C
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402E6E

Strings

verifying installer: %d%%, xrefs: 00402E46

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: e1d542de2cd716b5e5aca43617af61348071ba80885408b45aa8db9304e84829
Instruction ID: 97abdd23f95b89fa957f28f44bfdcbbe1494948371ff671501e6f707f2390605
Opcode Fuzzy Hash: e1d542de2cd716b5e5aca43617af61348071ba80885408b45aa8db9304e84829
Instruction Fuzzy Hash: B7014F7164020CBBEF209F60DE49FAA3B69AB04304F008439FA06B91E0DBB885558B98

Function 004028AD Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402901
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 0040291D
GlobalFree.KERNEL32(?), ref: 00402956
GlobalFree.KERNEL32(00000000), ref: 00402969
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,000000F0), ref: 00402981
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402995

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 4126a60767291b4e97372a1dfb43fb75c9546f442d683c376cf2255872b84c40
Instruction ID: 46c72067781f24dbae578634f425dbba750e376c3d5c902d6f733973cd64d3bf
Opcode Fuzzy Hash: 4126a60767291b4e97372a1dfb43fb75c9546f442d683c376cf2255872b84c40
Instruction Fuzzy Hash: 9621AEB1800128BBDF116FA5DE89DDE7E79AF08364F14423AF960762E0CB794C418B98

Function 004057F1 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(?,?,00000000), ref: 00405834
GetLastError.KERNEL32 ref: 00405848
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 0040585D
GetLastError.KERNEL32 ref: 00405867

Strings

C:\Users\user\Desktop, xrefs: 004057F1

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\Desktop
API String ID: 3449924974-224404859
Opcode ID: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction ID: 56aaffc7fd545305371b439287a03fd7ccaf004a29b63406c0e33255b185a1b6
Opcode Fuzzy Hash: c7775b55854fc79259119bfc4daa9494171cd7cf58f96f816c013ac7f64a11dc
Instruction Fuzzy Hash: 90011A72D00619EADF00DFA1C944BEFBBB8EF14354F00843AE945B6281D7789618CFA9

Function 00401DB9 Relevance: 7.5, APIs: 5, Instructions: 43COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401DBC
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401DD6
MulDiv.KERNEL32(00000000,00000000), ref: 00401DDE
ReleaseDC.USER32(?,00000000), ref: 00401DEF
CreateFontIndirectW.GDI32(0040CDD0), ref: 00401E3E

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 0df72e3b5cf70d21c530e24e682e28afae01b7faaf581061804cefe84a28b9e7
Instruction ID: ba082d56d8bf6e999078db2812661e05c0675f9cd89887cb5e118dc0f9610a58
Opcode Fuzzy Hash: 0df72e3b5cf70d21c530e24e682e28afae01b7faaf581061804cefe84a28b9e7
Instruction Fuzzy Hash: CF015E71944240EFE700ABB0AF4AAD97FB4AF55301F10457EE242F61E2DAB904458B2D

Function 00401D5D Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D63
GetClientRect.USER32(00000000,?), ref: 00401D70
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D91
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D9F
DeleteObject.GDI32(00000000), ref: 00401DAE

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: ffa308e51fc2a7dd0918d2a0305ef53ba2975e26ebd74a39f79ceeac246a8f65
Instruction ID: f6b005b132729ba5a1909f4a704d5e159ac18246d791616e3be01574202a0a4f
Opcode Fuzzy Hash: ffa308e51fc2a7dd0918d2a0305ef53ba2975e26ebd74a39f79ceeac246a8f65
Instruction Fuzzy Hash: 4EF0FF72A04518AFDB01DBE4DF88CEEB7BCEB48301B14047AF641F61A0CA749D419B38

Function 00401C1F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C8F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401CA7

Strings

!, xrefs: 00401C5B

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 7e3eeff1b63bcc2d517f183bf836ef2b026841584b0bf51ee9d38dd24623c36e
Instruction ID: 9b2162bbfebbb1b7b3748198b6c02d748cac4cdb6124cb19748b2f92d1b33cd7
Opcode Fuzzy Hash: 7e3eeff1b63bcc2d517f183bf836ef2b026841584b0bf51ee9d38dd24623c36e
Instruction Fuzzy Hash: 8E219371948209AEEF059FB5DE4AABE7BB5EF84304F14443EF605B61D0D7B889409B18

Function 00404ADE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(0042D248,0042D248,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B7F
wsprintfW.USER32 ref: 00404B88
SetDlgItemTextW.USER32(?,0042D248), ref: 00404B9B

Strings

%u.%u%s%s, xrefs: 00404B69

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: be899ce802f4ada5aa38b77195d66e19eeaafb4e1a6305ece11e6f52dcfdaeb3
Instruction ID: 49dacc2217062e77d4dc452dcd456e10a33323318ced1260d8f84a7edb165714
Opcode Fuzzy Hash: be899ce802f4ada5aa38b77195d66e19eeaafb4e1a6305ece11e6f52dcfdaeb3
Instruction Fuzzy Hash: D911C3736041283ADB00656D9C46F9E369C9B85334F254237FA25F21D1E979D82182E8

Function 00402598 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,0040B5D0,000000FF,C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free,00000400,?,?,00000021), ref: 004025E8
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free,?,?,0040B5D0,000000FF,C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free,00000400,?,?,00000021), ref: 004025F3

Strings

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free, xrefs: 004025B3, 004025DA, 004025EE, 0040263A

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free
API String ID: 3109718747-120379331
Opcode ID: df88c7b315d98be26a832866f643f7765180fbf59289eea360610b16d9ed4daa
Instruction ID: 4af4a56a495a7247eb1268c7c56f37f79310e300d8c273c1dd4748c0a8a00d57
Opcode Fuzzy Hash: df88c7b315d98be26a832866f643f7765180fbf59289eea360610b16d9ed4daa
Instruction Fuzzy Hash: 41110872A04301BADB046FB18E89A9F7664AF44398F24443FF103F61D0DAFC89416B5E

Function 00405B8F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,0040337C,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 00405B95
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,0040337C,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,74DF3420,004035D9,?,00000006,00000008,0000000A), ref: 00405B9F
lstrcatW.KERNEL32(?,0040A014), ref: 00405BB1

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B8F

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction ID: 9f579dd6f6e84daacee8b4087b975d8f345068127d43d06e1f6a06445f68851b
Opcode Fuzzy Hash: cc3b6fad2320eb0d125534955cb1fe8af3638bf69e103b669ecb1462063790d4
Instruction Fuzzy Hash: C8D05E31101534AAC111BF448D04CDF72ACAE45344742007AF501B20A2C7B82D5186FE

Function 00402D44 Relevance: 6.1, APIs: 4, Instructions: 63registryCOMMON

Download Yara Rule

APIs

RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402DA9
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DB2
RegCloseKey.ADVAPI32(?,?,?), ref: 00402DD3

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: Close$Enum
String ID:
API String ID: 464197530-0
Opcode ID: a4e23b119c2c64eb18a4fa0724f9b8d9fe0ec592ff9815e45bdb7592abe1cef3
Instruction ID: fc7ade2e12cd9e993d25f9a328d8db16c9603ee1eb20de8c24b8f84b94a82c23
Opcode Fuzzy Hash: a4e23b119c2c64eb18a4fa0724f9b8d9fe0ec592ff9815e45bdb7592abe1cef3
Instruction Fuzzy Hash: B4116A32500109FBDF02AB90CE09FEE7B7DAF54340F100076B904B51E1E7B59E21AB68

Function 00402E79 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00403059,00000001,?,00000006,00000008,0000000A), ref: 00402E8C
GetTickCount.KERNEL32 ref: 00402EAA
CreateDialogParamW.USER32(0000006F,00000000,00402DF3,00000000), ref: 00402EC7
ShowWindow.USER32(00000000,00000005,?,00000006,00000008,0000000A), ref: 00402ED5

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: 5c4e852214d6767aab513baeadf18d74bcc02012da70e31d5af0b3f9b2778c41
Instruction ID: ba23c68ca914eac1f4c080bcf69ea635dc5c4ffa9688b42209883b937cdf97fb
Opcode Fuzzy Hash: 5c4e852214d6767aab513baeadf18d74bcc02012da70e31d5af0b3f9b2778c41
Instruction Fuzzy Hash: 7FF03A30541630FBC6706B20FE0DA8B7B65FB44B02B42497AF002A19A4C7B849818ADC

Function 00405296 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 004052C5
CallWindowProcW.USER32(?,?,?,?), ref: 00405316

Part of subcall function 0040427D: SendMessageW.USER32(00000000,00000000,00000000,00000000), ref: 0040428F

Strings

, xrefs: 004052A6

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 724b08e39b448c58c7649a37dc1be8b90ebc0ba8e0923a3b5611d97535f2409a
Instruction ID: 81d983181078a42bdaaa38d141d1896fcab4c42a172a92442cc7f35772e796f5
Opcode Fuzzy Hash: 724b08e39b448c58c7649a37dc1be8b90ebc0ba8e0923a3b5611d97535f2409a
Instruction Fuzzy Hash: 8E018431200709EBDF205F51DDD4A5B7B25EB84794F50507BFA00751D0D7BA8C929E2E

Function 00406188 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000800,00000002,0042C228,00000000,?,?,"C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr,?,?,004063FC,80000002), ref: 004061CE
RegCloseKey.ADVAPI32(?,?,004063FC,80000002,Software\Microsoft\Windows\CurrentVersion,"C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr,"C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr,"C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr,00000000,0042C228), ref: 004061D9

Strings

"C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr, xrefs: 0040618F

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: CloseQueryValue
String ID: "C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe" EXEDIR=C:\Users\user\Desktop ||| EXENAME=drw_fr
API String ID: 3356406503-944021693
Opcode ID: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction ID: dbe656cbcd6f76d760dfbfd9a3b1c67a2d3549b4381969b9bec3f5648691b042
Opcode Fuzzy Hash: c86c14991d827863ed80974af0b6eb11eee99485bcf286d774b2a77da772c934
Instruction Fuzzy Hash: 22017C72500209EADF218F51CD09EDB3BA8EB55364F01803AFD16A61A1D778D964EBA4

Function 00403915 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,00000000,74DF3420,004038ED,00403703,00000006,?,00000006,00000008,0000000A), ref: 0040392F
GlobalFree.KERNEL32(?), ref: 00403936

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00403927

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3081826266
Opcode ID: 458fb59c7289fd05ef48150b7000eed9d6dd19151a6e1d3204a1ea3f1dd8076b
Instruction ID: cd662c2fc9a96c5040b18d0515cf0ea54f7952519699f51ce209c07819915f51
Opcode Fuzzy Hash: 458fb59c7289fd05ef48150b7000eed9d6dd19151a6e1d3204a1ea3f1dd8076b
Instruction Fuzzy Hash: 20E0C2335016209BC6215F04ED08B5E776CAF58B32F05447AF8807B26087B81C838FD8

Function 00405BDB Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00442800,C:\Users\user\Desktop,00402F49,C:\Users\user\Desktop,C:\Users\user\Desktop,00442800,00442800,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405BE1
CharPrevW.USER32(00442800,00000000,00442800,C:\Users\user\Desktop,00402F49,C:\Users\user\Desktop,C:\Users\user\Desktop,00442800,00442800,80000000,00000003,?,00000006,00000008,0000000A), ref: 00405BF1

Strings

C:\Users\user\Desktop, xrefs: 00405BDB

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\Desktop
API String ID: 2709904686-224404859
Opcode ID: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction ID: aeb767edbde6605fb3f6e877d1e8e55744b908c0e0c9ef55a7edb7ad10a4fca3
Opcode Fuzzy Hash: e4f7a16c0d3aeb27420e4918e5816bacf7b9900a4c75110623d7ea7fd9e9117e
Instruction Fuzzy Hash: D9D05EB2414920DAC3126B04DC40D9F73ACEF11300B4A446AE440A61A1D7786C8186AD

Function 00405D15 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D25
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405D3D
CharNextA.USER32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D4E
lstrlenA.KERNEL32(00000000,?,00000000,00405FFA,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405D57

Memory Dump Source

Source File: 00000000.00000002.1643001405.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1642970890.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643035849.0000000000408000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.000000000040A000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000431000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643073592.0000000000440000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1643187214.0000000000445000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_drw_free_installer.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction ID: cc601e2af81a4130f3690bf6756e9ae730db34a97aa71f580e1783f9e5236296
Opcode Fuzzy Hash: 6db5b03da17fe1faae21ad7e2c869b7ed7bb68520138c246bcc2ad94f2104a67
Instruction Fuzzy Hash: 3DF0F631200818FFC7129FA4DD049AFBBA8EF06354B2580BAE840F7211D634DE02AF98

Analysis Process: EDownloader.exePID: 7440, Parent PID: 7416COMMON

Execution Graph

Execution Coverage:	3.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.2%
Total number of Nodes:	2000
Total number of Limit Nodes:	58

Executed Functions

Function 00F742A0 Relevance: 130.0, APIs: 68, Strings: 5, Instructions: 2242COMMON

Download Yara Rule

APIs

IsRectEmpty.USER32(?), ref: 00F74344
_malloc.LIBCMT ref: 00F74379

Part of subcall function 00FDE798: __FF_MSGBANNER.LIBCMT ref: 00FDE7BB
Part of subcall function 00FDE798: __NMSG_WRITE.LIBCMT ref: 00FDE7C2
Part of subcall function 00FDE798: RtlAllocateHeap.NTDLL(00000000,?), ref: 00FDE80F

_malloc.LIBCMT ref: 00F7439C
_malloc.LIBCMT ref: 00F743B5
_malloc.LIBCMT ref: 00F743D1
GetClipBox.GDI32(?,?), ref: 00F74407
CreateRectRgnIndirect.GDI32(?), ref: 00F7441B
CreateRectRgnIndirect.GDI32(?), ref: 00F74425
ExtSelectClipRgn.GDI32(?,00000000,00000001), ref: 00F74438

Part of subcall function 00F742A0: PtInRect.USER32(?,?,?), ref: 00F74707

SelectObject.GDI32(?,?), ref: 00F744AD
SetBkMode.GDI32(?,00000001), ref: 00F744BD
SetTextColor.GDI32(?), ref: 00F744E7
SetBkColor.GDI32(?), ref: 00F74510
CharNextW.USER32(?), ref: 00F748FF
CharNextW.USER32(?), ref: 00F74954
SetTextColor.GDI32(?,00000000), ref: 00F749EF
SelectObject.GDI32(?,00000000), ref: 00F74AB6
SelectObject.GDI32(?,00000000), ref: 00F74BE3
CharNextW.USER32(?), ref: 00F7590D
CharNextW.USER32(?), ref: 00F7591C
GetTextExtentPoint32W.GDI32(?,?,?,?), ref: 00F76373
TextOutW.GDI32(?,?,?,?,?), ref: 00F765B1
SetRect.USER32(?,?,?,?,?), ref: 00F766DB
SetTextColor.GDI32(?,?), ref: 00F769F6
SelectObject.GDI32(?), ref: 00F76A30
SetBkMode.GDI32(?,00000002), ref: 00F76A40
SelectClipRgn.GDI32(?,?), ref: 00F76AB0
DeleteObject.GDI32(?), ref: 00F76AC4
DeleteObject.GDI32(?), ref: 00F76ACE
SelectObject.GDI32(?,?), ref: 00F76ADD

Strings

d, xrefs: 00F7456F
..., xrefs: 00F765D7
bold, xrefs: 00F74EF8
italic, xrefs: 00F74F46
underline, xrefs: 00F74F1F

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ObjectSelect$RectText$CharColorNext_malloc$Clip$CreateDeleteIndirectMode$AllocateEmptyExtentHeapPoint32
String ID: ...$bold$d$italic$underline
API String ID: 1369725245-2658422815
Opcode ID: 2a28f7c08f088908728fcd371d34fa416b746d5a67de91716d27693b49540cae
Instruction ID: eb03d3c1cbf9e5679cb9cc6e7c20bbed201fdf4dcb65cf6fc47cacb7542d1d40
Opcode Fuzzy Hash: 2a28f7c08f088908728fcd371d34fa416b746d5a67de91716d27693b49540cae
Instruction Fuzzy Hash: 41136970A087818FD724CF28C884BABB7E5AFC8714F14892EE989D7241D775E845DB93

Function 00F52450 Relevance: 111.2, APIs: 31, Strings: 32, Instructions: 980COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 00F52523
__wcsicoll.LIBCMT ref: 00F52539
__wcsicoll.LIBCMT ref: 00F5254F
__wcsicoll.LIBCMT ref: 00F52565
__wcsicoll.LIBCMT ref: 00F5257D
_memset.LIBCMT ref: 00F525D9
__wcstoi64.LIBCMT ref: 00F52610
__wcstoi64.LIBCMT ref: 00F526AA

Part of subcall function 00FDECD8: wcstoxl.LIBCMT ref: 00FDECF9

__wcsicoll.LIBCMT ref: 00F528C0
__wcsicoll.LIBCMT ref: 00F52768

Part of subcall function 00FDB3B2: _malloc.LIBCMT ref: 00FDB3CC

Strings

Edit, xrefs: 00F52945
count, xrefs: 00F525EE
Text, xrefs: 00F529C7
RichEdit, xrefs: 00F52D4A
IContainer, xrefs: 00F534EC
GifAnim, xrefs: 00F52C9F
ComboBox, xrefs: 00F52DD9
Font, xrefs: 00F52533
DateTime, xrefs: 00F52E1A
Label, xrefs: 00F52B0E
VBox, xrefs: 00F52A89
Progress, xrefs: 00F52D09
Control, xrefs: 00F52C1C
Include, xrefs: 00F52575
Default, xrefs: 00F52549
source, xrefs: 00F52627
TreeNode, xrefs: 00F52762, 00F52781, 00F52E9C, 00F534B7
true, xrefs: 00F533E2
TreeView, xrefs: 00F528DC, 00F52E5B
Tree, xrefs: 00F52A08
Image, xrefs: 00F5251D
HBox, xrefs: 00F52A49
TreeNodeUI, xrefs: 00F528B8
MultiLanguage, xrefs: 00F5255F
Option, xrefs: 00F52B96
CheckBox, xrefs: 00F52D8A
Combo, xrefs: 00F52ACD
Button, xrefs: 00F52B54
Slider, xrefs: 00F52BD6
cover, xrefs: 00F533CB
List, xrefs: 00F52986
ActiveX, xrefs: 00F52C5D

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __wcsicoll$__wcstoi64$_malloc_memsetwcstoxl
String ID: ActiveX$Button$CheckBox$Combo$ComboBox$Control$DateTime$Default$Edit$Font$GifAnim$HBox$IContainer$Image$Include$Label$List$MultiLanguage$Option$Progress$RichEdit$Slider$Text$Tree$TreeNode$TreeNodeUI$TreeView$VBox$count$cover$source$true
API String ID: 1658991335-831569304
Opcode ID: 835374de1082b1b087401c10183e28595cc478b39de651630ec9a83f04ea7a72
Instruction ID: ca8e3ae3390128f1cb36c809e423ce6db5948b898a1a80d28b86253c67e56729
Opcode Fuzzy Hash: 835374de1082b1b087401c10183e28595cc478b39de651630ec9a83f04ea7a72
Instruction Fuzzy Hash: 6E72E971A043429BDB20DF58CC42B6B73E5AF94355F04452EFE8987242E739DA48FB92

Function 00F4C22B Relevance: 83.2, APIs: 46, Strings: 1, Instructions: 908
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetClientRect.USER32(?,?), ref: 00F4C24B
IsRectEmpty.USER32 ref: 00F4C2A2
_memset.LIBCMT ref: 00F4C2BE
BeginPaint.USER32(?,?), ref: 00F4C2D5
EndPaint.USER32(?,?), ref: 00F4C2EA
GetUpdateRect.USER32(?,?,00000000), ref: 00F4C32F
InvalidateRect.USER32(?,00000000,00000000), ref: 00F4C36B
IsRectEmpty.USER32(?), ref: 00F4C431
DeleteDC.GDI32(?), ref: 00F4C474
DeleteDC.GDI32(?), ref: 00F4C485
DeleteObject.GDI32(?), ref: 00F4C496
DeleteObject.GDI32(?), ref: 00F4C4A7

Strings

windowinit, xrefs: 00F4C5D5

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Rect$Delete$EmptyObjectPaint$BeginClientInvalidateUpdate_memset
String ID: windowinit
API String ID: 2546552490-3894911279
Opcode ID: 3320140e61af4cd953fab0f0689ea323ad08acf5c50453c34b3c232119946d51
Instruction ID: 62f58c575e06b04a5ad2da208e111da2697cbab4878bf6a6c0e573b509ad2bcf
Opcode Fuzzy Hash: 3320140e61af4cd953fab0f0689ea323ad08acf5c50453c34b3c232119946d51
Instruction Fuzzy Hash: 0B821B716083409FD754CF28C884B9ABBF5BFC9300F18896DED898B355DB75A845CBA2

Function 00F71690 Relevance: 35.6, APIs: 18, Strings: 2, Instructions: 568
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileSize.KERNEL32(00000000,00000000), ref: 00F71770
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,00000000), ref: 00F717BE
CloseHandle.KERNEL32(00000000), ref: 00F717C5
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,0066EAA0,?,8F2D4ADD,?,?,?,?), ref: 00F7173C

Part of subcall function 00F49FD0: _malloc.LIBCMT ref: 00F4A01D

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00F71AB0
GetFileSize.KERNEL32(00000000,00000000), ref: 00F71AC0
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,00000000), ref: 00F71AE9
CloseHandle.KERNEL32(00000000), ref: 00F71AF0
_memset.LIBCMT ref: 00F71B5E
CreateDIBSection.GDI32 ref: 00F71BB7

Part of subcall function 00F4A110: _wcsncpy.LIBCMT ref: 00F4A1A1

CharNextW.USER32(?), ref: 00F71C31
__wcstoui64.LIBCMT ref: 00F71C3F

Part of subcall function 00FDB0A2: __lock.LIBCMT ref: 00FDB0C0
Part of subcall function 00FDB0A2: ___sbh_find_block.LIBCMT ref: 00FDB0CB
Part of subcall function 00FDB0A2: ___sbh_free_block.LIBCMT ref: 00FDB0DA
Part of subcall function 00FDB0A2: RtlFreeHeap.NTDLL(00000000,?,01028420,0000000C,00FE4923,00000000,01028990,0000000C,00FE495D,?,?,?,00FEF11D,00000004,01028BE0,0000000C), ref: 00FDB10A
Part of subcall function 00FDB0A2: GetLastError.KERNEL32(?,00FEF11D,00000004,01028BE0,0000000C,00FE429F,?,?,00000000,00000000,00000000,?,00FE58EA,00000001,00000214), ref: 00FDB11B

Strings

(, xrefs: 00F71B9A
*COLOR*, xrefs: 00F71984, 00F719E5, 00F71BE5, 00F71D55

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: File$Create$CloseHandleReadSize$CharErrorFreeHeapLastNextSection___sbh_find_block___sbh_free_block__lock__wcstoui64_malloc_memset_wcsncpy
String ID: ($*COLOR*
API String ID: 415274439-1670140489
Opcode ID: a011bd4bef33d1e26709a72ccba435f125c2ebf201bccf20964544fa37ac6ec2
Instruction ID: 5c160c48a731fe0756e574295052b3d17ff639aaa9691959dc4c9229cdaed999
Opcode Fuzzy Hash: a011bd4bef33d1e26709a72ccba435f125c2ebf201bccf20964544fa37ac6ec2
Instruction Fuzzy Hash: D822C0719083419FD321DF288885B6BB7E9BFA4710F08891EF88987341E77AD949DB53

Function 00F15AA0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 150
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00F15AD0
GetUserNameW.ADVAPI32(?,?), ref: 00F15AEE
_memset.LIBCMT ref: 00F15B0E
_memset.LIBCMT ref: 00F15B2B
LookupAccountNameW.ADVAPI32 ref: 00F15B6D
IsValidSid.ADVAPI32(00000000), ref: 00F15B80
GetSidIdentifierAuthority.ADVAPI32(?), ref: 00F15B94
swprintf.LIBCMT ref: 00F15BB5

Part of subcall function 00FDB417: __vswprintf_s_l.LIBCMT ref: 00FDB42B

swprintf.LIBCMT ref: 00F15BF2
GetSidSubAuthorityCount.ADVAPI32(?,?,?,?,?,?,?,?,?), ref: 00F15C08
GetSidSubAuthority.ADVAPI32(?,00000000), ref: 00F15C36
swprintf.LIBCMT ref: 00F15C54

Strings

S-%lu-, xrefs: 00F15BA6
%-lu, xrefs: 00F15BE8
-%lu, xrefs: 00F15C48

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Authority_memsetswprintf$Name$AccountCountIdentifierLookupUserValid__vswprintf_s_l
String ID: %-lu$-%lu$S-%lu-
API String ID: 1903154352-474367829
Opcode ID: 56acb5dab2cae718a2314abcc6977f5b7bad92354a0104c9f9756e8a5fb0cb98
Instruction ID: 4e08f3a5b61450364e1b93ffe59a82c8c642e82e2e4dd9d821326c970a568d62
Opcode Fuzzy Hash: 56acb5dab2cae718a2314abcc6977f5b7bad92354a0104c9f9756e8a5fb0cb98
Instruction Fuzzy Hash: FB51F6B2904340EBD320DF74CC85AEBB3E9AFC8710F044A1DF59986181EB75D648D792

Function 00F396C0 Relevance: 19.6, APIs: 3, Strings: 8, Instructions: 313
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTimeZoneInformation.KERNELBASE(?,8F2D4ADD), ref: 00F39708
_memset.LIBCMT ref: 00F39832
GetLocaleInfoW.KERNEL32(00000400,00001002,?,00000104,?,?,?), ref: 00F39851

Strings

exeNumber, xrefs: 00F3998A
%02d:%02d, xrefs: 00F397D8
GMT, xrefs: 00F39714
Timezone, xrefs: 00F3991A
Pageid, xrefs: 00F399E1
Result_Run_Installer, xrefs: 00F39A40
Web_Installer, xrefs: 00F39A67
Country, xrefs: 00F398BE

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: InfoInformationLocaleTimeZone_memset
String ID: %02d:%02d$Country$GMT$Pageid$Result_Run_Installer$Timezone$Web_Installer$exeNumber
API String ID: 3153034172-1566158848
Opcode ID: 8c1b5129e4c7847fa0f7b419256d8b3bcba59fcc9c102b0ed4aa1b534486a12c
Instruction ID: dc7b574b743463c4182185c27499a67671b24588414b44946fd9b53bb24af9ba
Opcode Fuzzy Hash: 8c1b5129e4c7847fa0f7b419256d8b3bcba59fcc9c102b0ed4aa1b534486a12c
Instruction Fuzzy Hash: 6EC1AE716083809FD725DF69C842B9BB7E9AFC5700F448A1EF5C987241DBB895448B93

Function 00F96A40 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 84
timethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocalTime.KERNEL32(?,00000000,74DF2EE0,00F1553E,Install recomand return=%ld,?), ref: 00F96A71
_memset.LIBCMT ref: 00F96A83
GetCurrentThreadId.KERNEL32 ref: 00F96AA3
__snprintf.LIBCMT ref: 00F96AB6
_vswprintf_s.LIBCMT ref: 00F96AD7

Part of subcall function 00FE7971: __vsnprintf_l.LIBCMT ref: 00FE7984

OutputDebugStringA.KERNELBASE(?), ref: 00F96B06

Strings

EasyLog.log, xrefs: 00F96B11
ab+, xrefs: 00F96B0C
[%d]-%02d:%02d:%02d:%03d , xrefs: 00F96AAA

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CurrentDebugLocalOutputStringThreadTime__snprintf__vsnprintf_l_memset_vswprintf_s
String ID: EasyLog.log$[%d]-%02d:%02d:%02d:%03d $ab+
API String ID: 833957585-2050719945
Opcode ID: c84fb8800c89673931fa83c8ed7f34162f439c44c79ec61f52b9fde59edd3089
Instruction ID: b1bf786454fcdf126457290ad9c0dd00963731db2e4b86fac1f5d9aaa0054eaa
Opcode Fuzzy Hash: c84fb8800c89673931fa83c8ed7f34162f439c44c79ec61f52b9fde59edd3089
Instruction Fuzzy Hash: 9821EEB1908351ABD320EF64CC46EABB7E9AF88704F44891EF588C7242E63DD504D7A2

Function 00F91220 Relevance: 12.8, APIs: 1, Strings: 6, Instructions: 589COMMON

Download Yara Rule

APIs

_realloc.LIBCMT ref: 00F91362

Part of subcall function 00FDB0A2: __lock.LIBCMT ref: 00FDB0C0
Part of subcall function 00FDB0A2: ___sbh_find_block.LIBCMT ref: 00FDB0CB
Part of subcall function 00FDB0A2: ___sbh_free_block.LIBCMT ref: 00FDB0DA
Part of subcall function 00FDB0A2: RtlFreeHeap.NTDLL(00000000,?,01028420,0000000C,00FE4923,00000000,01028990,0000000C,00FE495D,?,?,?,00FEF11D,00000004,01028BE0,0000000C), ref: 00FDB10A
Part of subcall function 00FDB0A2: GetLastError.KERNEL32(?,00FEF11D,00000004,01028BE0,0000000C,00FE429F,?,?,00000000,00000000,00000000,?,00FE58EA,00000001,00000214), ref: 00FDB11B

Strings

ETLP, xrefs: 00F91629
TADI, xrefs: 00F912D8
SNRt, xrefs: 00F91634
DNEI, xrefs: 00F912DF
IBgC, xrefs: 00F912CD
RDHI, xrefs: 00F912BC

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ErrorFreeHeapLast___sbh_find_block___sbh_free_block__lock_realloc
String ID: DNEI$ETLP$IBgC$RDHI$SNRt$TADI
API String ID: 2678416073-81932513
Opcode ID: 130a164c03d7f2a6435bc0497f7b891b5a217a4b3883105ec8db5811ac951253
Instruction ID: 367db5a4aa6233c07a6aa103235cdc3177c431c496cc3d14d21a16a478af4819
Opcode Fuzzy Hash: 130a164c03d7f2a6435bc0497f7b891b5a217a4b3883105ec8db5811ac951253
Instruction Fuzzy Hash: F232A071A05386DFEF75CF18C8447AA37A0BB85354F18457EE88A8B341D7398949EB82

Function 00F816C0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 288
librarycomloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(?), ref: 00F8170C
GetProcAddress.KERNEL32(00000000,DllGetClassObject), ref: 00F81720
CoCreateInstance.OLE32(?,00000000,00000017,01012444,?), ref: 00F8177C

Strings

UIActiveX, xrefs: 00F81906
showactivex, xrefs: 00F8191A
DllGetClassObject, xrefs: 00F81716

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: AddressCreateInstanceLibraryLoadProc
String ID: DllGetClassObject$UIActiveX$showactivex
API String ID: 3919134875-1617538497
Opcode ID: c3c369e55fe08b2b4ed956905e9dc778cb34cbe3c0a3c367feebce614b69f812
Instruction ID: 3b989601a270e01bee9f91fa90c2329fcea69bef507060adc0e07b1cf2deecce
Opcode Fuzzy Hash: c3c369e55fe08b2b4ed956905e9dc778cb34cbe3c0a3c367feebce614b69f812
Instruction Fuzzy Hash: 4DA136706447019FC310EB68C880E6AB3EAFFCD714F208A5CF199DB264DB76A846CB51

Function 00F701B0 Relevance: 3.3, APIs: 2, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c27cc1bfc2454246e667d5c030095a39f59b54b8897ec5cc143c909d0a3ac4d
Instruction ID: e0b90113956b42380da1653249278c056866693b174a3309a537734191ccac43
Opcode Fuzzy Hash: 8c27cc1bfc2454246e667d5c030095a39f59b54b8897ec5cc143c909d0a3ac4d
Instruction Fuzzy Hash: 46C1F671904345CFDB24CF28C8907DA7BE1AF99314F08855EE98D8B381DB75EA49CB92

Function 00F90320 Relevance: 2.4, APIs: 1, Instructions: 853COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00F90345

Part of subcall function 00FDE798: __FF_MSGBANNER.LIBCMT ref: 00FDE7BB
Part of subcall function 00FDE798: __NMSG_WRITE.LIBCMT ref: 00FDE7C2
Part of subcall function 00FDE798: RtlAllocateHeap.NTDLL(00000000,?), ref: 00FDE80F

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: 68a049cdfc5235ad3caee8b25472a8f4ae20f558964c94ddbac2ec98a6534f74
Instruction ID: 1285a0471917bd32269e28c44269b5ed79870923690250fdfa7935c24aaac565
Opcode Fuzzy Hash: 68a049cdfc5235ad3caee8b25472a8f4ae20f558964c94ddbac2ec98a6534f74
Instruction Fuzzy Hash: A662E131A083918FDB25CF3DC09016AFBE1EFA6314F184A5DE5D58B392DA35D806DB92

Function 00F39B90 Relevance: 51.6, APIs: 13, Strings: 16, Instructions: 800
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00F39CBA
GetTempPathW.KERNEL32(00000104,?,?,?,?,0000000B), ref: 00F39CCE
lstrlenW.KERNEL32(?,?,?,?,?,0000000B), ref: 00F39DAE

Part of subcall function 00F121D0: _memcpy_s.LIBCMT ref: 00F12255

__time64.LIBCMT ref: 00F39C88

Part of subcall function 00FDB986: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,00F163C6,00000000,8F2D4ADD), ref: 00FDB991
Part of subcall function 00FDB986: __aulldiv.LIBCMT ref: 00FDB9B1

__time64.LIBCMT ref: 00F39E92
_memset.LIBCMT ref: 00F39ECD

Part of subcall function 00F1BB00: std::_String_base::_Xlen.LIBCPMT ref: 00F1BB5C
Part of subcall function 00F1BB00: _memcpy_s.LIBCMT ref: 00F1BBB6

lstrlenA.KERNEL32(?,?,?,?,0000000C), ref: 00F39F11
lstrlenA.KERNEL32(00000004,?,?,?,0000000C), ref: 00F39F94

Part of subcall function 00F159E0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00F15A79

FindWindowW.USER32(00000000,-00000004), ref: 00F3A532
IsWindow.USER32(00000000), ref: 00F3A54C
ShowWindow.USER32(00000000,00000005), ref: 00F3A55D
SetForegroundWindow.USER32(00000000), ref: 00F3A564
SetFocus.USER32(00000000), ref: 00F3A56B

Part of subcall function 00F396C0: GetTimeZoneInformation.KERNELBASE(?,8F2D4ADD), ref: 00F39708

Part of subcall function 00F14790: LoadImageW.USER32(00F10000,?,00000001,00000000,00000000,00000050), ref: 00F147B6
Part of subcall function 00F14790: SendMessageW.USER32(?,00000080,00000001,00000000), ref: 00F147CA
Part of subcall function 00F14790: LoadImageW.USER32(00F10000,?,00000001,00000000,00000000,00000050), ref: 00F147EB
Part of subcall function 00F14790: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00F147F9

Part of subcall function 00F34D00: SetTimer.USER32(?,00000014,00000000,00000000), ref: 00F34D18
Part of subcall function 00F34D00: SetTimer.USER32(?,00000015,00000320,00000000), ref: 00F34D27

Strings

TestID, xrefs: 00F3A292
EXENAME, xrefs: 00F3A205
.exe, xrefs: 00F39CDC
downloader.ico, xrefs: 00F3A64B
Install_Language, xrefs: 00F39FCF
exeNumber, xrefs: 00F3A306
GUID, xrefs: 00F3A0F7, 00F3A1B5
INSTALL_TYPE, xrefs: 00F39BE9
skin.zip, xrefs: 00F3A5EA
DATA=1 ||| INSTALL_TYPE=1, xrefs: 00F39E22
PRODUCT_VERSION, xrefs: 00F3A3A1
install.xml, xrefs: 00F3A57D
REFERNUMBER, xrefs: 00F39C5C
installTB.xml, xrefs: 00F3A599
installEBC.xml, xrefs: 00F3A5AC
RECOMMEND_URL, xrefs: 00F39C2D

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Window$Timelstrlen$ImageLoadMessageSendTimer__time64_memcpy_s_memset$FileFindFocusForegroundInformationIos_base_dtorPathShowString_base::_SystemTempXlenZone__aulldivstd::_std::ios_base::_
String ID: DATA=1 ||| INSTALL_TYPE=1$.exe$EXENAME$GUID$INSTALL_TYPE$Install_Language$PRODUCT_VERSION$RECOMMEND_URL$REFERNUMBER$TestID$downloader.ico$exeNumber$install.xml$installEBC.xml$installTB.xml$skin.zip
API String ID: 1361978398-1569736989
Opcode ID: 336cbae43340339750b8e8b88887fa9d710c76da6a263c55dc67d8b2fb943872
Instruction ID: 0ef9c696e8c0778ff1e51348ca321a617066b6281f3fd1f941c26c9d11283ea8
Opcode Fuzzy Hash: 336cbae43340339750b8e8b88887fa9d710c76da6a263c55dc67d8b2fb943872
Instruction Fuzzy Hash: 755229728102889BCF34FF74CC56ADE3769AF44310F540129FD095B252EF79AA85EB92

Function 00F486A0 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 239
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(0066EAA0,80000000,00000001,00000000,00000003,00000080,00000000,0066EAA0,000000FF,8F2D4ADD,?,?,?,?), ref: 00F48762
_wcsncpy.LIBCMT ref: 00F4877A
GetFileSize.KERNEL32(00000000,00000000,?,?,?), ref: 00F487B7
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,?), ref: 00F487FA
CloseHandle.KERNEL32(00000000), ref: 00F48801

Part of subcall function 00F49FD0: _malloc.LIBCMT ref: 00F4A01D

_wcsncpy.LIBCMT ref: 00F48790

Part of subcall function 00FDB0A2: __lock.LIBCMT ref: 00FDB0C0
Part of subcall function 00FDB0A2: ___sbh_find_block.LIBCMT ref: 00FDB0CB
Part of subcall function 00FDB0A2: ___sbh_free_block.LIBCMT ref: 00FDB0DA
Part of subcall function 00FDB0A2: RtlFreeHeap.NTDLL(00000000,?,01028420,0000000C,00FE4923,00000000,01028990,0000000C,00FE495D,?,?,?,00FEF11D,00000004,01028BE0,0000000C), ref: 00FDB10A
Part of subcall function 00FDB0A2: GetLastError.KERNEL32(?,00FEF11D,00000004,01028BE0,0000000C,00FE429F,?,?,00000000,00000000,00000000,?,00FE58EA,00000001,00000214), ref: 00FDB11B

Strings

Error opening file, xrefs: 00F48771
Could not unzip file, xrefs: 00F48916
File is empty, xrefs: 00F487C5, 00F488B4
File too large, xrefs: 00F487D6, 00F488C7
Could not find ziped file, xrefs: 00F48897
Could not read file, xrefs: 00F4881F
Error opening zip file, xrefs: 00F48870

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: File$_wcsncpy$CloseCreateErrorFreeHandleHeapLastReadSize___sbh_find_block___sbh_free_block__lock_malloc
String ID: Could not find ziped file$Could not read file$Could not unzip file$Error opening file$Error opening zip file$File is empty$File too large
API String ID: 274506145-2950584456
Opcode ID: 692709a26925ce0e5b4f59e88d603969900b4278965a3c8856519b2e4ba0e0a4
Instruction ID: 6ea50f692c6da164ec0f29ed7d369602095f7859c1ed39c38d56b085898ee2d8
Opcode Fuzzy Hash: 692709a26925ce0e5b4f59e88d603969900b4278965a3c8856519b2e4ba0e0a4
Instruction Fuzzy Hash: 4C716EB1E04304ABD620AB20DC86F2F7B9DAB44750F14492AFD45A7281EF7DE905A793

Function 00F4ADB0 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 269
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F4ABA0: _memset.LIBCMT ref: 00F4ABE8

_memset.LIBCMT ref: 00F4AFEE
_memset.LIBCMT ref: 00F4B02C
_memset.LIBCMT ref: 00F4B06A

Part of subcall function 00F4AC00: _memset.LIBCMT ref: 00F4AC6C
Part of subcall function 00F4AC00: _memset.LIBCMT ref: 00F4ACA7
Part of subcall function 00F4AC00: _memset.LIBCMT ref: 00F4ACE2
Part of subcall function 00F4AC00: _memset.LIBCMT ref: 00F4AD1D

_memset.LIBCMT ref: 00F4B0E7
GetStockObject.GDI32(00000011), ref: 00F4B0F8
GetObjectW.GDI32(00000000), ref: 00F4B0FF
CreateFontIndirectW.GDI32 ref: 00F4B10F

Part of subcall function 00F4A110: _wcsncpy.LIBCMT ref: 00F4A1A1

_memset.LIBCMT ref: 00F4B16B
CreatePen.GDI32(00000000,00000001,000000DC), ref: 00F4B1BA
#17.COMCTL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,8F2D4ADD,?), ref: 00F4B1C5
LoadLibraryW.KERNELBASE(msimg32.dll), ref: 00F4B1D0

Strings

msimg32.dll, xrefs: 00F4B1CB

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _memset$CreateObject$FontIndirectLibraryLoadStock_wcsncpy
String ID: msimg32.dll
API String ID: 3166912299-3287713914
Opcode ID: 7fda5094d5bb219c70c4ed8ac34e719df83fc47ee2d3be02e184677212b77b20
Instruction ID: 214ee97930d8a92f67f5275ba5f4dba0722c08a408fe862b7c31553373c50983
Opcode Fuzzy Hash: 7fda5094d5bb219c70c4ed8ac34e719df83fc47ee2d3be02e184677212b77b20
Instruction Fuzzy Hash: 19D1E1B0A45B82EFD359DF3A8485786FBE8BB49300F80872EE1AC87241D7756164CF95

Function 00F49650 Relevance: 19.6, APIs: 13, Instructions: 85
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindow.USER32(?,00000004), ref: 00F4965E
ShowWindow.USER32(?,00000001), ref: 00F4966C
EnableWindow.USER32(00000000,00000000), ref: 00F4967A
IsWindow.USER32(?), ref: 00F4969E
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 00F496B3
EnableWindow.USER32(00000000,00000001), ref: 00F496D4
SetFocus.USER32(00000000), ref: 00F496D7
TranslateMessage.USER32(?), ref: 00F496F3
DispatchMessageW.USER32(?), ref: 00F496FE
IsWindow.USER32(?), ref: 00F4970F
EnableWindow.USER32(00000000,00000001), ref: 00F4971C
SetFocus.USER32(00000000), ref: 00F4971F
PostQuitMessage.USER32(?), ref: 00F49731

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Window$EnableMessage$Focus$CallbackDispatchDispatcherPostQuitShowTranslateUser
String ID:
API String ID: 802916070-0
Opcode ID: 0499878f2f4c86018d257277bd0da41c03b0a28e2ce17e41e84120d5abb3ac64
Instruction ID: 742eecaeda7d685a8f248a4a589579075d1757ac9838ae2d38020ed8fb10c478
Opcode Fuzzy Hash: 0499878f2f4c86018d257277bd0da41c03b0a28e2ce17e41e84120d5abb3ac64
Instruction Fuzzy Hash: B5317C70A04301AFD720DF64D984B5BBBEAFF48715F404918F599D3241DB7AE914CBA2

Function 00F153E0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 148
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00F153F6
CreateProcessW.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00F15445
GetLastError.KERNEL32 ref: 00F1544F
GetExitCodeProcess.KERNELBASE(?,?), ref: 00F154AF
GetLastError.KERNEL32 ref: 00F154B9

Part of subcall function 00F96A40: GetLocalTime.KERNEL32(?,00000000,74DF2EE0,00F1553E,Install recomand return=%ld,?), ref: 00F96A71
Part of subcall function 00F96A40: _memset.LIBCMT ref: 00F96A83
Part of subcall function 00F96A40: GetCurrentThreadId.KERNEL32 ref: 00F96AA3
Part of subcall function 00F96A40: __snprintf.LIBCMT ref: 00F96AB6
Part of subcall function 00F96A40: _vswprintf_s.LIBCMT ref: 00F96AD7
Part of subcall function 00F96A40: OutputDebugStringA.KERNELBASE(?), ref: 00F96B06

CloseHandle.KERNEL32(?), ref: 00F15516
CloseHandle.KERNEL32(?), ref: 00F1551D

Strings

Install recomand ErrCode=%d, xrefs: 00F15456
Install recomand ErrCode= %ld, xrefs: 00F154C0
Install recomand return=%ld, xrefs: 00F15524
D, xrefs: 00F15408

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CloseErrorHandleLastProcess_memset$CodeCreateCurrentDebugExitLocalOutputStringThreadTime__snprintf_vswprintf_s
String ID: D$Install recomand ErrCode= %ld$Install recomand ErrCode=%d$Install recomand return=%ld
API String ID: 3332992758-3228177572
Opcode ID: adb07f12cd9a97c5a9154f68a7f1530b7a2a186b6ab02410ae93d5b0034499b8
Instruction ID: 50b87330307df46ec09e0289bd2b33af95736dff81768c0efa846e8ed2818249
Opcode Fuzzy Hash: adb07f12cd9a97c5a9154f68a7f1530b7a2a186b6ab02410ae93d5b0034499b8
Instruction Fuzzy Hash: E841BCB19003449BDB00EF69E88199FB7E9EFC8715F00862EF94997200E779D544CF96

Function 00F530D1 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 235COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 00F530D7
__wcsicoll.LIBCMT ref: 00F53117
_memset.LIBCMT ref: 00F533AE

Part of subcall function 00FDB3B2: _malloc.LIBCMT ref: 00FDB3CC

Strings

, xrefs: 00F53179
ListHeaderItem, xrefs: 00F53111
true, xrefs: 00F533E2
ExtendRichEdit, xrefs: 00F53152
VerticalLayout, xrefs: 00F530D1
cover, xrefs: 00F533CB

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __wcsicoll$_malloc_memset
String ID: $ExtendRichEdit$ListHeaderItem$VerticalLayout$cover$true
API String ID: 1497606448-1609732637
Opcode ID: ebb5a1f493729200cd992ba5483f8915ac6c2e02d5e04784b159490c3db15723
Instruction ID: a33b2ff371cb61334e945aa2eafff9eb4e1ae5a24bf19067652db70fc5ca467b
Opcode Fuzzy Hash: ebb5a1f493729200cd992ba5483f8915ac6c2e02d5e04784b159490c3db15723
Instruction Fuzzy Hash: 2081D671A043429FD720DF58CC81B6EB3E5AFD4395F44052DEE8987241EB35DA49EB82

Function 00F44600 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 208
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00F44661
GetPrivateProfileStringA.KERNEL32(?,00000000,00000000,?,00000800,?), ref: 00F446AD
_memset.LIBCMT ref: 00F446D3
_memset.LIBCMT ref: 00F44721
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 00F4476F

Strings

.ini, xrefs: 00F44625

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _memset$PrivateProfileString
String ID: .ini
API String ID: 3423441237-3921635435
Opcode ID: 6a878e89eee7e21a2edb5417194193f501d4e656cc3dde1c8ce53b9b65decfee
Instruction ID: 5294255b1fa80bb99923319ce03131a634a14f068636952b50d5d16d79747c83
Opcode Fuzzy Hash: 6a878e89eee7e21a2edb5417194193f501d4e656cc3dde1c8ce53b9b65decfee
Instruction Fuzzy Hash: 0481C1B15083C49FD330EB64C895BEBBBE8ABC5304F40492EE58997241DB75A948C793

Function 00F6EF00 Relevance: 9.1, APIs: 6, Instructions: 116
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00F70171,80000000,00000001,00000000,00000003,00000080,00000000,00000000,?,00F7076F,?), ref: 00F6EF57
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002,00000000,?,00F7076F,?), ref: 00F6EF84
GetCurrentProcess.KERNEL32(00F70171,00000000), ref: 00F6EF88
DuplicateHandle.KERNEL32(00000000), ref: 00F6EF8B
GetFileType.KERNELBASE(00000000), ref: 00F6EFA9

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CurrentFileProcess$CreateDuplicateHandleType
String ID:
API String ID: 3926963402-0
Opcode ID: f6acc2ded0469e23249254e639f69b363d1e1ef7dea96697b4b795771899f416
Instruction ID: 99d34790f8b65017512ef8f83980f7f4daad54d3d631ae0a2872e72e21cb59a5
Opcode Fuzzy Hash: f6acc2ded0469e23249254e639f69b363d1e1ef7dea96697b4b795771899f416
Instruction Fuzzy Hash: A0318076B453009FE731CF28DC44B5BBBE5EB45320F24890EF59587680D7B6A844DB51

Function 00F87AA0 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 109
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F6B250: _memset.LIBCMT ref: 00F6B264
Part of subcall function 00F6B250: GetObjectW.GDI32(00000000,0000005C,?), ref: 00F6B28C
Part of subcall function 00F6B250: GetDeviceCaps.GDI32(?,0000005A), ref: 00F6B2CE

_memset.LIBCMT ref: 00F87ADE
LoadLibraryW.KERNELBASE(msftedit.dll,?,00000000), ref: 00F87B72
GetProcAddress.KERNEL32(00000000,CreateTextServices), ref: 00F87B82

Strings

CreateTextServices, xrefs: 00F87B7C
msftedit.dll, xrefs: 00F87B6D

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _memset$AddressCapsDeviceLibraryLoadObjectProc
String ID: CreateTextServices$msftedit.dll
API String ID: 4046179195-260715840
Opcode ID: e416b27b575170ca3206d99d917eda758f2146a8174a031d55ab0d961ffaf1c5
Instruction ID: b29bda03c8186a1ec8dff6ce571a1c380e705440ce7b46c676d5b6c84a3ede3f
Opcode Fuzzy Hash: e416b27b575170ca3206d99d917eda758f2146a8174a031d55ab0d961ffaf1c5
Instruction Fuzzy Hash: B641E0716043018FD714EF69C884B87BBEAFFC4310F148568E948CB25ADB75E955CBA0

Function 00F74190 Relevance: 7.6, APIs: 5, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F4A110: _wcsncpy.LIBCMT ref: 00F4A1A1

Part of subcall function 00F51500: _wcschr.LIBCMT ref: 00F5150B
Part of subcall function 00F51500: _wcschr.LIBCMT ref: 00F515EB

SetBkMode.GDI32(?,00000001), ref: 00F74205
SetTextColor.GDI32(?), ref: 00F74228

Part of subcall function 00F503B0: __itow.LIBCMT ref: 00F503EF

SelectObject.GDI32(?,00000000), ref: 00F74246
DrawTextW.USER32(?,?,000000FF,?,?), ref: 00F74260
SelectObject.GDI32(?,00000000), ref: 00F74268

Part of subcall function 00FDB0A2: __lock.LIBCMT ref: 00FDB0C0
Part of subcall function 00FDB0A2: ___sbh_find_block.LIBCMT ref: 00FDB0CB
Part of subcall function 00FDB0A2: ___sbh_free_block.LIBCMT ref: 00FDB0DA
Part of subcall function 00FDB0A2: RtlFreeHeap.NTDLL(00000000,?,01028420,0000000C,00FE4923,00000000,01028990,0000000C,00FE495D,?,?,?,00FEF11D,00000004,01028BE0,0000000C), ref: 00FDB10A
Part of subcall function 00FDB0A2: GetLastError.KERNEL32(?,00FEF11D,00000004,01028BE0,0000000C,00FE429F,?,?,00000000,00000000,00000000,?,00FE58EA,00000001,00000214), ref: 00FDB11B

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ObjectSelectText_wcschr$ColorDrawErrorFreeHeapLastMode___sbh_find_block___sbh_free_block__itow__lock_wcsncpy
String ID:
API String ID: 151897381-0
Opcode ID: e77b6e3bef98126c6333a02f2a7aa46e6c7e72b10a92381bf310b64cb6727223
Instruction ID: 65c9365eb0b45f6e97bd6d3f2b7e20c971323081d9f1450cee71b33906a2f7a1
Opcode Fuzzy Hash: e77b6e3bef98126c6333a02f2a7aa46e6c7e72b10a92381bf310b64cb6727223
Instruction Fuzzy Hash: FC216D716043149FD764DB25CC85B6BB7E9FBC8311F044A1DF99A93382DB39A805CB62

Function 00FDB0A2 Relevance: 7.5, APIs: 5, Instructions: 44memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00FDB0C0

Part of subcall function 00FE4942: __mtinitlocknum.LIBCMT ref: 00FE4958
Part of subcall function 00FE4942: __amsg_exit.LIBCMT ref: 00FE4964
Part of subcall function 00FE4942: EnterCriticalSection.KERNEL32(?,?,?,00FEF11D,00000004,01028BE0,0000000C,00FE429F,?,?,00000000,00000000,00000000,?,00FE58EA,00000001), ref: 00FE496C

___sbh_find_block.LIBCMT ref: 00FDB0CB
___sbh_free_block.LIBCMT ref: 00FDB0DA
RtlFreeHeap.NTDLL(00000000,?,01028420,0000000C,00FE4923,00000000,01028990,0000000C,00FE495D,?,?,?,00FEF11D,00000004,01028BE0,0000000C), ref: 00FDB10A
GetLastError.KERNEL32(?,00FEF11D,00000004,01028BE0,0000000C,00FE429F,?,?,00000000,00000000,00000000,?,00FE58EA,00000001,00000214), ref: 00FDB11B

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CriticalEnterErrorFreeHeapLastSection___sbh_find_block___sbh_free_block__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2714421763-0
Opcode ID: f25ec2bf684515e0d77289372b2f516ee1298b3c952146a1506a7250fd2f5da1
Instruction ID: 9cf4569987c8acbf7bb2ab18a456df9e899d517a928a95ed85009948b87aef89
Opcode Fuzzy Hash: f25ec2bf684515e0d77289372b2f516ee1298b3c952146a1506a7250fd2f5da1
Instruction Fuzzy Hash: 52018631D05316FADF31AF72AC1AB5E3BA5AF00771F15411AF440A6282DF7E9980BB54

Function 00F889B0 Relevance: 6.3, APIs: 4, Instructions: 274windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 00F88B51
GetCaretPos.USER32(?), ref: 00F88B74
IntersectRect.USER32(?,?,?), ref: 00F88BC9
IntersectRect.USER32(?,?,?), ref: 00F88C35

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: IntersectRect$CaretFocus
String ID:
API String ID: 3821461340-0
Opcode ID: 5c737c433677e8d587d5d2b575b219ce637cb68c36a2379e45ee2122d616b8a2
Instruction ID: 4809b4436490db0631bc129fb1f8ca2ece8136fba17732bbf6c49427fc3e8b30
Opcode Fuzzy Hash: 5c737c433677e8d587d5d2b575b219ce637cb68c36a2379e45ee2122d616b8a2
Instruction Fuzzy Hash: A0A1BE31B056019FD728DF18C880AAAF7E5BF89364F54465AE998C7381CB31EC52CB91

Function 00FDC3EC Relevance: 6.1, APIs: 4, Instructions: 137COMMONLIBRARYCODE

Download Yara Rule

APIs

__flush.LIBCMT ref: 00FDC4B0
__fileno.LIBCMT ref: 00FDC4D0
__locking.LIBCMT ref: 00FDC4D7
__flsbuf.LIBCMT ref: 00FDC502

Part of subcall function 00FE0A22: __getptd_noexit.LIBCMT ref: 00FE0A22

Part of subcall function 00FDB267: __decode_pointer.LIBCMT ref: 00FDB272

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: 3eeadf69eb4e18bd64e6abb00a3158512462f3aafd96295394ad5cbc7d378198
Instruction ID: 265d1c594af9428f84c2b9e51ceb355d094b0ea90906f463b645ac5038958a59
Opcode Fuzzy Hash: 3eeadf69eb4e18bd64e6abb00a3158512462f3aafd96295394ad5cbc7d378198
Instruction Fuzzy Hash: F141E431E006069BDF24DF6998946AEB7B7EF81330F2C822AE41697340D774ED41EB80

Function 00F6F2A0 Relevance: 6.1, APIs: 4, Instructions: 134COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000000,00000000,00000002,00000000,?,00000000,00F7076F,?), ref: 00F6F2BB
SetFilePointer.KERNELBASE(?,00000000,00000000,00000001,?,00000000,?,00000000,00F7076F,?), ref: 00F6F2D7
_malloc.LIBCMT ref: 00F6F328
SetFilePointer.KERNELBASE(?,?,00000000,00000000,?,?,00000000,?,00000000,00F7076F,?), ref: 00F6F3AE

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: FilePointer$_malloc
String ID:
API String ID: 3040784002-0
Opcode ID: fa790710b0a9f34389f0090717ab300ae00b455aa13ae3dee9452630f104f009
Instruction ID: 80eb115bd3a3bf2e71c6f8992ed4bb604349e12394ae6d3f33ea6a4d9fdf22c0
Opcode Fuzzy Hash: fa790710b0a9f34389f0090717ab300ae00b455aa13ae3dee9452630f104f009
Instruction Fuzzy Hash: 6E4106B1E08742ABE720DF28E88672ABBD1EF40364F54453EE54587782D375E89CE781

Function 00F14790 Relevance: 6.0, APIs: 4, Instructions: 49windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00F10000,?,00000001,00000000,00000000,00000050), ref: 00F147B6
SendMessageW.USER32(?,00000080,00000001,00000000), ref: 00F147CA
LoadImageW.USER32(00F10000,?,00000001,00000000,00000000,00000050), ref: 00F147EB
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00F147F9

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ImageLoadMessageSend
String ID:
API String ID: 2779929661-0
Opcode ID: baaa1e42847b354c8e8631edf3cce3b6c307299e9d81c410d5489d78264264fb
Instruction ID: 0ef240cc379c055e8030aa97d37b561b020f8bec0d79b18c6918cfc34b54a437
Opcode Fuzzy Hash: baaa1e42847b354c8e8631edf3cce3b6c307299e9d81c410d5489d78264264fb
Instruction Fuzzy Hash: 6901DA75294305BBE624DB54DC81F5B73EDAB88B05F108919F385AA1C0C6B5F894CB29

Function 00FDB3B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00FDB3CC

Part of subcall function 00FDE798: __FF_MSGBANNER.LIBCMT ref: 00FDE7BB
Part of subcall function 00FDE798: __NMSG_WRITE.LIBCMT ref: 00FDE7C2
Part of subcall function 00FDE798: RtlAllocateHeap.NTDLL(00000000,?), ref: 00FDE80F

std::bad_alloc::bad_alloc.LIBCMT ref: 00FDB3EF

Part of subcall function 00FDB397: std::exception::exception.LIBCMT ref: 00FDB3A3

Strings

P5s, xrefs: 00FDB410

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: AllocateHeap_mallocstd::bad_alloc::bad_allocstd::exception::exception
String ID: P5s
API String ID: 3447465555-4100073701
Opcode ID: c8e40cb13d9861cd06aa828ef80250db33e21a0ff3dd172c0b2e70531847fc2c
Instruction ID: 15ae3e003b17a25018c2a4503e1a18c7a04b61f96c9dbdd3730fcec768b10d83
Opcode Fuzzy Hash: c8e40cb13d9861cd06aa828ef80250db33e21a0ff3dd172c0b2e70531847fc2c
Instruction Fuzzy Hash: 3FF0E271800309BADF14BBA2EC16A5D3B9E8F40324B19412AFC5099295DF6ADA40BA40

Function 00F6F420 Relevance: 4.7, APIs: 3, Instructions: 164COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,00000000,00000000,?,00000000,00F7076F,?), ref: 00F6F478

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 90d627a3eaa3118e7f044141c77663945f7cf56ac1cefc74ed25c8b8899f8fac
Instruction ID: af4c0914dcc823c92eea51658981f33a2ea3f90bae222198e149cbeaf6be433a
Opcode Fuzzy Hash: 90d627a3eaa3118e7f044141c77663945f7cf56ac1cefc74ed25c8b8899f8fac
Instruction Fuzzy Hash: DD51E2B2A046004BE320DE29FC4071BB7E5AB85334F180739E965832D2EB39DD0ED392

Function 00F446E9 Relevance: 4.6, APIs: 3, Instructions: 150COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F44721
GetPrivateProfileStringA.KERNEL32(?,?,00000000,?,00000104,?), ref: 00F4476F
_memset.LIBCMT ref: 00F448A5

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _memset$PrivateProfileString
String ID:
API String ID: 3423441237-0
Opcode ID: 92dfca6963ce741ffa369cce6c09b4ee1e3278703f779c9bbbaab303d391b1e1
Instruction ID: cab0b99192ab85b8afab5a157300703f447d41329fd15b26745b673ee64e6adf
Opcode Fuzzy Hash: 92dfca6963ce741ffa369cce6c09b4ee1e3278703f779c9bbbaab303d391b1e1
Instruction Fuzzy Hash: E451D0B15083C09BD321EB64C891BEFBBE9AFC5304F44092EE5C957201EB75A549C7A3

Function 00F80160 Relevance: 4.6, APIs: 3, Instructions: 117comCOMMON

Download Yara Rule

APIs

OleLockRunning.OLE32(?,00000001,00000000), ref: 00F80197
OffsetRect.USER32(?,?,?), ref: 00F80274
KiUserCallbackDispatcher.NTDLL(?,?,?), ref: 00F8028A

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CallbackDispatcherLockOffsetRectRunningUser
String ID:
API String ID: 147883647-0
Opcode ID: 6087db921a9a02bd419dc0b43c7b2750506c1462450480996400156cc3d0eeeb
Instruction ID: 2bb2f52875e860b278fe2062994f62c5fa7371dae08a97ce9db98d2c8a379e37
Opcode Fuzzy Hash: 6087db921a9a02bd419dc0b43c7b2750506c1462450480996400156cc3d0eeeb
Instruction Fuzzy Hash: 6F419F756046029FD710DF28D888EA6B7F8FF89310F0482A9E8488B751DB31FC59CBA1

Function 00F1A6A0 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 166COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 00F1A718

Part of subcall function 00FE274B: RaiseException.KERNEL32(?,?,00FDB416,?,?,?,?,?,00FDB416,?,01028E28,010368F0,?,00F12B84,00000000,8F2D4ADD), ref: 00FE278D

Strings

map/set<T> too long, xrefs: 00F1A6D5

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow
String ID: map/set<T> too long
API String ID: 3976011213-1285458680
Opcode ID: 1ef6189a56d18d9ca2fe6d6b562d1979f4bc3a61cf207267492949be5129668a
Instruction ID: d3cb316ecc8cb9c940ff81a88ee077d476d8f1888615bea4ae857081c99b3ed3
Opcode Fuzzy Hash: 1ef6189a56d18d9ca2fe6d6b562d1979f4bc3a61cf207267492949be5129668a
Instruction Fuzzy Hash: 7B713475906641DFC321DF14C184A92FBF1BB59720F69828DE4894B392D735EC82DBD2

Function 00F47880 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 00F478F8

Part of subcall function 00FE274B: RaiseException.KERNEL32(?,?,00FDB416,?,?,?,?,?,00FDB416,?,01028E28,010368F0,?,00F12B84,00000000,8F2D4ADD), ref: 00FE278D

Strings

map/set<T> too long, xrefs: 00F478B5

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow
String ID: map/set<T> too long
API String ID: 3976011213-1285458680
Opcode ID: e2c6860d296d68142b980b8a68670d703d725646d894032fb2d95906453da6cb
Instruction ID: 294bc1784ef1c5b6eb7c817cde67022e9ca6fb12cd176445c5994508f9a5e61e
Opcode Fuzzy Hash: e2c6860d296d68142b980b8a68670d703d725646d894032fb2d95906453da6cb
Instruction Fuzzy Hash: 897123B1A087459FC311EF29C180A16FBE1BF59720F69868DE8894B362C735EC81DF95

Function 00F973B0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 26synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(00000000,00000000,00000000,8F2D4ADD,?,?,00FFD6A8,000000FF), ref: 00F973E9

Strings

@1f, xrefs: 00F973F4

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CreateMutex
String ID: @1f
API String ID: 1964310414-3981940493
Opcode ID: 1b08e160372a20bbc12bf5940e1f1d2a8187339be56eb08875be3912cc7b086c
Instruction ID: 0680bd223842c130dd98debb584dc2ffdcb55dfa8bef84bb039e9f3f124cfa14
Opcode Fuzzy Hash: 1b08e160372a20bbc12bf5940e1f1d2a8187339be56eb08875be3912cc7b086c
Instruction Fuzzy Hash: DDF058B0288B80BBE324CF40DC46B267BE8F784B24F000A59F4858A680C77D9605CB82

Function 00F34960 Relevance: 3.2, APIs: 2, Instructions: 226COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00F34C43
ShowWindow.USER32(?,00000000), ref: 00F34C52

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Window$Show
String ID:
API String ID: 990937876-0
Opcode ID: 84eb2ae627eb9ec20e96ed3b351fa298623225cea932d87e47a99d74902964be
Instruction ID: d4f33eef7c89d4275636cf8f247b4f4670071a5f1a44a54ed3e9f8ac1eb98ac3
Opcode Fuzzy Hash: 84eb2ae627eb9ec20e96ed3b351fa298623225cea932d87e47a99d74902964be
Instruction Fuzzy Hash: 209119B19093819BD720DF24CC41B9BB7E5BF88310F144E2EE699A3241EB38B544DB5B

Function 00F457B0 Relevance: 3.1, APIs: 2, Instructions: 119synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,?,010022F8,000000FF), ref: 00F45836
GetLastError.KERNEL32(?,?,00000008,?,?,?,?,?,?,?,?,?,?,?,010022F8,000000FF), ref: 00F45870

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: 88ba4f2cf2f72f6f7c7f5fc91d252f068116d5664e9e854e075371e9e8da5fbe
Instruction ID: 521d0a0bc868d8b918d1f93444af58a15e9b65fec4fb454d24df4352901dee95
Opcode Fuzzy Hash: 88ba4f2cf2f72f6f7c7f5fc91d252f068116d5664e9e854e075371e9e8da5fbe
Instruction Fuzzy Hash: 02418F769087409FD710EF58C881A1FBBE5BF84B50F054A1DF98597712DB39E804EBA2

Function 00F6FD60 Relevance: 3.1, APIs: 2, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f84f234a6ec292cc929b716a7dd15257868afe0145f97741de08bb267e1b40e
Instruction ID: f58af6c7e20cdbe5b50aa0078feb37a75eaebc2d2af1d6e7878cf03e89a4d005
Opcode Fuzzy Hash: 5f84f234a6ec292cc929b716a7dd15257868afe0145f97741de08bb267e1b40e
Instruction Fuzzy Hash: 3D31BEB59003099FCB14DF29E8C0566BBE4FF88320B54416EED188B34AE735E958DF86

Function 00FDC756 Relevance: 3.0, APIs: 2, Instructions: 39COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FE0A22: __getptd_noexit.LIBCMT ref: 00FE0A22

Part of subcall function 00FDB267: __decode_pointer.LIBCMT ref: 00FDB272

__lock_file.LIBCMT ref: 00FDC7A6

Part of subcall function 00FE01FF: __lock.LIBCMT ref: 00FE0224

__fclose_nolock.LIBCMT ref: 00FDC7B0

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __decode_pointer__fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 717694121-0
Opcode ID: c4e7d6071e5a05d32db3a8cd3a38c5cf05a006af91d312dc4b6f992b38e8d8e6
Instruction ID: 85e5530830b12efe2c1f8300cfda570d79ddea7bfe938c4810ab7fdea50dba26
Opcode Fuzzy Hash: c4e7d6071e5a05d32db3a8cd3a38c5cf05a006af91d312dc4b6f992b38e8d8e6
Instruction Fuzzy Hash: DBF0C271C006469AC721AB3A8C02A5E7AA16F84330F29821AF0789A2D1DF7C4541BF85

Function 00F1F140 Relevance: 3.0, APIs: 2, Instructions: 25COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00F1F15F

Part of subcall function 00FDAE7C: _strlen.LIBCMT ref: 00FDAE96
Part of subcall function 00FDAE7C: _malloc.LIBCMT ref: 00FDAE9F
Part of subcall function 00FDAE7C: _strcpy_s.LIBCMT ref: 00FDAEB1

__CxxThrowException@8.LIBCMT ref: 00F1F176

Part of subcall function 00FE274B: RaiseException.KERNEL32(?,?,00FDB416,?,?,?,?,?,00FDB416,?,01028E28,010368F0,?,00F12B84,00000000,8F2D4ADD), ref: 00FE278D

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow_malloc_strcpy_s_strlenstd::exception::exception
String ID:
API String ID: 3160936874-0
Opcode ID: 40af6a61f8f0492c95b987ab3f2082917673ef5e6ec2fcd488aa72b7a0bb6c4d
Instruction ID: 19e12d4479b99852c98e8c677599a3f362cfc789fcbeb7614b8d6843156e2429
Opcode Fuzzy Hash: 40af6a61f8f0492c95b987ab3f2082917673ef5e6ec2fcd488aa72b7a0bb6c4d
Instruction Fuzzy Hash: 02E09BF190420066D708EB24CC45A5B3797ABD4320F88CF2DF4A941299EB3C91199657

Function 00F481B0 Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00F481CF

Part of subcall function 00FDAE7C: _strlen.LIBCMT ref: 00FDAE96
Part of subcall function 00FDAE7C: _malloc.LIBCMT ref: 00FDAE9F
Part of subcall function 00FDAE7C: _strcpy_s.LIBCMT ref: 00FDAEB1

__CxxThrowException@8.LIBCMT ref: 00F481E6

Part of subcall function 00FE274B: RaiseException.KERNEL32(?,?,00FDB416,?,?,?,?,?,00FDB416,?,01028E28,010368F0,?,00F12B84,00000000,8F2D4ADD), ref: 00FE278D

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow_malloc_strcpy_s_strlenstd::exception::exception
String ID:
API String ID: 3160936874-0
Opcode ID: 3c09fc2d2f183999b07e7d1e4d31311d788774e4ad3ad5473eaeebcacd03b3aa
Instruction ID: 18edf09e13c551e65c56bbd3f7adcc22e738323b90797fcfeec4cedafa37ee06
Opcode Fuzzy Hash: 3c09fc2d2f183999b07e7d1e4d31311d788774e4ad3ad5473eaeebcacd03b3aa
Instruction Fuzzy Hash: 9AE0D8F541420066E704FF24CC45D5F7BAAABD4314F80CF1EF4B941295EB78D2199657

Function 00F12B40 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 00F12B5F

Part of subcall function 00FDAE7C: _strlen.LIBCMT ref: 00FDAE96
Part of subcall function 00FDAE7C: _malloc.LIBCMT ref: 00FDAE9F
Part of subcall function 00FDAE7C: _strcpy_s.LIBCMT ref: 00FDAEB1

__CxxThrowException@8.LIBCMT ref: 00F12B76

Part of subcall function 00FE274B: RaiseException.KERNEL32(?,?,00FDB416,?,?,?,?,?,00FDB416,?,01028E28,010368F0,?,00F12B84,00000000,8F2D4ADD), ref: 00FE278D

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ExceptionException@8RaiseThrow_malloc_strcpy_s_strlenstd::exception::exception
String ID:
API String ID: 3160936874-0
Opcode ID: 244f605a744dee549bf9360bcf1b6814c9e0a2c6de17ec98fdde81654977351f
Instruction ID: 1778308939c9feaede1e72afab972640e287d58e2e05b5bf51a3604280bce985
Opcode Fuzzy Hash: 244f605a744dee549bf9360bcf1b6814c9e0a2c6de17ec98fdde81654977351f
Instruction Fuzzy Hash: B6E0D8F140420066D704FF64CC4595B3BAAABD4310F80CE1EF4B9811D5E73891189A57

Function 00F34D00 Relevance: 3.0, APIs: 2, Instructions: 22timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000014,00000000,00000000), ref: 00F34D18
SetTimer.USER32(?,00000015,00000320,00000000), ref: 00F34D27

Part of subcall function 00F49650: GetWindow.USER32(?,00000004), ref: 00F4965E
Part of subcall function 00F49650: ShowWindow.USER32(?,00000001), ref: 00F4966C
Part of subcall function 00F49650: EnableWindow.USER32(00000000,00000000), ref: 00F4967A
Part of subcall function 00F49650: IsWindow.USER32(?), ref: 00F4969E
Part of subcall function 00F49650: KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 00F496B3
Part of subcall function 00F49650: EnableWindow.USER32(00000000,00000001), ref: 00F496D4
Part of subcall function 00F49650: SetFocus.USER32(00000000), ref: 00F496D7
Part of subcall function 00F49650: TranslateMessage.USER32(?), ref: 00F496F3
Part of subcall function 00F49650: DispatchMessageW.USER32(?), ref: 00F496FE
Part of subcall function 00F49650: IsWindow.USER32(?), ref: 00F4970F
Part of subcall function 00F49650: EnableWindow.USER32(00000000,00000001), ref: 00F4971C
Part of subcall function 00F49650: SetFocus.USER32(00000000), ref: 00F4971F
Part of subcall function 00F49650: PostQuitMessage.USER32(?), ref: 00F49731

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Window$EnableMessage$FocusTimer$CallbackDispatchDispatcherPostQuitShowTranslateUser
String ID:
API String ID: 4004917197-0
Opcode ID: 5b605699ef030c2f3583c191305cfc8086464ee1eaf9605d6d3d8915c2c5af1f
Instruction ID: 9a58ba318f76a54ea4ee32d1524f2d738d692e3acbe6adc216cffd42e59e8b55
Opcode Fuzzy Hash: 5b605699ef030c2f3583c191305cfc8086464ee1eaf9605d6d3d8915c2c5af1f
Instruction Fuzzy Hash: 7AD05E72780B1572E121666CAC02F4AA25E5B88B20F114116B304BF1C58AE9F8019798

Function 00F6F650 Relevance: 1.7, APIs: 1, Instructions: 241COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F6F68F

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 7beb29e7faad6b24f17a27226d1f04ae6ca06af564a2f00c68a8a4b6de5ce203
Instruction ID: f53b2219913ded2354a1335e93fbc7f1469aa5b61a42758386eee30d6e8debfa
Opcode Fuzzy Hash: 7beb29e7faad6b24f17a27226d1f04ae6ca06af564a2f00c68a8a4b6de5ce203
Instruction Fuzzy Hash: 547171B2E043018BD320DA78EC81A1677E59F91374F144B3DF9A5C72E2E765E908D752

Function 00F541C0 Relevance: 1.7, APIs: 1, Instructions: 234COMMON

Download Yara Rule

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 00F54401

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: c375c089ed389576a27ecb1fd5347084a693c0e9011798fba6b2f82a7258acdd
Instruction ID: f92260473239c88a0c7e2bc90443a6e5520601d06a6f1fc4cd924bc523e4b435
Opcode Fuzzy Hash: c375c089ed389576a27ecb1fd5347084a693c0e9011798fba6b2f82a7258acdd
Instruction Fuzzy Hash: C6712A7121424AAFE314CE49C888E7BB7BCFBD8309F24494CB69147261D771BD49EBA1

Function 00F6FB80 Relevance: 1.7, APIs: 1, Instructions: 178COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(B80A74C0,0002A2E9,00000000,00000000,?,?,?,00F702D9,?,?,?,?,?,00000000), ref: 00F6FBB7

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: b3ff1ae4068abf005c5db6826e04257809c6dd153b4ebb1ffa4e29013af9c1fd
Instruction ID: 09229afdb674d00c3f21c7a8a4fbeb1a8c6fa6e9dabd5540bebce007ca99e18d
Opcode Fuzzy Hash: b3ff1ae4068abf005c5db6826e04257809c6dd153b4ebb1ffa4e29013af9c1fd
Instruction Fuzzy Hash: C75174B2D052169BD720CF68F940A26B3A4AF45374F144B39EC61872D2D731ED1CE792

Function 00F6FE70 Relevance: 1.7, APIs: 1, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40e222d8a7e1b9b23c8c5e97565ee86aaa3fec0953f7e8819aba457b320d0acb
Instruction ID: 81ef8849e4289a1102beab5d2b304c0a318b65adb78ae6f4bb2ed06a9d4c696b
Opcode Fuzzy Hash: 40e222d8a7e1b9b23c8c5e97565ee86aaa3fec0953f7e8819aba457b320d0acb
Instruction Fuzzy Hash: 27518776A007018FC730CF29E88061AB7E0FF95325F144A2EE89687B61D776E94CDB91

Function 00F910A0 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00F910BC

Part of subcall function 00FDE798: __FF_MSGBANNER.LIBCMT ref: 00FDE7BB
Part of subcall function 00FDE798: __NMSG_WRITE.LIBCMT ref: 00FDE7C2
Part of subcall function 00FDE798: RtlAllocateHeap.NTDLL(00000000,?), ref: 00FDE80F

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: AllocateHeap_malloc
String ID:
API String ID: 501242067-0
Opcode ID: d60c084cedc967828ddb8997e43d15c50f72619c9e83109321c40d255bc386fd
Instruction ID: 845dbb1ec9d7e8d4c78781214ac43489bd098f83c07e420b6b2e00325c513512
Opcode Fuzzy Hash: d60c084cedc967828ddb8997e43d15c50f72619c9e83109321c40d255bc386fd
Instruction Fuzzy Hash: 7021466910C3D54FD7268B698880436FFE69EEA304B0DC4EEE4D54B353D12BE94AE721

Function 00F6F357 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,00000000,00000000,?,?,00000000,?,00000000,00F7076F,?), ref: 00F6F3AE

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: d71fb8e3c406b09cd67c11c991636e3e46447a086bf10e4313607ff6d079df2f
Instruction ID: fe2a0d3a2fa8ce34ad25a91c466c4fc6fadece176108b3f94160cf716eae4146
Opcode Fuzzy Hash: d71fb8e3c406b09cd67c11c991636e3e46447a086bf10e4313607ff6d079df2f
Instruction Fuzzy Hash: 3C21F0B1A087429BE720DF18E88271ABB91EB50364F14443EE685C7353D375D99C9386

Function 00F6F355 Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,00000000,00000000,?,?,00000000,?,00000000,00F7076F,?), ref: 00F6F3AE

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: b39551bb66a390fba696d74984b60caa8889c0b27e153d58737e16255e509069
Instruction ID: f0a790231f168f2b7be7f6a8d4235c06b7661b030413dcfe098b0360fd223d0f
Opcode Fuzzy Hash: b39551bb66a390fba696d74984b60caa8889c0b27e153d58737e16255e509069
Instruction Fuzzy Hash: 1A2121B1E087429BE720DF28E88271ABB91EB50364F14443EE681C7393D335D98CE386

Function 00F49580 Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,00000000), ref: 00F495F1

Part of subcall function 00F499A0: _memset.LIBCMT ref: 00F499AE
Part of subcall function 00F499A0: GetClassInfoExW.USER32(00000000,00000000), ref: 00F499D5
Part of subcall function 00F499A0: GetClassInfoExW.USER32(00F10000,00000000), ref: 00F499F1

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ClassInfo$CreateWindow_memset
String ID:
API String ID: 834990534-0
Opcode ID: db06c7c3f9a1c9aaf7f5398efa2a3d639dcfa13ed76b093cf6f9713724911fc9
Instruction ID: 395225b11f6c1dcecfa18d82962cf053a8527975c1c164363ca6b59790087693
Opcode Fuzzy Hash: db06c7c3f9a1c9aaf7f5398efa2a3d639dcfa13ed76b093cf6f9713724911fc9
Instruction Fuzzy Hash: 18112AB13145155F8B14DF9CDC50DAB77E9AF8D310B148249FD48C3381EA66EC11CBA5

Function 00F695B0 Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

GdiplusStartup.GDIPLUS(?,?,00000000,?,00F7AD5A,8F2D4ADD,?,00000000,00FFFC88,000000FF,00F52A03,00000000), ref: 00F696BE

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: GdiplusStartup
String ID:
API String ID: 2503201367-0
Opcode ID: f29a3e46a3e7c5c600a6597dc7c7f17d6a26b95937504215bab4410901dd9cba
Instruction ID: 0f8d15d153e551c6f5be5cc10ecac26dc1bcd7f693dda452cb45f9e5b7cd0317
Opcode Fuzzy Hash: f29a3e46a3e7c5c600a6597dc7c7f17d6a26b95937504215bab4410901dd9cba
Instruction Fuzzy Hash: 96318EB050AB40CED3A1DF3895417A3BBE2AB95314F108A5EE0EE87241EB332175DF11

Function 00F6F040 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(?,00000000,?,?,00000000,00000000,00000404,00F6F3C3,00000404,00000001), ref: 00F6F05F

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 1b1bc06c6a3f976c350cc28026cef802a08a09b01e321fc7a9f1c2035b16379e
Instruction ID: 46057683900b881489d074a2e1257b8a3c5b6fba628dbc567057601647f28516
Opcode Fuzzy Hash: 1b1bc06c6a3f976c350cc28026cef802a08a09b01e321fc7a9f1c2035b16379e
Instruction Fuzzy Hash: 6E0162726082157FE314CE69EC80AA6B7A9FB88314F148569F554C7541D332EC54D7E0

Function 00F126D0 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 00F126DB

Part of subcall function 00FDA04C: __EH_prolog3.LIBCMT ref: 00FDA053
Part of subcall function 00FDA04C: __CxxThrowException@8.LIBCMT ref: 00FDA07E

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Exception@8H_prolog3String_base::_ThrowXlenstd::_
String ID:
API String ID: 1675473389-0
Opcode ID: 9535840bd936af5a078c1e75f24e8041c5dd5d403ce8e2726b897c551c176e81
Instruction ID: 4b4ad3c63f2513c40552cd7c26646f4ce1326bae07bce9ed2ae6b97c4f1735ee
Opcode Fuzzy Hash: 9535840bd936af5a078c1e75f24e8041c5dd5d403ce8e2726b897c551c176e81
Instruction Fuzzy Hash: 12F05E32B145214A9FB9EE79AD418BB32E7EFD4720329CA2DE482CB1C4DD2098C56355

Function 00FDC54E Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 00FDC595

Part of subcall function 00FE0A22: __getptd_noexit.LIBCMT ref: 00FE0A22

Part of subcall function 00FDB267: __decode_pointer.LIBCMT ref: 00FDB272

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 3158947991-0
Opcode ID: b73575392c7a2532d17bf1fbafe19108e067421db34ece378cb27bbff79d5093
Instruction ID: 40334fdb5c612b814b6d88a3aec6c86d2efdfe51e85f289e85ecf8fc94930a8f
Opcode Fuzzy Hash: b73575392c7a2532d17bf1fbafe19108e067421db34ece378cb27bbff79d5093
Instruction Fuzzy Hash: 69F0A471C0021AEBCF22BFB5AC0298E3B62AF04710F088466F4145A251DB398A50FFD1

Function 00FDF89C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

__calloc_impl.LIBCMT ref: 00FDF8AF

Part of subcall function 00FE0A22: __getptd_noexit.LIBCMT ref: 00FE0A22

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __calloc_impl__getptd_noexit
String ID:
API String ID: 1948755799-0
Opcode ID: 94d0ac00552a7d5b6355c5a4d03805b78c6e78311afaf8b3052fbd07bdf09e04
Instruction ID: 5e7291e4ff052a382a24b85b05ab980b858754f71b2ae7fd4b38904af574d494
Opcode Fuzzy Hash: 94d0ac00552a7d5b6355c5a4d03805b78c6e78311afaf8b3052fbd07bdf09e04
Instruction Fuzzy Hash: 5BE06D3190021AFBCF209A91DD01A9D73A99F40360F044076AD01AB201EAB88F08F7A1

Function 00F80E90 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000), ref: 00F80ED0

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 009cbdb2ba07ca43777cd4200f8dc1e066de10e9561ea3e93973d5565479246a
Instruction ID: 7791e6bcbabefb4e05e8e78c30efacc9322c003e48e889f90340dbe839add662
Opcode Fuzzy Hash: 009cbdb2ba07ca43777cd4200f8dc1e066de10e9561ea3e93973d5565479246a
Instruction Fuzzy Hash: 05E06D706002159FD368DA28D584BABB3A2EB94320F414A6DF99687240CA79AC95DB60

Function 00F110B0 Relevance: 1.5, APIs: 1, Instructions: 21COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNELBASE(00000003,00000000,00000004,000000FF,?,?,00000000,00000000,00F185D6,00000003), ref: 00F110CB

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 14413bfee3343e64a8a41d8d1761130c976473f8cde03b5edb344a636c12263c
Instruction ID: bc07e21a0c7f34cabda44874430f3d13aa2ff49b1817a2aacfbd36b15ddcf89f
Opcode Fuzzy Hash: 14413bfee3343e64a8a41d8d1761130c976473f8cde03b5edb344a636c12263c
Instruction Fuzzy Hash: C3D02E72B9822179E63042318C0AF63A5C89BA4F20F20C7147650D61C8EA64E8C0C2B4

Function 00FE4796 Relevance: 1.5, APIs: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000), ref: 00FE47AB

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 19373c9747afcfc07e484c2b5a336ede61e094e41368818ec8d48f6194c0ccf1
Instruction ID: 279c449c7540b61667aa7d98df97e7f715728bdf9fa37861991a531f5cb235ab
Opcode Fuzzy Hash: 19373c9747afcfc07e484c2b5a336ede61e094e41368818ec8d48f6194c0ccf1
Instruction Fuzzy Hash: 60D05E729603486EDB219FB668087623BDCD384395F048439B84CC6144FA7AD950DB40

Function 00FDCF4E Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

__waccess_s.LIBCMT ref: 00FDCF59

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __waccess_s
String ID:
API String ID: 4272103461-0
Opcode ID: 121c4f77d4c72d3789264fc0d0d617dc9724d87233f222cead199be475d85574
Instruction ID: 2413c95b14b51669e985ff0dfda046dde548fe6ef99dee383802bc29f5e9262d
Opcode Fuzzy Hash: 121c4f77d4c72d3789264fc0d0d617dc9724d87233f222cead199be475d85574
Instruction Fuzzy Hash: 9CC09B7305410D7F9F055DE5EC01C593F5AD7C07707144116F91C89591DD32D551A5C0

Function 00FDD02A Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 00FDD037

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: b5f1e3f8c0985568a2b975540194b91a49099896255c8aa19d8b1f82aed34cac
Instruction ID: ee37ed7445ac277533e259abdbe4ffcffa0475b608ffaf76e59330ece9888de6
Opcode Fuzzy Hash: b5f1e3f8c0985568a2b975540194b91a49099896255c8aa19d8b1f82aed34cac
Instruction Fuzzy Hash: 44C09B7344010C77CF111A82DC02E453F1F97C0760F044011FB1C191619577DA61D5D9

Function 00F6E9F0 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

_calloc.LIBCMT ref: 00F6E9FA

Part of subcall function 00FDF89A: __calloc_impl.LIBCMT ref: 00FDF8AF

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __calloc_impl_calloc
String ID:
API String ID: 2108883976-0
Opcode ID: 4e2182e4b423de67d637deb6ccc7b446b136eacaa7299d7c5a54af367c121ca9
Instruction ID: 6587b82a4c8c71f1511dd359bdc047d4c790b5dd60db9e84a69b62dc0c1af91f
Opcode Fuzzy Hash: 4e2182e4b423de67d637deb6ccc7b446b136eacaa7299d7c5a54af367c121ca9
Instruction Fuzzy Hash: F9B012B95042007FC508E710DC41C2BB39AEFC4201F848D1DBC4946300E539DC08D623

Non-executed Functions

Function 00FEAFA9 Relevance: 66.4, APIs: 44, Instructions: 432COMMONLIBRARYCODE

Download Yara Rule

APIs

___getlocaleinfo.LIBCMT ref: 00FEAFE0
___getlocaleinfo.LIBCMT ref: 00FEAFF5
___getlocaleinfo.LIBCMT ref: 00FEB00A
___getlocaleinfo.LIBCMT ref: 00FEB01F
___getlocaleinfo.LIBCMT ref: 00FEB037
___getlocaleinfo.LIBCMT ref: 00FEB04C
___getlocaleinfo.LIBCMT ref: 00FEB05E
___getlocaleinfo.LIBCMT ref: 00FEB073
___getlocaleinfo.LIBCMT ref: 00FEB08B
___getlocaleinfo.LIBCMT ref: 00FEB0A0

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ___getlocaleinfo
String ID:
API String ID: 1937885557-0
Opcode ID: 77f6aa72a95c27c4c9a4d89ad5578ec5411739d8a9a1ef6ddc25b9ae69f14d63
Instruction ID: aae54744e9a39159708f35c46af409e6b10debbfd64947526eaa98c3b559759d
Opcode Fuzzy Hash: 77f6aa72a95c27c4c9a4d89ad5578ec5411739d8a9a1ef6ddc25b9ae69f14d63
Instruction Fuzzy Hash: 35E1F3B290025DBEFF12DAE1CC41DFF7BBDEB44788F04052BB255D6041EA74AA05AB60

Function 00FBA1D0 Relevance: 53.1, APIs: 17, Strings: 13, Instructions: 554networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FBA20F
__wcstoui64.LIBCMT ref: 00FBA2CC
__wcstoui64.LIBCMT ref: 00FBA2F8
getsockname.WS2_32(?,?,?), ref: 00FBA383
WSAGetLastError.WS2_32 ref: 00FBA391
_strncpy.LIBCMT ref: 00FBA3DA
WSAGetLastError.WS2_32 ref: 00FBA4D9
htons.WS2_32(00000000), ref: 00FBA549
bind.WS2_32(?,?,?), ref: 00FBA563
WSAGetLastError.WS2_32 ref: 00FBA571
getsockname.WS2_32 ref: 00FBA5B9
WSAGetLastError.WS2_32 ref: 00FBA5E6
getsockname.WS2_32(?,?,?), ref: 00FBA68F
WSAGetLastError.WS2_32 ref: 00FBA699
listen.WS2_32(?,00000001), ref: 00FBA6D5
WSAGetLastError.WS2_32 ref: 00FBA6DF

Part of subcall function 00FD0610: GetLastError.KERNEL32(?,00000000,00000000,?,00FA8580,00000004,00000000), ref: 00FD0614
Part of subcall function 00FD0610: _strerror.LIBCMT ref: 00FD0649
Part of subcall function 00FD0610: _strncpy.LIBCMT ref: 00FD0653
Part of subcall function 00FD0610: _strrchr.LIBCMT ref: 00FD06AB
Part of subcall function 00FD0610: _strrchr.LIBCMT ref: 00FD06C6
Part of subcall function 00FD0610: GetLastError.KERNEL32 ref: 00FD06EE
Part of subcall function 00FD0610: SetLastError.KERNEL32(?), ref: 00FD06FD

htons.WS2_32(?), ref: 00FBA746

Strings

PORT, xrefs: 00FBA864
Failure sending EPRT command: %s, xrefs: 00FBA7F0
bind(port=%hu) failed: %s, xrefs: 00FBA627
EPRT, xrefs: 00FBA7CC
bind(port=%hu) on non-local address failed: %s, xrefs: 00FBA592
,%d,%d, xrefs: 00FBA84C
%s %s, xrefs: 00FBA86F
bind() failed, we ran out of ports!, xrefs: 00FBA655
%s |%d|%s|%hu|, xrefs: 00FBA7D1
Failure sending PORT command: %s, xrefs: 00FBA892
getsockname() failed: %s, xrefs: 00FBA3A3, 00FBA5F4, 00FBA6A7
failed to resolve the address provided to PORT: %s, xrefs: 00FBA483
socket failure: %s, xrefs: 00FBA4F6, 00FBA6ED

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ErrorLast$getsockname$__wcstoui64_strncpy_strrchrhtons$_memset_strerrorbindlisten
String ID: %s %s$%s |%d|%s|%hu|$,%d,%d$EPRT$Failure sending EPRT command: %s$Failure sending PORT command: %s$PORT$bind() failed, we ran out of ports!$bind(port=%hu) failed: %s$bind(port=%hu) on non-local address failed: %s$failed to resolve the address provided to PORT: %s$getsockname() failed: %s$socket failure: %s
API String ID: 2164481949-2383553807
Opcode ID: 912339c55cfbd1336a6140608413ed3cc255d78dbf3a6c2f7d25183cf9dd338a
Instruction ID: f38df58e13214feda6975bcf566a4f58ca4d0ec3cfb2ab69da8ddc19bbd0a552
Opcode Fuzzy Hash: 912339c55cfbd1336a6140608413ed3cc255d78dbf3a6c2f7d25183cf9dd338a
Instruction Fuzzy Hash: 2802D4B1904341ABD321AF66CC45FBB73E9EF85304F04491DF48587242EB7AD905ABA3

Function 00F15090 Relevance: 44.0, APIs: 13, Strings: 12, Instructions: 264encryptionfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,8F2D4ADD,?,?,00000000), ref: 00F150FB
CloseHandle.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00FFE068), ref: 00F15116
CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000,?,00000000), ref: 00F1515A
CryptCreateHash.ADVAPI32(?,00008003,00000000,00000000,?,?,00000000), ref: 00F15186
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,00000000), ref: 00F1520F
CryptHashData.ADVAPI32(?,00000000,?,00000000), ref: 00F15233
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F15254
CryptGetHashParam.ADVAPI32 ref: 00F15278
CryptGetHashParam.ADVAPI32 ref: 00F152EA
_sprintf.LIBCMT ref: 00F1530F
CryptDestroyHash.ADVAPI32(?,00000000,00000000), ref: 00F1534D
CryptReleaseContext.ADVAPI32(?,00000000), ref: 00F1536B
GetFileSize.KERNEL32(00000000,00000000,?,00000000), ref: 00F1519F

Part of subcall function 00F96A40: GetLocalTime.KERNEL32(?,00000000,74DF2EE0,00F1553E,Install recomand return=%ld,?), ref: 00F96A71
Part of subcall function 00F96A40: _memset.LIBCMT ref: 00F96A83
Part of subcall function 00F96A40: GetCurrentThreadId.KERNEL32 ref: 00F96AA3
Part of subcall function 00F96A40: __snprintf.LIBCMT ref: 00F96AB6
Part of subcall function 00F96A40: _vswprintf_s.LIBCMT ref: 00F96AD7
Part of subcall function 00F96A40: OutputDebugStringA.KERNELBASE(?), ref: 00F96B06

Strings

CryptHashData go wrong, xrefs: 00F1523D
CryptDestroyHash go wrong, xrefs: 00F15357
%02x, xrefs: 00F15309
CryptAcquireContext go wrong, xrefs: 00F15164
pbHash allocation failed, xrefs: 00F1529E
CryptReleaseContext go wrong, xrefs: 00F15375
CreateFile go wrong , xrefs: 00F15108
lpReadFileBuffer allocation failed, xrefs: 00F151C8
ReadFile go wrong, xrefs: 00F15219
GetFileSize go wrong, xrefs: 00F151AC
CryptCreateHash go wrong, xrefs: 00F15190
get length wrong, xrefs: 00F1527E

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Crypt$Hash$File$CloseContextCreateHandleParam$AcquireCurrentDataDebugDestroyLocalOutputReadReleaseSizeStringThreadTime__snprintf_memset_sprintf_vswprintf_s
String ID: %02x$CreateFile go wrong $CryptAcquireContext go wrong$CryptCreateHash go wrong$CryptDestroyHash go wrong$CryptHashData go wrong$CryptReleaseContext go wrong$GetFileSize go wrong$ReadFile go wrong$get length wrong$lpReadFileBuffer allocation failed$pbHash allocation failed
API String ID: 1612529147-576794067
Opcode ID: b7010b2e6cc008f521e31a4ce80b81e9beddb891fe638256a729d5b8ae6f2e04
Instruction ID: 66dc9bbf0fd4be082e920c755eab27919ea73719203d870a283189bf32635d20
Opcode Fuzzy Hash: b7010b2e6cc008f521e31a4ce80b81e9beddb891fe638256a729d5b8ae6f2e04
Instruction Fuzzy Hash: B79105B1508300EFE710EF64DC41B6BB7E9AB84B44F04452CF486E7241D779E94497A3

Function 00F26F50 Relevance: 39.1, APIs: 3, Strings: 19, Instructions: 625COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00F26F9C

Part of subcall function 00FDB986: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,00F163C6,00000000,8F2D4ADD), ref: 00FDB991
Part of subcall function 00FDB986: __aulldiv.LIBCMT ref: 00FDB9B1

Part of subcall function 00F159E0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00F15A79

Part of subcall function 00F12580: _memcpy_s.LIBCMT ref: 00F125FD

Part of subcall function 00F121D0: _memcpy_s.LIBCMT ref: 00F12255

_memset.LIBCMT ref: 00F27546
GetLocaleInfoW.KERNEL32(00000400,00001002,?,00000104), ref: 00F27565

Strings

Downloadfrom, xrefs: 00F27276
Result_Install_Program, xrefs: 00F276E8
Install_Finish, xrefs: 00F2770F
DOWNLOAD_VERSION_USER_INFO, xrefs: 00F2732B
result_fail, xrefs: 00F270D2
Country, xrefs: 00F275BF
Install_Language, xrefs: 00F27654
exeNumber, xrefs: 00F273F1
Downloadfrom, xrefs: 00F2723A
Versionnumber, xrefs: 00F27498
Version, xrefs: 00F27381
Errorinfo, xrefs: 00F270EA
Test_id, xrefs: 00F271CB
Elapsedtime, xrefs: 00F26FD3
Result, xrefs: 00F27070
Language, xrefs: 00F2761C
DOWNLOAD_VERSION, xrefs: 00F272E2
Pageid, xrefs: 00F2742D
Versionnumber, xrefs: 00F274D4

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Time_memcpy_s$FileInfoIos_base_dtorLocaleSystem__aulldiv__time64_memsetstd::ios_base::_
String ID: Country$DOWNLOAD_VERSION$DOWNLOAD_VERSION_USER_INFO$Downloadfrom$Downloadfrom$Elapsedtime$Errorinfo$Install_Finish$Install_Language$Language$Pageid$Result$Result_Install_Program$Test_id$Version$Versionnumber$Versionnumber$exeNumber$result_fail
API String ID: 137583597-966982631
Opcode ID: 3160a3e918bbe2faea67af4b679c8dfbbded62de75e530d937fc92621adc553c
Instruction ID: edca1a4877202594cae5c000228cc278ba38cc2745b043821aa81f931960b8f8
Opcode Fuzzy Hash: 3160a3e918bbe2faea67af4b679c8dfbbded62de75e530d937fc92621adc553c
Instruction Fuzzy Hash: 08428AB050C3C0ABD325EB698C81B9FBBE5AFC8700F584A2DF58857241DB799548DB93

Function 00F18260 Relevance: 35.5, APIs: 7, Strings: 13, Instructions: 470stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F176C0: GetSystemInfo.KERNEL32 ref: 00F17733
Part of subcall function 00F176C0: GetVersionExW.KERNEL32 ref: 00F1774C
Part of subcall function 00F176C0: LoadLibraryA.KERNEL32(ntdll.dll), ref: 00F1775C
Part of subcall function 00F176C0: GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 00F1776E
Part of subcall function 00F176C0: FreeLibrary.KERNEL32(00000000), ref: 00F1779A

lstrlenW.KERNEL32(?), ref: 00F182B3
WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,00000000,00000000,00000000), ref: 00F182E1
lstrlenW.KERNEL32(00000004,00000000,download_setup_url_free_before_win7,00000023), ref: 00F18435
lstrlenW.KERNEL32(00000004,00000000,download_setup_url_trial_before_win7), ref: 00F184FB
lstrlenA.KERNEL32(?,?,ad_,00000003,?,?,DOWNLOAD_VERSION), ref: 00F18618
MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 00F18644

Strings

Url, xrefs: 00F1865F
Download_Old, xrefs: 00F18729
free, xrefs: 00F183C7
the system's version is greater than or equal win7, xrefs: 00F1884B
ad_, xrefs: 00F1854A
download_setup_url_trial_before_win7, xrefs: 00F184BD
download_setup_url_free_before_win7, xrefs: 00F183F0
the system's version is smaller than win7, xrefs: 00F18383
trial, xrefs: 00F184A0
the system's name is , xrefs: 00F182FF
download_setup_url_ad_before_win7, xrefs: 00F1856D
DOWNLOAD_VERSION, xrefs: 00F1839F
Download_Failed, xrefs: 00F18758

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: lstrlen$ByteCharLibraryMultiWide$AddressFreeInfoLoadProcSystemVersion
String ID: DOWNLOAD_VERSION$Download_Failed$Download_Old$Url$ad_$download_setup_url_ad_before_win7$download_setup_url_free_before_win7$download_setup_url_trial_before_win7$free$the system's name is $the system's version is greater than or equal win7$the system's version is smaller than win7$trial
API String ID: 3529924728-3496699267
Opcode ID: 0c5f10f08fb714fdccff1157f7063935fe1dd1b02c8b4c78426cb51bb954aa4d
Instruction ID: aa84bfae9dee187d1a857fb46947431a15d9f29350e27ed637850b83cc3d3f7a
Opcode Fuzzy Hash: 0c5f10f08fb714fdccff1157f7063935fe1dd1b02c8b4c78426cb51bb954aa4d
Instruction Fuzzy Hash: 49024531D00354DBDB20DBB4CD417DEBB76AF45350F14819CE409AB282DF799A86EB92

Function 00F3C710 Relevance: 28.8, APIs: 2, Strings: 14, Instructions: 822COMMON

Download Yara Rule

APIs

Part of subcall function 00F16FE0: GetTimeZoneInformation.KERNEL32(01014D18,01014D18), ref: 00F1705D
Part of subcall function 00F16FE0: swprintf.LIBCMT ref: 00F17110

_memset.LIBCMT ref: 00F3CDA5
GetLocaleInfoW.KERNEL32(00000400,00001002,?,00000104,?,?,?), ref: 00F3CDC4

Part of subcall function 00F12580: _memcpy_s.LIBCMT ref: 00F125FD

Strings

H4f, xrefs: 00F3C80A, 00F3C8C6
LANG, xrefs: 00F3C91F
productContrastPage, xrefs: 00F3C7BA
Timezone, xrefs: 00F3CCA2
Home_Installer, xrefs: 00F3CEB1
Country, xrefs: 00F3CE1F
Click_Install, xrefs: 00F3CE7E
exeNumber, xrefs: 00F3CAE7
DIR, xrefs: 00F3CA13
Language, xrefs: 00F3CB50
FreeVersionName, xrefs: 00F3C87F
Install_Path, xrefs: 00F3CBAF
DOWNLOAD_VERSION, xrefs: 00F3C837
Pageid, xrefs: 00F3CD32

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: InfoInformationLocaleTimeZone_memcpy_s_memsetswprintf
String ID: Click_Install$Country$DIR$DOWNLOAD_VERSION$FreeVersionName$H4f$Home_Installer$Install_Path$LANG$Language$Pageid$Timezone$exeNumber$productContrastPage
API String ID: 4036348029-1938298312
Opcode ID: beac668028dd1d01b78978cb6dddf04601a4cd5b9878dccd66eed3be0f341648
Instruction ID: 5b9226ebb88fbee581e58d11e8cd9e572472576b31ab4cce2accc8477960f683
Opcode Fuzzy Hash: beac668028dd1d01b78978cb6dddf04601a4cd5b9878dccd66eed3be0f341648
Instruction Fuzzy Hash: F4729BB19083809BD731EF65C882B9FB7E5BF94310F048A2EF58957241DBB89548DB93

Function 00F2C820 Relevance: 25.0, APIs: 6, Strings: 8, Instructions: 458stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1BB00: std::_String_base::_Xlen.LIBCPMT ref: 00F1BB5C
Part of subcall function 00F1BB00: _memcpy_s.LIBCMT ref: 00F1BBB6

lstrlenW.KERNEL32(?,00000000,download_setup_url_trial), ref: 00F2C945
WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,?,00000000,00000000), ref: 00F2C97E
lstrlenW.KERNEL32(?,00000000,00000001), ref: 00F2C9E0
WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,?,00000000,00000000), ref: 00F2CA19
lstrlenA.KERNEL32(?,?,00000000,00000000,000000FF,000000FF,DOWNLOAD_VERSION,00000010,?,?,?,?,?,?,00000018), ref: 00F2CB7D
MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001,?,?,?,?,?,?,00000018), ref: 00F2CBAF

Strings

download_setup_url_trial, xrefs: 00F2C8EB
do not need check md5, xrefs: 00F2C869
Url, xrefs: 00F2CBC5
free, xrefs: 00F2CACB
Download_Default, xrefs: 00F2CCA8
download_setup_url_free, xrefs: 00F2C8A5
DOWNLOAD_VERSION, xrefs: 00F2CA8B
Download_Failed, xrefs: 00F2CCCD

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$String_base::_Xlen_memcpy_sstd::_
String ID: DOWNLOAD_VERSION$Download_Default$Download_Failed$Url$do not need check md5$download_setup_url_free$download_setup_url_trial$free
API String ID: 1177619202-1148718834
Opcode ID: c86e7c071bc9b3eb8c356b7ba225f2938331c4fcdeba173d53599b9a71165f31
Instruction ID: 4ad9cc7fc31e30edfb1a0730730e45c9ab613eb00ba11135b8beb2094138bb4f
Opcode Fuzzy Hash: c86e7c071bc9b3eb8c356b7ba225f2938331c4fcdeba173d53599b9a71165f31
Instruction Fuzzy Hash: 1502D0B1D01268DBDB20DFA8CC41BDEBBB5BF44310F1482ADE419A7281DB795A84DF91

Function 00F16390 Relevance: 23.1, APIs: 4, Strings: 9, Instructions: 349stringCOMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00F163C1

Part of subcall function 00FDB986: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,00F163C6,00000000,8F2D4ADD), ref: 00FDB991
Part of subcall function 00FDB986: __aulldiv.LIBCMT ref: 00FDB9B1

Part of subcall function 00F159E0: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00F15A79

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00F164FC
lstrlenA.KERNEL32(010151FC,00000000,00000000,000000FF,?,000000FF,?,Elapsedtime,0000000B,?), ref: 00F16637
MultiByteToWideChar.KERNEL32(00000003,00000000,010151FC,000000FF,?,00000001), ref: 00F16666

Strings

Errorinfo, xrefs: 00F1659C
Downloading, xrefs: 00F16709
Cdn, xrefs: 00F1667C
Elapsedtime, xrefs: 00F163E7
Result, xrefs: 00F16484
Average_Networkspeed, xrefs: 00F16505
Success, xrefs: 00F1646D
Failed, xrefs: 00F16479
Result_Download_Program, xrefs: 00F166E6

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Time$ByteCharFileIos_base_dtorMultiSystemUnothrow_t@std@@@Wide__aulldiv__ehfuncinfo$??2@__time64lstrlenstd::ios_base::_
String ID: Average_Networkspeed$Cdn$Downloading$Elapsedtime$Errorinfo$Failed$Result$Result_Download_Program$Success
API String ID: 2797415940-1120128802
Opcode ID: cd20cdbcc8d1bffdc0dad3c73aa2eebfb9bf851eaefc89a2dd9a3c17b147d2f5
Instruction ID: ee77a5f176aa03e7619c842bce3aa85229a370c6493da8c67914f51a30c6d9ab
Opcode Fuzzy Hash: cd20cdbcc8d1bffdc0dad3c73aa2eebfb9bf851eaefc89a2dd9a3c17b147d2f5
Instruction Fuzzy Hash: 14D1B371D01248EBDF01DFE9CC81ADFBBB5AF44314F18412DE505B7241EA796A84DB91

Function 00F26110 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 200shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1BB00: std::_String_base::_Xlen.LIBCPMT ref: 00F1BB5C
Part of subcall function 00F1BB00: _memcpy_s.LIBCMT ref: 00F1BBB6

Part of subcall function 00F12580: _memcpy_s.LIBCMT ref: 00F125FD

Part of subcall function 00F16280: GetCurrentProcess.KERNEL32(000F01FF,?,?,?,?,?,?,Click_Close,0000000B), ref: 00F1628D
Part of subcall function 00F16280: OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,Click_Close,0000000B), ref: 00F16294

ExitWindowsEx.USER32(00000006,00040000), ref: 00F2636A

Strings

RestartPCTipDialog.xml, xrefs: 00F2615E
lb_RestartText, xrefs: 00F261E1
Restart, xrefs: 00F262D4
btn_Restartnow, xrefs: 00F26232
Later, xrefs: 00F26286
Click_Close, xrefs: 00F26319
lb_RestartTip, xrefs: 00F26194
Click_Restart, xrefs: 00F26350
Click_Later, xrefs: 00F2637C
Restart_Prompt, xrefs: 00F2638A

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Process_memcpy_s$CurrentExitOpenString_base::_TokenWindowsXlenstd::_
String ID: Click_Close$Click_Later$Click_Restart$Later$Restart$RestartPCTipDialog.xml$Restart_Prompt$btn_Restartnow$lb_RestartText$lb_RestartTip
API String ID: 2925917507-3534793505
Opcode ID: 3a39417cb569e3fa39c4c4de55f84984bbfb8f6e943c3f5a928645f0baa3486a
Instruction ID: 43eaf1197b71d8d26c24583f7d82a83ac1f2af17f52666f1c9f9d4e98e97617e
Opcode Fuzzy Hash: 3a39417cb569e3fa39c4c4de55f84984bbfb8f6e943c3f5a928645f0baa3486a
Instruction Fuzzy Hash: C08191709083C09BD720EF38C94279BBBE5AB85714F54455DF5884B282DBBA9449CBE3

Function 00F49760 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 141windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00F4978C
GetParent.USER32(?), ref: 00F497A8
GetWindow.USER32(?,00000004), ref: 00F497B4
MonitorFromWindow.USER32 ref: 00F497FC
GetMonitorInfoW.USER32(00000000), ref: 00F49803
IsIconic.USER32(00000000), ref: 00F4982E
GetWindowRect.USER32(00000000,?), ref: 00F4983E
SetWindowPos.USER32(?,00000000,?,?,000000FF,000000FF,00000015), ref: 00F498E1

Strings

(, xrefs: 00F497F4

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Window$MonitorRect$FromIconicInfoParent
String ID: (
API String ID: 1680950861-3887548279
Opcode ID: 99f61b66fb4eae799dffc6d5e603ef53fa3720e028a07a97a09f75998c167510
Instruction ID: 595e0e9f5373f0b0cd0b704f2ff41118489612ef339e665af1be18994b3ab694
Opcode Fuzzy Hash: 99f61b66fb4eae799dffc6d5e603ef53fa3720e028a07a97a09f75998c167510
Instruction Fuzzy Hash: EC51F3B1A083019FC350CF2DC984A1BFBE6BB89750F458A2DF999D3254E775E9048B92

Function 00FD0610 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 92windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,00000000,?,00FA8580,00000004,00000000), ref: 00FD0614

Part of subcall function 00FE0A22: __getptd_noexit.LIBCMT ref: 00FE0A22

_strerror.LIBCMT ref: 00FD0649

Part of subcall function 00FE25F6: __getptd_noexit.LIBCMT ref: 00FE25FD

_strncpy.LIBCMT ref: 00FD0653
FormatMessageA.KERNEL32(00001000,00000000,?,00000000,?,000000FF,00000000), ref: 00FD0682
_strrchr.LIBCMT ref: 00FD06AB
_strrchr.LIBCMT ref: 00FD06C6
GetLastError.KERNEL32 ref: 00FD06EE
SetLastError.KERNEL32(?), ref: 00FD06FD

Strings

Unknown error %d (%#x), xrefs: 00FD068E

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ErrorLast$__getptd_noexit_strrchr$FormatMessage_strerror_strncpy
String ID: Unknown error %d (%#x)
API String ID: 2622127435-2414550090
Opcode ID: 1eddcd6f329a5b40d6866819df5b114cddd133e3f3a2f63241248532f649a642
Instruction ID: cc33e794544c5d4013ee8e3377ee09d0c8949c7f33b003bdeebf7a64b76a93a3
Opcode Fuzzy Hash: 1eddcd6f329a5b40d6866819df5b114cddd133e3f3a2f63241248532f649a642
Instruction Fuzzy Hash: 3221DB71A012426AE63227359C45F3F769A9FD2755F0C003AF8459B382EE6ED810B7B2

Function 00F3E3E0 Relevance: 15.4, APIs: 4, Strings: 6, Instructions: 382COMMON

Download Yara Rule

Strings

Click_Language, xrefs: 00F3E5FC
text, xrefs: 00F3E441
Language, xrefs: 00F3E58B
Home_Installer, xrefs: 00F3E62B
.ini, xrefs: 00F3E6B5
Install_Language, xrefs: 00F3E7C1

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID:
String ID: .ini$Click_Language$Home_Installer$Install_Language$Language$text
API String ID: 0-1637465603
Opcode ID: 9b3569c2f3a4cdd6c7b8e21b50815486829aad6395e7fc3f01a83d9b480539a3
Instruction ID: 7a0716777ee74fa2bcbdb8f38bd095f9f28e17edb12bf0896724adfc799770cf
Opcode Fuzzy Hash: 9b3569c2f3a4cdd6c7b8e21b50815486829aad6395e7fc3f01a83d9b480539a3
Instruction Fuzzy Hash: DCE1B171D00348DBDF10EFA8CC41BDEBBB5AF54324F18466DE409A7281EB759A84DB92

Function 00F23110 Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 378stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,00000000,000000FF,?,?,?,?,?,?,?,?,?,00000000), ref: 00F232CF
WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,00000007,00000000,00000000), ref: 00F23300

Strings

win_, xrefs: 00F231DA
ProductName, xrefs: 00F23189
H4f, xrefs: 00F231C5
successfully to download setup.exe ,url:%s, xrefs: 00F23410

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID: H4f$ProductName$successfully to download setup.exe ,url:%s$win_
API String ID: 3109718747-1349602888
Opcode ID: f53b66ba5a70969bbc7160e659ea8c029d9da5c10c1d6d2da65e8fc99e5a441e
Instruction ID: 7474151eb68ac50f1f15c71117e5af139216599715ccb60dba0d78e6781ef7d3
Opcode Fuzzy Hash: f53b66ba5a70969bbc7160e659ea8c029d9da5c10c1d6d2da65e8fc99e5a441e
Instruction Fuzzy Hash: 25E103B1D00254EBDB10DFA8DC46B9EBBB5AF04314F14425DF805AB381DB79AA44DBA2

Function 00FCEF40 Relevance: 12.7, APIs: 4, Strings: 3, Instructions: 407COMMON

Download Yara Rule

APIs

_swscanf.LIBCMT ref: 00FCF00A

Part of subcall function 00FDFA6E: _vscan_fn.LIBCMT ref: 00FDFA85

_swscanf.LIBCMT ref: 00FCF0C4
_swscanf.LIBCMT ref: 00FCF0F5

Part of subcall function 00FE0A22: __getptd_noexit.LIBCMT ref: 00FE0A22

__wcstoi64.LIBCMT ref: 00FCF125

Part of subcall function 00FE0949: strtoxl.LIBCMT ref: 00FE096A

Strings

%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz], xrefs: 00FCEFFF
%02d:%02d%n, xrefs: 00FCF0EF
%02d:%02d:%02d%n, xrefs: 00FCF0BE

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _swscanf$__getptd_noexit__wcstoi64_vscan_fnstrtoxl
String ID: %02d:%02d%n$%02d:%02d:%02d%n$%31[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz]
API String ID: 3019234080-1523987602
Opcode ID: d753a5912ea035c19d92d472be23e1ce54c0c020fd3ed104cdf42762b7ba4020
Instruction ID: 0ea56fbd784338f6691eda38676e51406a44f95360f12892d21a961b1e5b99a7
Opcode Fuzzy Hash: d753a5912ea035c19d92d472be23e1ce54c0c020fd3ed104cdf42762b7ba4020
Instruction Fuzzy Hash: 8EE1AFB1E083428FC714DF29CA42A6BF7E2ABD4720F544A3EF495C7291E775C9489B42

Function 00F176C0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 151libraryloaderCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32 ref: 00F17733
GetVersionExW.KERNEL32 ref: 00F1774C
LoadLibraryA.KERNEL32(ntdll.dll), ref: 00F1775C
GetProcAddress.KERNEL32(00000000,RtlGetNtVersionNumbers), ref: 00F1776E
FreeLibrary.KERNEL32(00000000), ref: 00F1779A

Strings

RtlGetNtVersionNumbers, xrefs: 00F17768
ntdll.dll, xrefs: 00F17754

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Library$AddressFreeInfoLoadProcSystemVersion
String ID: RtlGetNtVersionNumbers$ntdll.dll
API String ID: 993833964-1263206204
Opcode ID: be0d71fe2dd05f639b968914c2a839cdae2698444445a80894f5609b46ecbd62
Instruction ID: 4cdef26ce1f1fee0ec8ee28f3cded4e1f127629e620c16b251495a8cc309416b
Opcode Fuzzy Hash: be0d71fe2dd05f639b968914c2a839cdae2698444445a80894f5609b46ecbd62
Instruction Fuzzy Hash: 3F517D7110C386DBD330EF58DC45BDBB3E8BB84714F504A1DF5A993280EB39A5889B62

Function 00F3B2B0 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 370windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F44A70: GetModuleHandleW.KERNEL32(kernel32,GetNativeSystemInfo,?,?,?,?,00F3B2FC,8F2D4ADD,?,?,?), ref: 00F44A7D
Part of subcall function 00F44A70: GetProcAddress.KERNEL32(00000000), ref: 00F44A84

Part of subcall function 00F1BB00: std::_String_base::_Xlen.LIBCPMT ref: 00F1BB5C
Part of subcall function 00F1BB00: _memcpy_s.LIBCMT ref: 00F1BBB6

Part of subcall function 00F15860: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,?,8F2D4ADD), ref: 00F15903
Part of subcall function 00F15860: _memset.LIBCMT ref: 00F1591D
Part of subcall function 00F15860: RegQueryValueExW.ADVAPI32(00000200,?,00000000,?,?,00000200), ref: 00F15959
Part of subcall function 00F15860: RegCloseKey.ADVAPI32(8F2D4ADD), ref: 00F1598F

IsWindow.USER32(?), ref: 00F3B6BD
PostMessageW.USER32(?,00000010,00000001,00000000), ref: 00F3B6D0
ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 00F3B73C

Strings

RegistryName, xrefs: 00F3B364
RegistryAddress, xrefs: 00F3B313
DisplayIcon, xrefs: 00F3B3F7

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: AddressCloseExecuteHandleMessageModuleOpenPostProcQueryShellString_base::_ValueWindowXlen_memcpy_s_memsetstd::_
String ID: DisplayIcon$RegistryAddress$RegistryName
API String ID: 3497597177-1137452039
Opcode ID: 2be9e471532f4c9a3a19537c1df258f7b04a093b7185402acfaf6b9a1644c095
Instruction ID: f7a37dfc3b5c804b4550f3eb89e5b5eb97e4dcb1893a6e0b16cd310999edc3e5
Opcode Fuzzy Hash: 2be9e471532f4c9a3a19537c1df258f7b04a093b7185402acfaf6b9a1644c095
Instruction Fuzzy Hash: BAE16AB1908380DFD320DF68C881B9BBBE5BF98710F044A2EF59987241EB799444DB97

Function 00F14B80 Relevance: 9.1, APIs: 6, Instructions: 81windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00F14B96
GetWindowRect.USER32(?,?), ref: 00F14BCB
OffsetRect.USER32(?,?,?), ref: 00F14BE4
CreateRoundRectRgn.GDI32(?,?,?,?,?,?), ref: 00F14C0A
SetWindowRgn.USER32(?,00000000,00000001), ref: 00F14C19
DeleteObject.GDI32(00000000), ref: 00F14C20

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Rect$Window$CreateDeleteIconicObjectOffsetRound
String ID:
API String ID: 2749569207-0
Opcode ID: f16d37ddf1d2fd37e5ba5bf0a5a24e3341c71d02b21b2a8fbec2ba4f45d11a1f
Instruction ID: 18147ad66ce46ee4e34ae5e5bb2e0bb9dbbc39bf1f2b8c29ca6cb762c0341ecd
Opcode Fuzzy Hash: f16d37ddf1d2fd37e5ba5bf0a5a24e3341c71d02b21b2a8fbec2ba4f45d11a1f
Instruction Fuzzy Hash: 19215CB66083019FD314CF69D88496BF7E9FBD8714F00492EF98AC3200DA36E945CB62

Function 00F54DE0 Relevance: 9.1, APIs: 6, Instructions: 58windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00F54DE8
GetWindowRect.USER32(?,?), ref: 00F54E0F
OffsetRect.USER32(?,?,?), ref: 00F54E28
CreateRoundRectRgn.GDI32(?,?,?,?,00000004,00000004), ref: 00F54E50
SetWindowRgn.USER32(?,00000000,00000001), ref: 00F54E5F
DeleteObject.GDI32(00000000), ref: 00F54E66

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Rect$Window$CreateDeleteIconicObjectOffsetRound
String ID:
API String ID: 2749569207-0
Opcode ID: 2434b5cb2266d76133a9d856e43f1aa6ee48e2284f9646f7bdda03e145a23f22
Instruction ID: adbb21b7c4db43252cd03068a7c7728c7d3cf32aee76b432729f2ddf955bd9b0
Opcode Fuzzy Hash: 2434b5cb2266d76133a9d856e43f1aa6ee48e2284f9646f7bdda03e145a23f22
Instruction Fuzzy Hash: 6011FBB5504302AFD314DF28C844AABBBE9FB88714F008A1DF999C3340D736E855CBA6

Function 00F16280 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000F01FF,?,?,?,?,?,?,Click_Close,0000000B), ref: 00F1628D
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,Click_Close,0000000B), ref: 00F16294
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00F162B0
AdjustTokenPrivileges.ADVAPI32 ref: 00F162DC

Strings

SeShutdownPrivilege, xrefs: 00F162A9

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 2349140579-3733053543
Opcode ID: d29b967675643f97bf2134423a84b6d908ff37c00904df5f0aaa3f8b2f5860b1
Instruction ID: ca4016e4e16ee6e1e132092bdcf71f286cb0b2ca31dc7f0dc4a305a20a9d66fc
Opcode Fuzzy Hash: d29b967675643f97bf2134423a84b6d908ff37c00904df5f0aaa3f8b2f5860b1
Instruction Fuzzy Hash: 30F03070644301ABE720DF54DD0AF6B77A8BF84B01F44850CB689D9185D7BA95149B62

Function 00F45480 Relevance: 7.6, APIs: 5, Instructions: 121processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00F454D8
Process32FirstW.KERNEL32 ref: 00F4552D
CloseHandle.KERNEL32(00000000), ref: 00F45537

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CloseCreateFirstHandleProcess32SnapshotToolhelp32
String ID:
API String ID: 1083639309-0
Opcode ID: d95c29f230be570fae827cba1fd1e7cb6413940efbeeabff405d4050744475d3
Instruction ID: f18e00e2b300e1c672402d0c08c8343c7feaa3a51a2aa9c8b5662c4f30f27fde
Opcode Fuzzy Hash: d95c29f230be570fae827cba1fd1e7cb6413940efbeeabff405d4050744475d3
Instruction Fuzzy Hash: B04174B15093809BD730FB64CC89BAFB7E9BF84714F14492EF58987242EA39A5049753

Function 00FDADFF Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00FE46E3
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00FE46F8
UnhandledExceptionFilter.KERNEL32(01013338), ref: 00FE4703
GetCurrentProcess.KERNEL32(C0000409), ref: 00FE471F
TerminateProcess.KERNEL32(00000000), ref: 00FE4726

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: a5c4e4ba0c945a6ad16f05e6df8c4c65132300a4cbd8d3953f8ddc2d545a876f
Instruction ID: 463cd1867f3186a9a67a545ec2c8fddead3060e46993aa2d5a7305aed678277a
Opcode Fuzzy Hash: a5c4e4ba0c945a6ad16f05e6df8c4c65132300a4cbd8d3953f8ddc2d545a876f
Instruction Fuzzy Hash: 3B21F2B8811A04FFD321DF26F4846443BACFB09314F10941AE48987B48E7BF5A828F59

Function 00F4AB50 Relevance: 7.5, APIs: 5, Instructions: 33keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000011), ref: 00F4AB5C
GetKeyState.USER32(00000002), ref: 00F4AB6A
GetKeyState.USER32(00000001), ref: 00F4AB76
GetKeyState.USER32(00000010), ref: 00F4AB82
GetKeyState.USER32(00000012), ref: 00F4AB8E

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: State
String ID:
API String ID: 1649606143-0
Opcode ID: a2a80610b067c5fd958bb91bc240d40448f8efab9d59dcc0e224e079f8dfe529
Instruction ID: 16cdd445b7b8f9a6a0063e957aeff5407a38edc26316791166342886acb6e9c8
Opcode Fuzzy Hash: a2a80610b067c5fd958bb91bc240d40448f8efab9d59dcc0e224e079f8dfe529
Instruction Fuzzy Hash: 05E0126BEC166610ED1031D91C01FE999568FE0FE4F8301A4ED88371C8DDCA0D4326B3

Function 00F14C60 Relevance: 3.1, APIs: 2, Instructions: 90windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00F14CAD
CallWindowProcW.USER32(?,?,?,?,?), ref: 00F14D2A

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CallIconicProcWindow
String ID:
API String ID: 799844899-0
Opcode ID: b3fda8a7d5a8001776f746c68bd6b81b35fed0703bc80a38815002efdc0472dc
Instruction ID: 8536ca30649f31d8d0f61492c1e772539373f676be0438fd11fdeed34c02a4a3
Opcode Fuzzy Hash: b3fda8a7d5a8001776f746c68bd6b81b35fed0703bc80a38815002efdc0472dc
Instruction Fuzzy Hash: 1F217C736042099BC710DF69F844AEBB7A8EBC4721F00896AFD54C7240DA36E9559BE1

Function 00FB12F0 Relevance: 3.0, APIs: 2, Instructions: 34networkCOMMON

Download Yara Rule

APIs

htons.WS2_32 ref: 00FB1319
GetCurrentProcessId.KERNEL32 ref: 00FB1351

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CurrentProcesshtons
String ID:
API String ID: 2530476045-0
Opcode ID: e951a99ba54fdc0935596768b38466c5e452e6a00c1d20631183c540b762bf7d
Instruction ID: 115678c56014179ac7919361547a4c87cde23a8d87181639757d2de0f5e69768
Opcode Fuzzy Hash: e951a99ba54fdc0935596768b38466c5e452e6a00c1d20631183c540b762bf7d
Instruction Fuzzy Hash: E80157B4514B419EC3609F79D490656BBF0FF28300B049A6E98EAC7B11E3B5A588CB95

Function 00FA52D0 Relevance: 2.6, Strings: 2, Instructions: 83COMMON

Download Yara Rule

Strings

-----BEGIN PUBLIC KEY-----, xrefs: 00FA52E3
-----END PUBLIC KEY-----, xrefs: 00FA5309

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID:
String ID: -----END PUBLIC KEY-----$-----BEGIN PUBLIC KEY-----
API String ID: 0-1157147699
Opcode ID: d217018e532d3d16a6bf33b531f967e90654ce7174aeebf7abe282e8a08ceacd
Instruction ID: 792f5f7c418cc1428fc5379ff112506f59de0b0390d574f3f203a897524a5896
Opcode Fuzzy Hash: d217018e532d3d16a6bf33b531f967e90654ce7174aeebf7abe282e8a08ceacd
Instruction Fuzzy Hash: F0210BB6A047011BDB255A2CA8407B6B7D9DBD27A2F44057EF8C5C3241D764E805D6A1

Function 00FAE0C0 Relevance: 1.5, APIs: 1, Instructions: 24networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000001,00000002), ref: 00FAE0F2

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 933577bdcc5449469979307fd8b35cd9e0e5979b0f808ae15972f6dabf5466b1
Instruction ID: f4054cc657e2bc031576a8c5b0ba7fe86944ac52c897459ccdc8de081b41c17f
Opcode Fuzzy Hash: 933577bdcc5449469979307fd8b35cd9e0e5979b0f808ae15972f6dabf5466b1
Instruction Fuzzy Hash: 06E086F0A043016EE6208734CC4DFA632D5AB51725FC8C6B4F418C24D1E7B9DC54E611

Function 00F537C0 Relevance: 1.5, APIs: 1, Instructions: 11windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00F537C4

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Iconic
String ID:
API String ID: 110040809-0
Opcode ID: 13969d24a836e18503cf8b3c17ca6dfab82c42207bd7daec07fc7ff04fffb2dc
Instruction ID: 7e9cc838713c148b81f283553ff89eeb3a90285a06243a0d5cf879920f506d8b
Opcode Fuzzy Hash: 13969d24a836e18503cf8b3c17ca6dfab82c42207bd7daec07fc7ff04fffb2dc
Instruction Fuzzy Hash: 28D0C9B5614305ABC3158F30C64471A7BE4AB45381F04CC29A44186190DB36C400CB20

Function 00FD0280 Relevance: 94.7, APIs: 4, Strings: 50, Instructions: 152COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00000000,?,00FD066B,?,00000004,?,00FA8580,00000004,00000000), ref: 00FD028A

Part of subcall function 00FE0A22: __getptd_noexit.LIBCMT ref: 00FE0A22

_strncpy.LIBCMT ref: 00FD04AB
GetLastError.KERNEL32(00000004,00000000), ref: 00FD04C8
SetLastError.KERNEL32(?), ref: 00FD04D7

Strings

Socket is not connected, xrefs: 00FD03D8
Winsock version not supported, xrefs: 00FD046E
Socket has been shut down, xrefs: 00FD03E2
Bad quota, xrefs: 00FD0444
Protocol option is unsupported, xrefs: 00FD0342
Loop??, xrefs: 00FD040A
Network down, xrefs: 00FD0392
Timed out, xrefs: 00FD03F6
Winsock library not initialised, xrefs: 00FD0467
Something is stale, xrefs: 00FD044B
Remote error, xrefs: 00FD0452
Address family not supported, xrefs: 00FD036A
Blocking call in progress, xrefs: 00FD0310
Connection was aborted, xrefs: 00FD03B0
Connection was reset, xrefs: 00FD03BA
Host unreachable, xrefs: 00FD0428
Bad protocol, xrefs: 00FD0338
Winsock library is not ready, xrefs: 00FD0460
Not empty, xrefs: 00FD042F
No data record of requested type, xrefs: 00FD0495
Disconnected, xrefs: 00FD0459
Too many users, xrefs: 00FD043D
Process limit reached, xrefs: 00FD0436
Network unreachable, xrefs: 00FD039C
Out of file descriptors, xrefs: 00FD02FC
Call interrupted, xrefs: 00FD02CA
Too many references, xrefs: 00FD03EC
Descriptor is not a socket, xrefs: 00FD031A
Host not found, try again, xrefs: 00FD04A3
Bad access, xrefs: 00FD02DE
Bad message size, xrefs: 00FD032E
Host not found, xrefs: 00FD0475
Socket is already connected, xrefs: 00FD03CE
Protocol is unsupported, xrefs: 00FD034C
No buffer space, xrefs: 00FD03C4
Need destination address, xrefs: 00FD0324
Call would block, xrefs: 00FD0306
Network has been reset, xrefs: 00FD03A6
Address not available, xrefs: 00FD0388
Bad file, xrefs: 00FD02D4
Invalid arguments, xrefs: 00FD02F2
Bad argument, xrefs: 00FD02E8
Protocol family not supported, xrefs: 00FD0374
Connection refused, xrefs: 00FD0400
Operation not supported, xrefs: 00FD0360
Unrecoverable error in call to nameserver, xrefs: 00FD049C, 00FD04A9
Host down, xrefs: 00FD041E
Name too long, xrefs: 00FD0414
Socket is unsupported, xrefs: 00FD0356
Address already in use, xrefs: 00FD037E

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ErrorLast$__getptd_noexit_strncpy
String ID: Address already in use$Address family not supported$Address not available$Bad access$Bad argument$Bad file$Bad message size$Bad protocol$Bad quota$Blocking call in progress$Call interrupted$Call would block$Connection refused$Connection was aborted$Connection was reset$Descriptor is not a socket$Disconnected$Host down$Host not found$Host not found, try again$Host unreachable$Invalid arguments$Loop??$Name too long$Need destination address$Network down$Network has been reset$Network unreachable$No buffer space$No data record of requested type$Not empty$Operation not supported$Out of file descriptors$Process limit reached$Protocol family not supported$Protocol is unsupported$Protocol option is unsupported$Remote error$Socket has been shut down$Socket is already connected$Socket is not connected$Socket is unsupported$Something is stale$Timed out$Too many references$Too many users$Unrecoverable error in call to nameserver$Winsock library is not ready$Winsock library not initialised$Winsock version not supported
API String ID: 226764833-3442644082
Opcode ID: 1abe781cf148b1d4fd99d27791ccf2d409dc6281a8ec40b383ba72092744b5c8
Instruction ID: 14750fcf70b21414f9d4915fe6d837d974e26778ea1f8c2f6f15edd10dc83986
Opcode Fuzzy Hash: 1abe781cf148b1d4fd99d27791ccf2d409dc6281a8ec40b383ba72092744b5c8
Instruction Fuzzy Hash: E441C12362824A8761E6D118D105F39625BFB83328FBC813FABC2EE381CD259C417762

Function 00FB9820 Relevance: 73.9, APIs: 25, Strings: 17, Instructions: 427libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB8AD0: _memset.LIBCMT ref: 00FB8AF8
Part of subcall function 00FB8AD0: _memset.LIBCMT ref: 00FB8B12

Part of subcall function 00FB8240: WSAStartup.WS2_32(00000002,8F2D4ADD), ref: 00FB825A

Part of subcall function 00FD0F50: GetModuleHandleW.KERNEL32(kernel32,00000000,00000000,?,00FA861E,secur32.dll,?,?,?,00F9D0EA), ref: 00FD0F5A

GetLastError.KERNEL32 ref: 00FB98AB
GetProcAddress.KERNEL32(00000000,WSACreateEvent), ref: 00FB98D7
GetLastError.KERNEL32 ref: 00FB98E1
FreeLibrary.KERNEL32(00000000), ref: 00FB98F7

Strings

failed to find WSACreateEvent function (%u), xrefs: 00FB98E8
WSAEnumNetworkEvents, xrefs: 00FB9965
FreeLibrary(wsock2) failed (%u), xrefs: 00FB9D15
failed to find WSAEventSelect function (%u), xrefs: 00FB993D
Time-out, xrefs: 00FB9CCA
WSAEnumNetworkEvents failed (%d), xrefs: 00FB9BAC
, xrefs: 00FB9C3D
failed to load WS2_32.DLL (%u), xrefs: 00FB98B2
WSACloseEvent failed (%d), xrefs: 00FB9CF1
WSACreateEvent failed (%d), xrefs: 00FB99B7
failed to find WSAEnumNetworkEvents function (%u), xrefs: 00FB997C
failed to find WSACloseEvent function (%u), xrefs: 00FB9921
WSACloseEvent, xrefs: 00FB990A
WSAEventSelect, xrefs: 00FB9928
WSACreateEvent, xrefs: 00FB98D1
d, xrefs: 00FB9A47
WS2_32.DLL, xrefs: 00FB9894

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ErrorLast_memset$AddressFreeHandleLibraryModuleProcStartup
String ID: $FreeLibrary(wsock2) failed (%u)$Time-out$WS2_32.DLL$WSACloseEvent$WSACloseEvent failed (%d)$WSACreateEvent$WSACreateEvent failed (%d)$WSAEnumNetworkEvents$WSAEnumNetworkEvents failed (%d)$WSAEventSelect$d$failed to find WSACloseEvent function (%u)$failed to find WSACreateEvent function (%u)$failed to find WSAEnumNetworkEvents function (%u)$failed to find WSAEventSelect function (%u)$failed to load WS2_32.DLL (%u)
API String ID: 1460278797-3724274948
Opcode ID: 17cce1d605d127ace70fa77fd9fb9ad273846d3493bb764c13346d34cb393285
Instruction ID: 90b951712f2662c58e3053595b7c59e29eaf006afc24b4c2e3ea9b0c992049c0
Opcode Fuzzy Hash: 17cce1d605d127ace70fa77fd9fb9ad273846d3493bb764c13346d34cb393285
Instruction Fuzzy Hash: 4CE1F8B1A083019FD720DF65CC84EAB7BE8EF84324F14852DFA4587241D6BAD845DFA2

Function 00FD0710 Relevance: 70.2, APIs: 7, Strings: 33, Instructions: 190windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?), ref: 00FD072E

Part of subcall function 00FE0A22: __getptd_noexit.LIBCMT ref: 00FE0A22

FormatMessageA.KERNEL32 ref: 00FD0A69
_strrchr.LIBCMT ref: 00FD0A86
_strrchr.LIBCMT ref: 00FD0AA9
_strncpy.LIBCMT ref: 00FD0B9E
GetLastError.KERNEL32 ref: 00FD0BBD
SetLastError.KERNEL32(?), ref: 00FD0BCC

Strings

SEC_E_TARGET_UNKNOWN, xrefs: 00FD09CF
SEC_I_NO_LSA_CONTEXT, xrefs: 00FD0B4B
SEC_E_OUT_OF_SEQUENCE, xrefs: 00FD0943
%s (0x%08X), xrefs: 00FD0A3A
SEC_E_SECPKG_NOT_FOUND, xrefs: 00FD0989
Unknown error, xrefs: 00FD0B60
SEC_E_NO_CREDENTIALS, xrefs: 00FD08FD
SEC_E_INTERNAL_ERROR, xrefs: 00FD0849
%s - %s, xrefs: 00FD0ACF
SEC_E_LOGON_DENIED, xrefs: 00FD08B7
CRYPT_E_REVOKED, xrefs: 00FD0A33
SEC_E_INSUFFICIENT_MEMORY, xrefs: 00FD083F
SEC_I_INCOMPLETE_CREDENTIALS, xrefs: 00FD0B3D
SEC_E_UNKNOWN_CREDENTIALS, xrefs: 00FD09F7
SEC_E_CANNOT_PACK, xrefs: 00FD07A9
SEC_I_CONTEXT_EXPIRED, xrefs: 00FD0B36
SEC_E_CANNOT_INSTALL, xrefs: 00FD079F
SEC_E_NO_AUTHENTICATING_AUTHORITY, xrefs: 00FD08F3
SEC_I_COMPLETE_NEEDED, xrefs: 00FD0B2F, 00FD0B6E
SEC_E_INVALID_TOKEN, xrefs: 00FD0867
No error, xrefs: 00FD0AF5, 00FD0AFF
SEC_I_SIGNATURE_NEEDED, xrefs: 00FD0B59
SEC_E_INVALID_HANDLE, xrefs: 00FD0853
SEC_I_CONTINUE_NEEDED, xrefs: 00FD0A39, 00FD0B05
SEC_E_NO_IMPERSONATION, xrefs: 00FD0907
SEC_I_COMPLETE_AND_CONTINUE, xrefs: 00FD0B28
SEC_E_MESSAGE_ALTERED, xrefs: 00FD08CB
SEC_E_QOP_NOT_SUPPORTED, xrefs: 00FD096B
SEC_E_NOT_OWNER, xrefs: 00FD08E9
SEC_I_RENEGOTIATE, xrefs: 00FD0B52
SEC_I_LOCAL_LOGON, xrefs: 00FD0B44
SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log., xrefs: 00FD0B7E
SEC_E_UNSUPPORTED_FUNCTION, xrefs: 00FD0A01

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ErrorLast$_strrchr$FormatMessage__getptd_noexit_strncpy
String ID: %s (0x%08X)$%s - %s$CRYPT_E_REVOKED$No error$SEC_E_CANNOT_INSTALL$SEC_E_CANNOT_PACK$SEC_E_ILLEGAL_MESSAGE (0x%08X) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed). More detail may be available in the Windows System event log.$SEC_E_INSUFFICIENT_MEMORY$SEC_E_INTERNAL_ERROR$SEC_E_INVALID_HANDLE$SEC_E_INVALID_TOKEN$SEC_E_LOGON_DENIED$SEC_E_MESSAGE_ALTERED$SEC_E_NOT_OWNER$SEC_E_NO_AUTHENTICATING_AUTHORITY$SEC_E_NO_CREDENTIALS$SEC_E_NO_IMPERSONATION$SEC_E_OUT_OF_SEQUENCE$SEC_E_QOP_NOT_SUPPORTED$SEC_E_SECPKG_NOT_FOUND$SEC_E_TARGET_UNKNOWN$SEC_E_UNKNOWN_CREDENTIALS$SEC_E_UNSUPPORTED_FUNCTION$SEC_I_COMPLETE_AND_CONTINUE$SEC_I_COMPLETE_NEEDED$SEC_I_CONTEXT_EXPIRED$SEC_I_CONTINUE_NEEDED$SEC_I_INCOMPLETE_CREDENTIALS$SEC_I_LOCAL_LOGON$SEC_I_NO_LSA_CONTEXT$SEC_I_RENEGOTIATE$SEC_I_SIGNATURE_NEEDED$Unknown error
API String ID: 501956867-2070339000
Opcode ID: b6c16ccad21a9ea1f60162e94bffab9a6a43fb8516cadb5efd7c8d6e1972c928
Instruction ID: 10c93d6ba7e1d71af6af7e53112d31cf304c3b33496d52e5372ee8d0f50c894b
Opcode Fuzzy Hash: b6c16ccad21a9ea1f60162e94bffab9a6a43fb8516cadb5efd7c8d6e1972c928
Instruction Fuzzy Hash: 0051DE3264C345DBD2215A18DC81B7A7296BBC1B08F98442BB4C2DF389DE6D9890B367

Function 00F5AE70 Relevance: 48.5, APIs: 32, Instructions: 479COMMON

Download Yara Rule

APIs

IntersectRect.USER32(?,?,?), ref: 00F5AEC2

Part of subcall function 00F709E0: GetClipBox.GDI32(?,?), ref: 00F709FC
Part of subcall function 00F709E0: CreateRectRgnIndirect.GDI32(?), ref: 00F70A0D
Part of subcall function 00F709E0: CreateRectRgnIndirect.GDI32(?), ref: 00F70A17
Part of subcall function 00F709E0: ExtSelectClipRgn.GDI32(?,00000000,00000001), ref: 00F70A20

IntersectRect.USER32(?,?,?), ref: 00F5AFCE
IntersectRect.USER32(?,?,00000000), ref: 00F5B025
IntersectRect.USER32(?,?,00000000), ref: 00F5B055
SelectClipRgn.GDI32(?,?), ref: 00F5B0B8
DeleteObject.GDI32(?), ref: 00F5B0BF
DeleteObject.GDI32(?), ref: 00F5B0C6
SelectClipRgn.GDI32(?,?), ref: 00F5B0E9
DeleteObject.GDI32(?), ref: 00F5B0F6
DeleteObject.GDI32(?), ref: 00F5B0FD
IntersectRect.USER32(?,?,00000000), ref: 00F5B199
IntersectRect.USER32(?,?,00000000), ref: 00F5B1CD
SelectClipRgn.GDI32(?,?), ref: 00F5B1DD
SelectClipRgn.GDI32(?,?), ref: 00F5B206
IntersectRect.USER32(?,?,00000000), ref: 00F5B220
SelectClipRgn.GDI32(?,?), ref: 00F5B26B
DeleteObject.GDI32(?), ref: 00F5B278
DeleteObject.GDI32(?), ref: 00F5B27F
SelectClipRgn.GDI32(?,?), ref: 00F5B296
DeleteObject.GDI32(?), ref: 00F5B29F
DeleteObject.GDI32(?), ref: 00F5B2A6
SelectClipRgn.GDI32(?,?), ref: 00F5B2B2
DeleteObject.GDI32(?), ref: 00F5B2B5
DeleteObject.GDI32(?), ref: 00F5B2BC
IntersectRect.USER32(?,?,00000000), ref: 00F5B325
SelectClipRgn.GDI32(?,?), ref: 00F5B369
DeleteObject.GDI32(?), ref: 00F5B370
DeleteObject.GDI32(?), ref: 00F5B377
IntersectRect.USER32(?,?,00000000), ref: 00F5B3B7
SelectClipRgn.GDI32(?,?), ref: 00F5B3EE
DeleteObject.GDI32(?), ref: 00F5B3F5
DeleteObject.GDI32(?), ref: 00F5B3FC

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: DeleteObject$ClipRect$Select$Intersect$CreateIndirect
String ID:
API String ID: 2241121588-0
Opcode ID: 2828ba12f74b4a2193732af1bdc6e9d9085ea17973c29144030cdefd8a60dcf9
Instruction ID: bf16ee9ba3aa38dda0284942e990a05a3fee249c7e3ef8decc0da97de6e37c30
Opcode Fuzzy Hash: 2828ba12f74b4a2193732af1bdc6e9d9085ea17973c29144030cdefd8a60dcf9
Instruction Fuzzy Hash: B20229756042019FCB15DF68C880AAAB7AAFFC9310F14866DFE558B355CB36E805CBA1

Function 00F7E1B0 Relevance: 37.2, APIs: 8, Strings: 13, Instructions: 418COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,?,?,00F68CCD,?,?), ref: 00F7E491
__wcstoui64.LIBCMT ref: 00F7E4A3
CharNextW.USER32(?,?,?,?,00F68CCD,?,?), ref: 00F7E4FA
__wcstoui64.LIBCMT ref: 00F7E50C
CharNextW.USER32(?,?,?,?,00F68CCD,?,?), ref: 00F7E561
__wcstoui64.LIBCMT ref: 00F7E573
CharNextW.USER32(?,?,?,?,00F68CCD,?,?), ref: 00F7E5CA
__wcstoui64.LIBCMT ref: 00F7E5DC

Strings

focusedtextcolor, xrefs: 00F7E587
hottextcolor, xrefs: 00F7E4B7
hotforeimage, xrefs: 00F7E371
fivestatusimage, xrefs: 00F7E3B9
fadedelta, xrefs: 00F7E401
hotimage, xrefs: 00F7E203
normalimage, xrefs: 00F7E1B9
pushedimage, xrefs: 00F7E251
disabledimage, xrefs: 00F7E2E1
pushedtextcolor, xrefs: 00F7E520
focusedimage, xrefs: 00F7E299
hotbkcolor, xrefs: 00F7E450
foreimage, xrefs: 00F7E329

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CharNext__wcstoui64
String ID: disabledimage$fadedelta$fivestatusimage$focusedimage$focusedtextcolor$foreimage$hotbkcolor$hotforeimage$hotimage$hottextcolor$normalimage$pushedimage$pushedtextcolor
API String ID: 216335860-1272733750
Opcode ID: 1511480b5ae9c252987104f8f7e41c14723598a026f37f5678043e90bbe768cf
Instruction ID: db3f2aa00049805409841e7ba44f436e097b6b03e227151656110af137df7a26
Opcode Fuzzy Hash: 1511480b5ae9c252987104f8f7e41c14723598a026f37f5678043e90bbe768cf
Instruction Fuzzy Hash: C7C1B653B1000147DA35AF38D8415BA7297BBB9B347D8CAABE149CB295E723CC84E313

Function 00FC7160 Relevance: 33.4, APIs: 11, Strings: 8, Instructions: 186COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FC71AE
__allrem.LIBCMT ref: 00FC71E1
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FC71EF
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FC71FF
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FC7233
__allrem.LIBCMT ref: 00FC7263
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FC7271
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FC7281
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FC72B4
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FC72E7
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FC730C

Strings

%4I64dP, xrefs: 00FC7313
%4I64dk, xrefs: 00FC71B5
%4I64dM, xrefs: 00FC723A
%5I64d, xrefs: 00FC717E
%2I64d.%0I64dM, xrefs: 00FC7206
%2I64d.%0I64dG, xrefs: 00FC7288
%4I64dT, xrefs: 00FC72EE
%4I64dG, xrefs: 00FC72BB

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem
String ID: %2I64d.%0I64dG$%2I64d.%0I64dM$%4I64dG$%4I64dM$%4I64dP$%4I64dT$%4I64dk$%5I64d
API String ID: 632788072-2102732564
Opcode ID: 62b8c3da0d4297b20e98361efd0f2b2caf786fc9ed43dc4613383a089a077859
Instruction ID: 3537a17d474af53b1743b701801a41dd2487a3048bba494712ca3a41c0e3978e
Opcode Fuzzy Hash: 62b8c3da0d4297b20e98361efd0f2b2caf786fc9ed43dc4613383a089a077859
Instruction Fuzzy Hash: 2F41C2E2B8534235F031746A6E83F7BA02D9BD1F55F28042DBA02F90D3E6D96890647D

Function 00F74DB5 Relevance: 32.0, APIs: 15, Strings: 3, Instructions: 468COMMON

Download Yara Rule

APIs

Part of subcall function 00F49FD0: _malloc.LIBCMT ref: 00F4A01D

CharNextW.USER32(?), ref: 00F74E17
__wcstoi64.LIBCMT ref: 00F74E41
CharNextW.USER32(?,?,?,?,000000FF), ref: 00F74E67
CharNextW.USER32(?,?,?,?,000000FF), ref: 00F74E8D
__wcslwr.LIBCMT ref: 00F74EE9
SelectObject.GDI32(00000000), ref: 00F74FE9
CharNextW.USER32(?), ref: 00F7590D
CharNextW.USER32(?), ref: 00F7591C

Strings

bold, xrefs: 00F74EF8
italic, xrefs: 00F74F46
underline, xrefs: 00F74F1F

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CharNext$ObjectSelect__wcslwr__wcstoi64_malloc
String ID: bold$italic$underline
API String ID: 2718116904-1406305012
Opcode ID: 0ec4cd54a278dc007bfec25eead1bd36958b01c114ae876e04421417df485c2f
Instruction ID: b64c3367b4371c68be38b0dafda0fdd314ea6e32744c2b0173b0785d98569aba
Opcode Fuzzy Hash: 0ec4cd54a278dc007bfec25eead1bd36958b01c114ae876e04421417df485c2f
Instruction Fuzzy Hash: C30260B0A083419BD724DF24C884BABB7E5EF85710F04881EF989D7241E779E945DBA3

Function 00FA0800 Relevance: 31.9, APIs: 2, Strings: 16, Instructions: 406COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00FA09CD
__wcstoi64.LIBCMT ref: 00FA0A6B

Strings

Invalid IPv6 address format, xrefs: 00FA0A3C
Unsupported proxy scheme for '%s', xrefs: 00FA08E2
/, xrefs: 00FA0AB4
https, xrefs: 00FA082E
Please URL encode %% as %%25, see RFC 6874., xrefs: 00FA09DD
Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support., xrefs: 00FA091C
http:, xrefs: 00FA08CC
://, xrefs: 00FA080B
No valid port number in proxy string (%s), xrefs: 00FA0AA4
socks5, xrefs: 00FA086B
socks, xrefs: 00FA08B8
socks4a, xrefs: 00FA0889
socks4, xrefs: 00FA08A4
socks5h, xrefs: 00FA084D
[, xrefs: 00FA098A
%25, xrefs: 00FA09C8

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __wcstoi64_strncmp
String ID: %25$/$://$Invalid IPv6 address format$No valid port number in proxy string (%s)$Please URL encode %% as %%25, see RFC 6874.$Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support.$Unsupported proxy scheme for '%s'$[$http:$https$socks$socks4$socks4a$socks5$socks5h
API String ID: 540414501-672486822
Opcode ID: 92dbd6f248ee3c6fffd910a105b58beac27020bfab089b81166b733232da9013
Instruction ID: 71e38a3cb854b77a1004f381189b586284c9d4c1f01f8d109f9b4eae244b5b9d
Opcode Fuzzy Hash: 92dbd6f248ee3c6fffd910a105b58beac27020bfab089b81166b733232da9013
Instruction Fuzzy Hash: 69D15AF1E043015BE7309F15EC85B677BD59F86364F080429F8C98A243EB3AD949E7A2

Function 00FB54D0 Relevance: 31.7, APIs: 2, Strings: 16, Instructions: 183COMMON

Download Yara Rule

APIs

__wcstoi64.LIBCMT ref: 00FB5576

Strings

Malformed ACK packet, rejecting, xrefs: 00FB5642
got option=(%s) value=(%s), xrefs: 00FB5542
blksize is larger than max supported, xrefs: 00FB567D
requested, xrefs: 00FB55AD
invalid tsize -:%s:- value in OACK packet, xrefs: 00FB56B4
server requested blksize larger than allocated, xrefs: 00FB56A7
tsize parsed from OACK, xrefs: 00FB55FC
%s (%d) %s (%d), xrefs: 00FB55B8
tsize, xrefs: 00FB55DD
blksize is smaller than min supported, xrefs: 00FB569F
%s (%ld), xrefs: 00FB5601
blksize parsed from OACK, xrefs: 00FB55B3
blksize, xrefs: 00FB555F
%s (%d), xrefs: 00FB5682
invalid blocksize value in OACK packet, xrefs: 00FB565D
%s (%ld), xrefs: 00FB56AC

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __wcstoi64
String ID: %s (%d)$%s (%d) %s (%d)$%s (%ld)$%s (%ld)$Malformed ACK packet, rejecting$blksize$blksize is larger than max supported$blksize is smaller than min supported$blksize parsed from OACK$got option=(%s) value=(%s)$invalid blocksize value in OACK packet$invalid tsize -:%s:- value in OACK packet$requested$server requested blksize larger than allocated$tsize$tsize parsed from OACK
API String ID: 398114495-895336422
Opcode ID: 8f6539b7120af0f6dc6f003c5138b9ae2ef428b6a719bc04e70544410652d521
Instruction ID: e1a4b3359699d5c91bb67b30f0d5d284ac40e5d95b9b22b6b8b995bf1b5ba65a
Opcode Fuzzy Hash: 8f6539b7120af0f6dc6f003c5138b9ae2ef428b6a719bc04e70544410652d521
Instruction Fuzzy Hash: 4E416371B443016BE611A917BC42FF77349D7C1F6AF440039FD4C9A243EA5E9A09AAA2

Function 00F711F0 Relevance: 30.3, APIs: 20, Instructions: 266windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 00F71200
CreateDIBSection.GDI32(?,00000000,00000000,?,00000000,00000000), ref: 00F71276
SelectObject.GDI32(00000000,00000000), ref: 00F71295
StretchBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,?,?,00CC0020), ref: 00F712C2
SelectObject.GDI32(00000000,?), ref: 00F712CE
DeleteObject.GDI32(?), ref: 00F712F4
DeleteDC.GDI32(00000000), ref: 00F712FB
CreateDIBSection.GDI32(?,00000000,00000000,?,00000000,00000000), ref: 00F71357
SelectObject.GDI32(00000000,00000000), ref: 00F71376
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00CC0020), ref: 00F7139A
SelectObject.GDI32(00000000,?), ref: 00F713A6
SelectObject.GDI32(00000000,?), ref: 00F7142F
DeleteDC.GDI32(00000000), ref: 00F714D0

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Object$Select$CreateDelete$Section$CompatibleStretch
String ID:
API String ID: 1102575708-0
Opcode ID: 05a88d6f7f57558a4b053fe8786c445857cac325fbc352131683002422f34789
Instruction ID: 34383995977d755ccac48aaed169e3a49c9c714b77aa14793049d6582430e47d
Opcode Fuzzy Hash: 05a88d6f7f57558a4b053fe8786c445857cac325fbc352131683002422f34789
Instruction Fuzzy Hash: B2914DB1604300AFD714DF68D885A6BBBF9FF88310F148A1EF94993345D776E8508BA2

Function 00F76F40 Relevance: 30.2, APIs: 20, Instructions: 222COMMON

Download Yara Rule

APIs

GdipCreateFromHDC.GDIPLUS(?,?,?,00000000), ref: 00F76F59
GdipSetSmoothingMode.GDIPLUS(?,00000004,?,?,?,00000000), ref: 00F76F69
GdipCreatePen1.GDIPLUS(?,?,00000000,00000004,?,00000004,?,?,?,00000000), ref: 00F76F83
GdipCreateSolidFill.GDIPLUS ref: 00F76FAE
GdipCreatePath.GDIPLUS(00000000,?), ref: 00F76FCA
GdipAddPathArcI.GDIPLUS(?,?,?,00000000,?), ref: 00F76FFB
GdipAddPathLineI.GDIPLUS(?,?,?,?,?,?,?,?,00000000,?), ref: 00F7701D
GdipAddPathArcI.GDIPLUS(?,?,?,?,?,00000000,?), ref: 00F77056
GdipAddPathLineI.GDIPLUS(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00F77079
GdipAddPathArcI.GDIPLUS(?,?,?,?,?,?,?,00000000,?), ref: 00F770B0
GdipAddPathLineI.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00F770CD
GdipAddPathArcI.GDIPLUS(?,?,?,?,?,?,?,?,?,00000000,?), ref: 00F770FC
GdipAddPathLineI.GDIPLUS(?,?,?,?,00000000,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00F7711E
GdipFillPath.GDIPLUS(?,?,?,?,?,?,?,00000000,?,?,?,?,?,?,?), ref: 00F7713A
GdipDrawPath.GDIPLUS(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,?), ref: 00F7714A
GdipClosePathFigure.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 00F77154
GdipDeletePath.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,?), ref: 00F77166
GdipDeleteBrush.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00F77170
GdipDeletePen.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00F7717A
GdipDeleteGraphics.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F77180

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Gdip$Path$CreateDeleteLine$Fill$BrushCloseDrawFigureFromGraphicsModePen1SmoothingSolid
String ID:
API String ID: 496263768-0
Opcode ID: bde7af276fa96c460005457768f54a8b68886e8313da2e14bfc0eba3bc45ad6a
Instruction ID: 5c6a4c562fe2edd6b10e9a71af3051f070491412367946e276efbc7ad92da077
Opcode Fuzzy Hash: bde7af276fa96c460005457768f54a8b68886e8313da2e14bfc0eba3bc45ad6a
Instruction Fuzzy Hash: 867108B0618306AFD714EF69CD85E2BBBE9EFC8740F10891DF98883255D674EC059B62

Function 00F753D7 Relevance: 28.5, APIs: 12, Strings: 4, Instructions: 456COMMON

Download Yara Rule

APIs

CharNextW.USER32(?), ref: 00F75408
CharNextW.USER32(?), ref: 00F7542B
CharNextW.USER32(?), ref: 00F7547E
CharNextW.USER32(?), ref: 00F754AC
CharNextW.USER32(?), ref: 00F754DA

Strings

res, xrefs: 00F75550
, xrefs: 00F7567C
file, xrefs: 00F7553B
restype, xrefs: 00F75565

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CharNext
String ID: $file$res$restype
API String ID: 3213498283-2182986002
Opcode ID: 08d8af0164d22143bd47e0395b8eb049633b8ee8fee65c5cb11333821daedc84
Instruction ID: 3977aa2ef5de8a187a718c02e994aa4a68da2ffe84e9a70ebba058cd6bb807ee
Opcode Fuzzy Hash: 08d8af0164d22143bd47e0395b8eb049633b8ee8fee65c5cb11333821daedc84
Instruction Fuzzy Hash: EF0290749087858BDB30DF24C884BAFB3E5AF94710F48882EE88D97241E779E945DB53

Function 00F79640 Relevance: 28.4, APIs: 15, Strings: 1, Instructions: 355timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4F730: GetWindowRect.USER32(?,?), ref: 00F4F754
Part of subcall function 00F4F730: ScreenToClient.USER32(?,?), ref: 00F4F76C
Part of subcall function 00F4F730: ScreenToClient.USER32(?,?), ref: 00F4F77A

GetCaretBlinkTime.USER32(00000000), ref: 00F79687
SetTimer.USER32(?,00000014,00000000), ref: 00F79694
CallWindowProcW.USER32(?,?,?,?,?), ref: 00F796AB
GetClientRect.USER32(?,?), ref: 00F79733
InvalidateRect.USER32(?,?,00000000), ref: 00F79743

Strings

return, xrefs: 00F79776

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ClientRect$ScreenWindow$BlinkCallCaretInvalidateProcTimeTimer
String ID: return
API String ID: 3851949828-2812165903
Opcode ID: a7606b2329b923ce02396edd73ee139e05646165f68a6657e2570fd9f3adc205
Instruction ID: 7fdf72032a63f075cff33f766de5f1ef5f7c53b394bdeb81cd80f4eba56b2707
Opcode Fuzzy Hash: a7606b2329b923ce02396edd73ee139e05646165f68a6657e2570fd9f3adc205
Instruction Fuzzy Hash: C5C18075A042009FDB14DF68D884A6AB7E5EBC9320F00C6AEFD5D8B356C675DC11CBA2

Function 00F78E30 Relevance: 28.3, APIs: 8, Strings: 8, Instructions: 318COMMON

Download Yara Rule

APIs

CharNextW.USER32(?), ref: 00F78FEA
__wcstoui64.LIBCMT ref: 00F78FFC

Strings

true, xrefs: 00F78E75, 00F78EBB, 00F78F03, 00F78F43
visiblecheckbtn, xrefs: 00F78EC6
selitemtextcolor, xrefs: 00F79087
itemhottextcolor, xrefs: 00F79017
itemminwidth, xrefs: 00F78F4E
selitemhottextcolor, xrefs: 00F790F7
itemtextcolor, xrefs: 00F78FA4
visiblefolderbtn, xrefs: 00F78E39

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CharNext__wcstoui64
String ID: itemhottextcolor$itemminwidth$itemtextcolor$selitemhottextcolor$selitemtextcolor$true$visiblecheckbtn$visiblefolderbtn
API String ID: 216335860-1882295018
Opcode ID: 2f4854379d6acc4690974c78f778c6684307daa00695914cf9beec8c0074dd34
Instruction ID: 20ecfc8e220be8dc5f5d3d2c443a4e3cfe2010b680a8878b5a6a11bd8606832a
Opcode Fuzzy Hash: 2f4854379d6acc4690974c78f778c6684307daa00695914cf9beec8c0074dd34
Instruction Fuzzy Hash: B6A1F9627540014BDB25AF38CC44ABA7393BBB5770BD4862BE14ACB294DB63DC85D363

Function 00FB8AD0 Relevance: 28.2, APIs: 6, Strings: 10, Instructions: 200COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FB8AF8
_memset.LIBCMT ref: 00FB8B12
_swscanf.LIBCMT ref: 00FB8BC5
_strncpy.LIBCMT ref: 00FB8BFD
_strncpy.LIBCMT ref: 00FB8C3D

Strings

XDISPLOC, xrefs: 00FB8C1A
USER,%s, xrefs: 00FB8B3C
TTYPE, xrefs: 00FB8BDA
NEW_ENV, xrefs: 00FB8C5A
%127[^= ]%*[ =]%255s, xrefs: 00FB8BBF
%hu%*[xX]%hu, xrefs: 00FB8CC4
1, xrefs: 00FB8D69
BINARY, xrefs: 00FB8CE3
Syntax error in telnet option: %s, xrefs: 00FB8D33, 00FB8D5E
Unknown telnet option %s, xrefs: 00FB8D42

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _memset_strncpy$_swscanf
String ID: %127[^= ]%*[ =]%255s$%hu%*[xX]%hu$1$BINARY$NEW_ENV$Syntax error in telnet option: %s$TTYPE$USER,%s$Unknown telnet option %s$XDISPLOC
API String ID: 193792928-1116758244
Opcode ID: c4f9a830261996ea5d613c57565ffb72aa22b0171a0feba298fea3b60a9fc497
Instruction ID: f1e41a36ec88275ddc7f861e63f7268cfd5f9d84ce2781aa7bb77b80fddfe6d0
Opcode Fuzzy Hash: c4f9a830261996ea5d613c57565ffb72aa22b0171a0feba298fea3b60a9fc497
Instruction Fuzzy Hash: 9071A2B29043059FD721EF65CC81EE7B7E8AF98384F44482EF59947241EB34E509DBA2

Function 00F7A600 Relevance: 26.6, APIs: 4, Strings: 11, Instructions: 400windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000CF,?,00000000), ref: 00F7A6A3
SendMessageW.USER32(?,000000C5,00000000,00000000), ref: 00F7A8C4
CharNextW.USER32(?), ref: 00F7AA31
__wcstoui64.LIBCMT ref: 00F7AA47

Strings

numberonly, xrefs: 00F7A6B3
autoselall, xrefs: 00F7A7D4
disabledimage, xrefs: 00F7A9A7
password, xrefs: 00F7A745
true, xrefs: 00F7A643, 00F7A6F3, 00F7A783, 00F7A813
nativebkcolor, xrefs: 00F7A9F0
readonly, xrefs: 00F7A608
hotimage, xrefs: 00F7A916
focusedimage, xrefs: 00F7A960
normalimage, xrefs: 00F7A8CF
maxchar, xrefs: 00F7A861

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: MessageSend$CharNext__wcstoui64
String ID: autoselall$disabledimage$focusedimage$hotimage$maxchar$nativebkcolor$normalimage$numberonly$password$readonly$true
API String ID: 2158325730-3096893876
Opcode ID: cf1bdcdadd5c8c8a86641afdb472821407296eb1b029a94e4b33c02c34ba52e7
Instruction ID: 0499a78d20850a88f62b3dcbb29dd59643680df0d0d78902ca43a5e5d9c564c7
Opcode Fuzzy Hash: cf1bdcdadd5c8c8a86641afdb472821407296eb1b029a94e4b33c02c34ba52e7
Instruction Fuzzy Hash: 47C1E452B1010296E614AF34C8016BE7263AFF1774B4BC62AD959CB299F313CD96E353

Function 00F48A40 Relevance: 26.6, APIs: 9, Strings: 6, Instructions: 349COMMON

Download Yara Rule

APIs

CharNextW.USER32(00000000,00000000,?,?,?,00F48A31,00000000,00000000,?,?,?,?,?,00F4865C), ref: 00F48A5E
CharNextW.USER32(00000000), ref: 00F48A99
CharNextW.USER32(00000000), ref: 00F48AD9
CharNextW.USER32(00000000), ref: 00F48B10
_realloc.LIBCMT ref: 00F48B49
CharNextW.USER32(00000000,?), ref: 00F48BF9
CharNextW.USER32(?,?,0000003C,?), ref: 00F48D1D
CharNextW.USER32(?), ref: 00F48D57
CharNextW.USER32(?), ref: 00F48D8D

Part of subcall function 00F49230: _wcsncpy.LIBCMT ref: 00F4923A
Part of subcall function 00F49230: _wcsncpy.LIBCMT ref: 00F49257

Strings

Expected end-tag start, xrefs: 00F48E04
Unmatched closing tag, xrefs: 00F48E20
Expected start-tag closing, xrefs: 00F48DEC
Expected start tag, xrefs: 00F48DB0
gfff, xrefs: 00F48B68
Error parsing element name, xrefs: 00F48DC8

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CharNext$_wcsncpy$_realloc
String ID: Error parsing element name$Expected end-tag start$Expected start tag$Expected start-tag closing$Unmatched closing tag$gfff
API String ID: 2427325080-2742108210
Opcode ID: 9d97254ae7ab90c7507c46d8f878fe3ce8a3d3bfb9c31892bdfc2b8df0fc5239
Instruction ID: b16f1e98cbc7b869af2931e26c4bac213d712aa0224ea7e76511ac8671277b7f
Opcode Fuzzy Hash: 9d97254ae7ab90c7507c46d8f878fe3ce8a3d3bfb9c31892bdfc2b8df0fc5239
Instruction Fuzzy Hash: D9C1B531E002018FC724EF28D444A6EBBF1FF953A0B55846EECC58B290EBB99D86D750

Function 00F15580 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 189windowprocessCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F155BF
CreateProcessW.KERNEL32(?,?,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00F15626
GetLastError.KERNEL32 ref: 00F15630
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000C8,000004FF), ref: 00F156C4
GetExitCodeProcess.KERNEL32(?,?), ref: 00F156E9
GetLastError.KERNEL32(?,00000000,?,?), ref: 00F156F7
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00F15772
TranslateMessage.USER32(?), ref: 00F15796
DispatchMessageW.USER32(?), ref: 00F1579D
CloseHandle.KERNEL32(?,?,00000000,?,?), ref: 00F157B3
CloseHandle.KERNEL32(?,?,00000000,?,?), ref: 00F157BA

Part of subcall function 00F96A40: GetLocalTime.KERNEL32(?,00000000,74DF2EE0,00F1553E,Install recomand return=%ld,?), ref: 00F96A71
Part of subcall function 00F96A40: _memset.LIBCMT ref: 00F96A83
Part of subcall function 00F96A40: GetCurrentThreadId.KERNEL32 ref: 00F96AA3
Part of subcall function 00F96A40: __snprintf.LIBCMT ref: 00F96AB6
Part of subcall function 00F96A40: _vswprintf_s.LIBCMT ref: 00F96AD7
Part of subcall function 00F96A40: OutputDebugStringA.KERNELBASE(?), ref: 00F96B06

Strings

Install ErrCode=%d, xrefs: 00F15637
Install return=%ld, xrefs: 00F157C1
Install ErrCode= %ld, xrefs: 00F156FE
D, xrefs: 00F155D5

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Message$CloseErrorHandleLastProcess_memset$CodeCreateCurrentDebugDispatchExitLocalMultipleObjectsOutputPeekStringThreadTimeTranslateWait__snprintf_vswprintf_s
String ID: D$Install ErrCode= %ld$Install ErrCode=%d$Install return=%ld
API String ID: 467620243-3459061465
Opcode ID: db685fc37800342ef103bfba869614e8e88076b805766af4fc745104250956b6
Instruction ID: a76e406bc698355925757a52fee38ca0d81d608031de99c2b975d18ba4b41ba8
Opcode Fuzzy Hash: db685fc37800342ef103bfba869614e8e88076b805766af4fc745104250956b6
Instruction Fuzzy Hash: 40615DB1908380DBD730DF64D841B9BB7E9AFD4B40F04492EF68997240DB7A9544DB93

Function 00F98EF0 Relevance: 25.0, APIs: 9, Strings: 5, Instructions: 485stringthreadCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A270: std::_String_base::_Xlen.LIBCPMT ref: 00F1A2BF
Part of subcall function 00F1A270: _memcpy_s.LIBCMT ref: 00F1A32A

CreateThread.KERNEL32(00000000,00000000,00F99BC0,?,00000000,00000000), ref: 00F99167
CloseHandle.KERNEL32(00000000), ref: 00F99183
__time64.LIBCMT ref: 00F991AF
_rand.LIBCMT ref: 00F991B7
lstrlenW.KERNEL32(?,?,?,?), ref: 00F9921C
WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,?,00000000,00000000,?,?), ref: 00F9924C
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00F9933A
lstrlenA.KERNEL32(?), ref: 00F993D3
MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 00F99405

Strings

%s %d redownload info count:%d, xrefs: 00F992CC
%s %d download info code:%d, xrefs: 00F99199
&tmpTime_=, xrefs: 00F992A3
CHttpHelper::GetDownloadInfo, xrefs: 00F99194, 00F992C7
TestID, xrefs: 00F99464

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen$CloseCreateHandleIos_base_dtorString_base::_ThreadXlen__time64_memcpy_s_randstd::_std::ios_base::_
String ID: %s %d download info code:%d$%s %d redownload info count:%d$&tmpTime_=$CHttpHelper::GetDownloadInfo$TestID
API String ID: 1102782826-1444138739
Opcode ID: d5cb56f13667fc3884c1fb2f72c1edb0622078f2cf6788997b57812d1f6ad6c8
Instruction ID: 503fd632b5dd11f20d1e7b6c3cdb2bfd18da6aa87d4b5ed63489a1b3b3178f63
Opcode Fuzzy Hash: d5cb56f13667fc3884c1fb2f72c1edb0622078f2cf6788997b57812d1f6ad6c8
Instruction Fuzzy Hash: C212DFB1D042589FEF20DFA8CC81BDEBBB5AF45310F1541A9E109A7341DB785E84DBA2

Function 00F2C170 Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 322stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000004,00000000,InterceptWebEventY), ref: 00F2C223
lstrlenW.KERNEL32(00000004,00000000,InterceptWebEventX), ref: 00F2C2C4
lstrlenW.KERNEL32(00000004,00000000,InterceptWebEventCloseX), ref: 00F2C365
lstrlenW.KERNEL32(00000004,00000000,InterceptWebEventCloseY), ref: 00F2C409
GetWindowRect.USER32(?,?), ref: 00F2C45C
ClientToScreen.USER32(?,?), ref: 00F2C4A2
PtInRect.USER32(?,?,?), ref: 00F2C4BA
SendMessageW.USER32(?,000000A1,00000002,?), ref: 00F2C4DA

Part of subcall function 00F110B0: WideCharToMultiByte.KERNELBASE(00000003,00000000,00000004,000000FF,?,?,00000000,00000000,00F185D6,00000003), ref: 00F110CB

PtInRect.USER32(?,?,?), ref: 00F2C4F3
SendMessageW.USER32(?,00000112,0000F020,00000000), ref: 00F2C514

Strings

InterceptWebEventCloseX, xrefs: 00F2C325
InterceptWebEventY, xrefs: 00F2C1E3
InterceptWebEventX, xrefs: 00F2C284
InterceptWebEventCloseY, xrefs: 00F2C3C9

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: lstrlen$Rect$MessageSend$ByteCharClientMultiScreenWideWindow
String ID: InterceptWebEventCloseX$InterceptWebEventCloseY$InterceptWebEventX$InterceptWebEventY
API String ID: 4024436429-2061605471
Opcode ID: 27bcbe2c9da3b7dccde8592c04cda699887f37fc413287f6dc88b13a9da46efd
Instruction ID: 393bc9e474fe65bc852419a3218e4551ec1066a05b42eb958152162165ddcee4
Opcode Fuzzy Hash: 27bcbe2c9da3b7dccde8592c04cda699887f37fc413287f6dc88b13a9da46efd
Instruction Fuzzy Hash: 40C1D0B1E00324DFCB10EFA4DC45BAEBBB5AB48710F244529E405AB381DB79AD41EBD1

Function 00FB8DB0 Relevance: 22.9, APIs: 7, Strings: 6, Instructions: 197networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FB8DE2
_memset.LIBCMT ref: 00FB8DF5
_swscanf.LIBCMT ref: 00FB8EBF
send.WS2_32(?,?,00000002,00000000), ref: 00FB8F42
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,0000007F), ref: 00FB8F4C
send.WS2_32(?,?,?,00000000), ref: 00FB8FF4
WSAGetLastError.WS2_32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,0000007F), ref: 00FB8FFE

Strings

%c%c%c%c%s%c%c, xrefs: 00FB8FC5
Sending data failed (%d), xrefs: 00FB8F57, 00FB9005
%c%c%c%c, xrefs: 00FB8E60
%127[^,],%127s, xrefs: 00FB8EB9
%c%s%c%s, xrefs: 00FB8EE1
%c%c, xrefs: 00FB8F15

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ErrorLast_memsetsend$_swscanf
String ID: %127[^,],%127s$%c%c$%c%c%c%c$%c%c%c%c%s%c%c$%c%s%c%s$Sending data failed (%d)
API String ID: 3960926081-3318542072
Opcode ID: c72506e8792364f48251a107e11467abb37def2afbc06ee9994c20d1600881a7
Instruction ID: 8b25c84456deacf676d029a97bc361edc00b4054ee3bb89acf1eb2a0306a5500
Opcode Fuzzy Hash: c72506e8792364f48251a107e11467abb37def2afbc06ee9994c20d1600881a7
Instruction Fuzzy Hash: 1361F571744346AFE335DB14CC82FF773A9AB84744F04062CFA895B2C2DEB5A9099B91

Function 00F68A40 Relevance: 21.2, APIs: 4, Strings: 8, Instructions: 245COMMON

Download Yara Rule

APIs

CharNextW.USER32(?), ref: 00F68C31
__wcstoui64.LIBCMT ref: 00F68C47
CharNextW.USER32(?), ref: 00F68C9B
__wcstoui64.LIBCMT ref: 00F68CB1

Strings

selectedtextcolor, xrefs: 00F68C5A
true, xrefs: 00F68AC9, 00F68B0D
selectedimage, xrefs: 00F68B17
selected, xrefs: 00F68A8F
selectedbkcolor, xrefs: 00F68BF0
group, xrefs: 00F68A48
selectedhotimage, xrefs: 00F68B60
foreimage, xrefs: 00F68BA7

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CharNext__wcstoui64
String ID: foreimage$group$selected$selectedbkcolor$selectedhotimage$selectedimage$selectedtextcolor$true
API String ID: 216335860-3444983114
Opcode ID: 18349b80293a44a4faf16bcffc879ffac4acf424dbc304b4725bb094e43f63be
Instruction ID: 93b7f0a66bbb0e4483b515e6eda5059671e11ec2158f1c078eb2bba0e4fec1bd
Opcode Fuzzy Hash: 18349b80293a44a4faf16bcffc879ffac4acf424dbc304b4725bb094e43f63be
Instruction Fuzzy Hash: 2B71E5A2A1010256D714AF78C84167772A7EFB57F4B48476EE951CB298FB23CC87E320

Function 00F96FA0 Relevance: 21.2, APIs: 3, Strings: 9, Instructions: 233synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,00F972F0,00000000,00000000,00000000), ref: 00F971BE

Part of subcall function 00F12BB0: std::_String_base::_Xlen.LIBCPMT ref: 00F12BE7
Part of subcall function 00F12BB0: _memcpy_s.LIBCMT ref: 00F12C36

WaitForSingleObject.KERNEL32(00000000,00002710), ref: 00F9724F
CloseHandle.KERNEL32(00000000), ref: 00F97256

Strings

&downloader_num=, xrefs: 00F9709D
GUID, xrefs: 00F96FF3
&url=, xrefs: 00F97052
&install_start_downloader=true, xrefs: 00F970EA
&install_finish_downloader=false, xrefs: 00F97111
UpdateEventUrl, xrefs: 00F97130
&install_start_downloader=false, xrefs: 00F970F3
uid=, xrefs: 00F97028
&install_finish_downloader=true, xrefs: 00F97108

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CloseCreateHandleObjectSingleString_base::_ThreadWaitXlen_memcpy_sstd::_
String ID: &downloader_num=$&install_finish_downloader=false$&install_finish_downloader=true$&install_start_downloader=false$&install_start_downloader=true$&url=$GUID$UpdateEventUrl$uid=
API String ID: 3702222336-3402532700
Opcode ID: 3ccb689a5a450f3c882dbd564ad617e48e2ec22ab1a5bd306d0aacea9e268e06
Instruction ID: b8f25b86307dbc7e6e401b55b991e2f9fd6fe54749e4d9c4e682dd41953c2f67
Opcode Fuzzy Hash: 3ccb689a5a450f3c882dbd564ad617e48e2ec22ab1a5bd306d0aacea9e268e06
Instruction Fuzzy Hash: 4F91CFB1918380ABE720EF64C842B5FBBE5BF84710F144A2DF68947341DB39A844DB93

Function 00FB5720 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207networkCOMMON

Download Yara Rule

APIs

sendto.WS2_32(?,00000000,00000004,00000000,?,?), ref: 00FB57B9
__time64.LIBCMT ref: 00FB57E6
sendto.WS2_32(?,?,00000004,00000000,000000CC,?), ref: 00FB5847
WSAGetLastError.WS2_32(?,00000004,00000000,000000CC,?,?,?), ref: 00FB5851
sendto.WS2_32(?,?,00000004,00000000,?,?), ref: 00FB5952

Strings

Timeout waiting for block %d ACK. Retries = %d, xrefs: 00FB58A4
Received last DATA packet block %d again., xrefs: 00FB5771
tftp_rx: internal error, xrefs: 00FB5964
Received unexpected DATA packet block %d, expecting block %d, xrefs: 00FB57F6

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: sendto$ErrorLast__time64
String ID: Received last DATA packet block %d again.$Received unexpected DATA packet block %d, expecting block %d$Timeout waiting for block %d ACK. Retries = %d$tftp_rx: internal error
API String ID: 4265266248-1785996722
Opcode ID: 0c8e39d5d9e06dab718a21fd2a0cbcf7f2124d75e41df2ab2b9a78c0727cc263
Instruction ID: 686742dbd21a287a85d6a61627ed24938fbf2c195019d99edaf1531660971406
Opcode Fuzzy Hash: 0c8e39d5d9e06dab718a21fd2a0cbcf7f2124d75e41df2ab2b9a78c0727cc263
Instruction Fuzzy Hash: BE61B4B1200B009BE731AF35DC81FAB73E9EF84715F14491DF58AC7282EA7AE4459B61

Function 00F79270 Relevance: 21.2, APIs: 14, Instructions: 179windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F79470: IntersectRect.USER32(?,?,?), ref: 00F79586

SendMessageW.USER32(?,00000030,?,00000001), ref: 00F79330
SendMessageW.USER32(?,000000C5,?,00000000), ref: 00F79347
SendMessageW.USER32(?,000000CC,?,00000000), ref: 00F79368
SetWindowTextW.USER32(?,?), ref: 00F79380
SendMessageW.USER32(?,000000B9,00000000,00000000), ref: 00F793A8
SendMessageW.USER32(?,000000D3,00000003,00000000), ref: 00F793B7
EnableWindow.USER32(?,00000000), ref: 00F793D2
SendMessageW.USER32(?,000000CF,00000000,00000000), ref: 00F793F3
ShowWindow.USER32(?,00000004), ref: 00F793FB
SetFocus.USER32(?), ref: 00F79405
GetWindowTextLengthW.USER32(?), ref: 00F7941B
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00F79436
GetWindowTextLengthW.USER32(?), ref: 00F79449
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00F7945A

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: MessageSend$Window$Text$Length$EnableFocusIntersectRectShow
String ID:
API String ID: 2848147740-0
Opcode ID: befa880a77e1b02308a91d1f9ac31b7421e71f44746ab97a944db398c1b00e23
Instruction ID: 25b71be296e48b223429cf390ae06592cac23c1cdcdce9b67510a23585a880b4
Opcode Fuzzy Hash: befa880a77e1b02308a91d1f9ac31b7421e71f44746ab97a944db398c1b00e23
Instruction Fuzzy Hash: EB519FB5700701AFE314DB68CC85F66B7AABB88700F048659F9189B391C7B6FC51CB91

Function 00F602C0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 130memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(errorLine), ref: 00F60319
SysAllocString.OLEAUT32(errorCharacter), ref: 00F60324
SysAllocString.OLEAUT32(errorCode), ref: 00F6032F
SysAllocString.OLEAUT32(errorMessage), ref: 00F6033A
SysAllocString.OLEAUT32(errorUrl), ref: 00F60345
SysFreeString.OLEAUT32 ref: 00F603F6

Strings

errorCharacter, xrefs: 00F6031B
errorCode, xrefs: 00F60326
errorLine, xrefs: 00F60308
(, xrefs: 00F602EE
errorUrl, xrefs: 00F6033C
errorMessage, xrefs: 00F60331

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: String$Alloc$Free
String ID: ($errorCharacter$errorCode$errorLine$errorMessage$errorUrl
API String ID: 2383597386-2821095632
Opcode ID: 14e3ddc318044667fff7bda63879467336267d7688efa766439a30e2b0a3d047
Instruction ID: 48e0c93f3bec276fe42d849877f39ea61609aaacae40cee9d35cd425e85c2e6b
Opcode Fuzzy Hash: 14e3ddc318044667fff7bda63879467336267d7688efa766439a30e2b0a3d047
Instruction Fuzzy Hash: CB4175716043059FC210DF68D880E5BB7E8EBC8714F208A2EF588CB265DB71E905CBA2

Function 00F4C7C6 Relevance: 19.9, APIs: 13, Instructions: 366COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00F4C853
RestoreDC.GDI32(?,?), ref: 00F4CA77
GetWindowRect.USER32(?,?), ref: 00F4CABB

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Window$RectRestore
String ID:
API String ID: 1490976877-0
Opcode ID: 181c75f009d53cb63e2ebc3dae30ea7ffcc5d51d09852ec2fa2d6c5b467b93d7
Instruction ID: a99325ec5f80feabaa5c76ce90b31e9e2a5c254872c4d7aa88df2f58a0f44a68
Opcode Fuzzy Hash: 181c75f009d53cb63e2ebc3dae30ea7ffcc5d51d09852ec2fa2d6c5b467b93d7
Instruction Fuzzy Hash: 01F12F755083408FD754CF28C884B9ABBF6BFC8310F19896DED898B355DB34A845DBA2

Function 00F50100 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F5012B
GetStockObject.GDI32(00000011), ref: 00F5013C
GetObjectW.GDI32(00000000), ref: 00F50143
_wcsncpy.LIBCMT ref: 00F50151
CreateFontIndirectW.GDI32(?), ref: 00F501A0
_memset.LIBCMT ref: 00F501DB
SelectObject.GDI32(?,?), ref: 00F50264
GetTextMetricsW.GDI32(?,00000090), ref: 00F50276
SelectObject.GDI32(?,00000000), ref: 00F50284
__itow.LIBCMT ref: 00F502C6
DeleteObject.GDI32 ref: 00F50302

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Object$Select_memset$CreateDeleteFontIndirectMetricsStockText__itow_wcsncpy
String ID:
API String ID: 278288231-0
Opcode ID: a27ac01ad221bdf0c9d9f9f7cc3ceed649c2bd6702bee96580de9aa52d975b95
Instruction ID: 2e181f4e8c74f6f001ab8d185afb1069473be18c4eb9a4f0bbd715bf69396153
Opcode Fuzzy Hash: a27ac01ad221bdf0c9d9f9f7cc3ceed649c2bd6702bee96580de9aa52d975b95
Instruction Fuzzy Hash: 84618F719083849FE730DF34CC45B9BBBE4AF88310F04891DBA88C7242EB799948DB52

Function 00F256C0 Relevance: 19.7, APIs: 2, Strings: 11, Instructions: 185stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,InstallIntervalTime,?,?,?,8F2D4ADD), ref: 00F2574D

Strings

!, xrefs: 00F257B4
3, xrefs: 00F257BB
<, xrefs: 00F257C2
slrProgress, xrefs: 00F258FB
T, xrefs: 00F257D0
progressValue, xrefs: 00F2586F
value, xrefs: 00F258D3
text, xrefs: 00F25843
K, xrefs: 00F257C9
InstallIntervalTime, xrefs: 00F2570B
], xrefs: 00F257D7

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: lstrlen
String ID: !$3$<$InstallIntervalTime$K$T$]$progressValue$slrProgress$text$value
API String ID: 1659193697-919299193
Opcode ID: 1b1eaf3a5605e4e6c07a42256ef7c2f7a0a827189a2fa1ace35fb92760136be1
Instruction ID: 8c75cf847996d788643733ad2287052892582caef86fcb39511db4ed06138da5
Opcode Fuzzy Hash: 1b1eaf3a5605e4e6c07a42256ef7c2f7a0a827189a2fa1ace35fb92760136be1
Instruction Fuzzy Hash: 83710770D01358DBDF20EFA9D84A78EBBB1EF00714F14415DE8056B281DBB9AA48DB92

Function 00FB6170 Relevance: 19.6, APIs: 2, Strings: 9, Instructions: 331COMMON

Download Yara Rule

Strings

TFTP file name too long, xrefs: 00FB62AA
timeout, xrefs: 00FB63EE
%s%c%s%c, xrefs: 00FB62EB
netascii, xrefs: 00FB61A8
tftp_send_first: internal error, xrefs: 00FB6505
tsize, xrefs: 00FB6374
octet, xrefs: 00FB6191, 00FB62F4
%I64d, xrefs: 00FB634C
blksize, xrefs: 00FB63B1

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID:
String ID: %I64d$%s%c%s%c$TFTP file name too long$blksize$netascii$octet$tftp_send_first: internal error$timeout$tsize
API String ID: 0-1678188727
Opcode ID: 18d3cc1f50f1f2e043f9aea20d4b92c3075e43cd97a90b77a727d7bcdd292747
Instruction ID: dbf593668d7df3612353ebdf3c0751dcf4811cf2c41207e84d3896265c60130d
Opcode Fuzzy Hash: 18d3cc1f50f1f2e043f9aea20d4b92c3075e43cd97a90b77a727d7bcdd292747
Instruction Fuzzy Hash: F2B1C3B1A002409BD714DF29CC96BAB77E6FFC4714F48452DF8498B382DA79E805CB96

Function 00F253E0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 199filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00F240BA,C0000000,00000003,00000000,00000003,00000080,00000000,8F2D4ADD,00000007,00000000,?), ref: 00F2544C
GetFileSize.KERNEL32(00000000,00000000), ref: 00F25463
SetFilePointer.KERNEL32(?,-FFFFF800,00000000,00000001), ref: 00F25487
_memset.LIBCMT ref: 00F254A6
ReadFile.KERNEL32(?,?,00000104,?,00000000), ref: 00F254C3
lstrlenA.KERNEL32(?,?), ref: 00F254E7
MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000001), ref: 00F25519
CloseHandle.KERNEL32(?,8F2D4ADD,00000007,00000000,?), ref: 00F2568B

Strings

error_info, xrefs: 00F255AB
errInfo, xrefs: 00F2552F
Install_Failed, xrefs: 00F255DA

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: File$ByteCharCloseCreateHandleMultiPointerReadSizeWide_memsetlstrlen
String ID: Install_Failed$errInfo$error_info
API String ID: 403388370-415826701
Opcode ID: efdd05ba88fe5980aefc1c9e0010f752b394c11460b85ae43db384f1a803086b
Instruction ID: 004ffdcb65414806d37fcc6f30ced6a1cde99f29f689c8eb0e4fd9107ec57983
Opcode Fuzzy Hash: efdd05ba88fe5980aefc1c9e0010f752b394c11460b85ae43db384f1a803086b
Instruction Fuzzy Hash: EF71F471D00228ABDB20DF64CC85BEEB7B9EF48714F5441A9E509A7280EB795F84CF90

Function 00FD0F50 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 162libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,00000000,00000000,?,00FA861E,secur32.dll,?,?,?,00F9D0EA), ref: 00FD0F5A
GetProcAddress.KERNEL32(00000000,LoadLibraryExW), ref: 00FD0F78
_wcspbrk.LIBCMT ref: 00FD0F88

Strings

LoadLibraryExW, xrefs: 00FD0F72
AddDllDirectory, xrefs: 00FD0FC0
kernel32, xrefs: 00FD0F53

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: AddressHandleModuleProc_wcspbrk
String ID: AddDllDirectory$LoadLibraryExW$kernel32
API String ID: 3039737319-3974551115
Opcode ID: 15fa87ce569364b0603c6d395a1c1308d13c0ba7eae454c77ee00e5a5149efb6
Instruction ID: faf2d3e5e848c49a33bb7b52a8673663246095c8414e3acac590a070020f0aad
Opcode Fuzzy Hash: 15fa87ce569364b0603c6d395a1c1308d13c0ba7eae454c77ee00e5a5149efb6
Instruction Fuzzy Hash: E84138327053015BD3305B68AC45BABB39AFF84761F18452AFD82CB348EF6AE9549790

Function 00FDA9CF Relevance: 18.1, APIs: 12, Instructions: 139COMMON

Download Yara Rule

APIs

____lc_handle_func.LIBCMT ref: 00FDAA03
____lc_codepage_func.LIBCMT ref: 00FDAA0B
__GetLocaleForCP.LIBCPMT ref: 00FDAA34
____mb_cur_max_l_func.LIBCMT ref: 00FDAA4A
MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000002,?,00000000,00000000,00000001,?,00000000,00F13388,00000000,?,?,?,?), ref: 00FDAA69
____mb_cur_max_l_func.LIBCMT ref: 00FDAA77
___pctype_func.LIBCMT ref: 00FDAA9C
____mb_cur_max_l_func.LIBCMT ref: 00FDAAC2
____mb_cur_max_l_func.LIBCMT ref: 00FDAADA
____mb_cur_max_l_func.LIBCMT ref: 00FDAAF2
MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,?,00000000,00000000,00000001,?,00000000,00F13388,00000000,?,?,?,?), ref: 00FDAAFF
MultiByteToWideChar.KERNEL32(?,00000009,?,00000001,?,00000000,00000000,00000001,?,00000000,00F13388,00000000,?,?,?,?), ref: 00FDAB30

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ____mb_cur_max_l_func$ByteCharMultiWide$Locale____lc_codepage_func____lc_handle_func___pctype_func
String ID:
API String ID: 3819326198-0
Opcode ID: 03d11c70420e9ff0314d705804b22afda650ad1fcbdaff00193bed6a833cd1ba
Instruction ID: b84d6e9c65f0bc0b6a171a8acf9fda50bb56c12c561e7fa69e0975b8883e5eaa
Opcode Fuzzy Hash: 03d11c70420e9ff0314d705804b22afda650ad1fcbdaff00193bed6a833cd1ba
Instruction Fuzzy Hash: 2241EB31504242EEDB215F35DC41B793BAAAF05361F198227F855CA292E738CD90FB56

Function 00F26440 Relevance: 17.8, APIs: 3, Strings: 7, Instructions: 305stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F12580: _memcpy_s.LIBCMT ref: 00F125FD

lstrlenW.KERNEL32(?,DOWNLOAD_VERSION,00000010), ref: 00F26685
lstrlenA.KERNEL32(?,00000000,00000000,000000FF,00000000,00000001,00000003), ref: 00F26708
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00F26774

Strings

download_setup_url_trial, xrefs: 00F265B6
open, xrefs: 00F2676E
free, xrefs: 00F2664D
download_setup_url_free, xrefs: 00F2656F
DOWNLOAD_VERSION, xrefs: 00F26615
Click_Download_Offline, xrefs: 00F26479
Download_Failed, xrefs: 00F264A3

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: lstrlen$ExecuteShell_memcpy_s
String ID: Click_Download_Offline$DOWNLOAD_VERSION$Download_Failed$download_setup_url_free$download_setup_url_trial$free$open
API String ID: 825883226-2322613642
Opcode ID: f90f7ae500b8d24dba410a27194a5b095313e6103f0107272295c15936c364e2
Instruction ID: e049ad1813c7fc14a011aa32acf1e4e033888629f1d4927c5227cf28927856a1
Opcode Fuzzy Hash: f90f7ae500b8d24dba410a27194a5b095313e6103f0107272295c15936c364e2
Instruction Fuzzy Hash: 09C10371D01358EBDF10DFA8DC417EEBB75AF44300F1441AEE409AB281DB795A85DB91

Function 00F75862 Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 265COMMON

Download Yara Rule

APIs

CharNextW.USER32(?), ref: 00F7590D
CharNextW.USER32(?), ref: 00F7591C

Strings

, xrefs: 00F75865

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-3916222277
Opcode ID: fd70d3b2d2859abc9638f49f99fef4e64dae71103ced52ca6b98c9e81e384621
Instruction ID: eb541ffa942b91e28e7ade9ebd79734558065da00bee73149378a70034c172e6
Opcode Fuzzy Hash: fd70d3b2d2859abc9638f49f99fef4e64dae71103ced52ca6b98c9e81e384621
Instruction Fuzzy Hash: 07A18FB0A087818BD724DF24D885BABB7E5AFC5310F04882EE989D7341D739E945DB53

Function 00F7587A Relevance: 16.8, APIs: 11, Instructions: 296COMMON

Download Yara Rule

APIs

CharNextW.USER32 ref: 00F758A7
__wcstoi64.LIBCMT ref: 00F758BD
CharNextW.USER32(?), ref: 00F7590D
CharNextW.USER32(?), ref: 00F7591C

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CharNext$__wcstoi64
String ID:
API String ID: 1114731063-0
Opcode ID: 7da5d6d1c63b9a69b38ee3b034b9332f2c53f317ad7113c169d7c07810846793
Instruction ID: 225782aebdece58a920da8e775dabeddaf768004f46ee093aacbf75146f32c75
Opcode Fuzzy Hash: 7da5d6d1c63b9a69b38ee3b034b9332f2c53f317ad7113c169d7c07810846793
Instruction Fuzzy Hash: C1B16DB0A083818BD724DF24D885BABB7E5AF85310F04882EF989D7241E779E945DB53

Function 00F7D600 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 356COMMON

Download Yara Rule

APIs

PtInRect.USER32(?,?,?), ref: 00F7D6DC

Strings

P, xrefs: 00F7D9B8
menu, xrefs: 00F7D7AB

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Rect
String ID: P$menu
API String ID: 400858303-3578578207
Opcode ID: 447b0135d3dd5a8bd65981d5c95df70eda4ec1baedcb3270584e32a590577d8e
Instruction ID: 2000597b10724c2950b8f5231999691e3ae202ee9a55a34982ee46a7936e63c7
Opcode Fuzzy Hash: 447b0135d3dd5a8bd65981d5c95df70eda4ec1baedcb3270584e32a590577d8e
Instruction Fuzzy Hash: 17B1A476B002004BCB20DF68D8C0A6973B6AF85371F5885BBEE4D8F246DA36DC599761

Function 00FA9820 Relevance: 16.1, APIs: 2, Strings: 7, Instructions: 310COMMON

Download Yara Rule

APIs

_swscanf.LIBCMT ref: 00FA987F

Part of subcall function 00FDFA6E: _vscan_fn.LIBCMT ref: 00FDFA85

__wcstoui64.LIBCMT ref: 00FA9953

Strings

RESOLVE %s:%d is - old addresses discarded!, xrefs: 00FA9ADD
%255[^:]:%d, xrefs: 00FA9879
Couldn't parse CURLOPT_RESOLVE entry '%s'!, xrefs: 00FA9A55
Ignoring resolve address '%s', missing IPv6 support., xrefs: 00FA9A05
Resolve address '%s' found illegal!, xrefs: 00FA9A77
Couldn't parse CURLOPT_RESOLVE removal entry '%s'!, xrefs: 00FA988F
Added %s:%d:%s to DNS cache, xrefs: 00FA9B47

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __wcstoui64_swscanf_vscan_fn
String ID: %255[^:]:%d$Added %s:%d:%s to DNS cache$Couldn't parse CURLOPT_RESOLVE entry '%s'!$Couldn't parse CURLOPT_RESOLVE removal entry '%s'!$Ignoring resolve address '%s', missing IPv6 support.$RESOLVE %s:%d is - old addresses discarded!$Resolve address '%s' found illegal!
API String ID: 1797087322-3873099096
Opcode ID: 4f07946e349cdc15823c862ebd18d81df5bf45ed3bdc8466ff84c00ae52b8b9e
Instruction ID: 80e6b9f4158f8a19455d565a4282b0df40772be0d39de16987e399d27ebcd5ec
Opcode Fuzzy Hash: 4f07946e349cdc15823c862ebd18d81df5bf45ed3bdc8466ff84c00ae52b8b9e
Instruction Fuzzy Hash: A1A1B2B290C3416FD720DF24DC85F6B77D9AB86354F04453DF88987242E6B9E908D7A2

Function 00F7F4C0 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 247COMMON

Download Yara Rule

APIs

__wcstoi64.LIBCMT ref: 00F7F612
__wcstoi64.LIBCMT ref: 00F7F62B

Strings

step, xrefs: 00F7F648
imm, xrefs: 00F7F69A
true, xrefs: 00F7F6D3
thumbsize, xrefs: 00F7F5C3
thumbpushedimage, xrefs: 00F7F573
thumbimage, xrefs: 00F7F4D1
thumbhotimage, xrefs: 00F7F523

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __wcstoi64
String ID: imm$step$thumbhotimage$thumbimage$thumbpushedimage$thumbsize$true
API String ID: 398114495-535450508
Opcode ID: 3fe208642cc1c7bda0dcdc1253ef6563e16066f9f84072b6ae9155536c06bea8
Instruction ID: a49420649debed2ac15c89f746a2ef049945d3338e73d8b27911de501cd221cc
Opcode Fuzzy Hash: 3fe208642cc1c7bda0dcdc1253ef6563e16066f9f84072b6ae9155536c06bea8
Instruction Fuzzy Hash: 37719353B1000156DB35AE38DC81AB57392FB75B30BD8867BE949CB298E623DD48D352

Function 00F52EE1 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 244COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 00F52EE7
__wcsicoll.LIBCMT ref: 00F52F29
_memset.LIBCMT ref: 00F533AE

Part of subcall function 00FDB3B2: _malloc.LIBCMT ref: 00FDB3CC

Strings

Container, xrefs: 00F52EE1
true, xrefs: 00F533E2
TabLayout, xrefs: 00F52F23
ScrollBar, xrefs: 00F52F81
cover, xrefs: 00F533CB

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __wcsicoll$_malloc_memset
String ID: Container$ScrollBar$TabLayout$cover$true
API String ID: 1497606448-799656983
Opcode ID: 35534758b6cbe022f2150cd2cb7137518b31fbf0288ff6f0311c1d1b07233108
Instruction ID: b1a0e44c6eff1713704c6024f4cc76d83b7136159086f64d6f921b46c6f35ff2
Opcode Fuzzy Hash: 35534758b6cbe022f2150cd2cb7137518b31fbf0288ff6f0311c1d1b07233108
Instruction Fuzzy Hash: 0181E872A043428BD720DF58C881B6EB3E5BFC8395F14052DEE8987241EB75DE49E782

Function 00F52FC7 Relevance: 16.0, APIs: 4, Strings: 5, Instructions: 235COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 00F52FCD
__wcsicoll.LIBCMT ref: 00F5300F
_memset.LIBCMT ref: 00F533AE

Part of subcall function 00FDB3B2: _malloc.LIBCMT ref: 00FDB3CC

Strings

TileLayout, xrefs: 00F53009
true, xrefs: 00F533E2
cover, xrefs: 00F533CB
WebBrowser, xrefs: 00F53049
ListHeader, xrefs: 00F52FC7

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __wcsicoll$_malloc_memset
String ID: ListHeader$TileLayout$WebBrowser$cover$true
API String ID: 1497606448-1509296067
Opcode ID: c9759b2a4cc4751d8210c0f9a47f10ebfb8913a3f5eb7493090c5a656f1e4c65
Instruction ID: ad134871b065e5b96ff200ebe5c8d0850afeb86f0bf4d564bb2b34a22e1c1ad2
Opcode Fuzzy Hash: c9759b2a4cc4751d8210c0f9a47f10ebfb8913a3f5eb7493090c5a656f1e4c65
Instruction Fuzzy Hash: 1B81C771A043429BD720DF58CC81B6EB3E5AFD4395F44052DEE8987241EB35DA49EB82

Function 00FC6D30 Relevance: 16.0, APIs: 1, Strings: 8, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 00FDD02A: __fsopen.LIBCMT ref: 00FDD037

_fgets.LIBCMT ref: 00FC6E2F

Strings

HOME, xrefs: 00FC6DA2
%s%s%s, xrefs: 00FC6DC8
, xrefs: 00FC6E48, 00FC6FD1
_netrc, xrefs: 00FC6DBD
machine, xrefs: 00FC6F5E, 00FC6F95
login, xrefs: 00FC6F2C
default, xrefs: 00FC6FAE
password, xrefs: 00FC6F45

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __fsopen_fgets
String ID: $%s%s%s$HOME$_netrc$default$login$machine$password
API String ID: 1017413239-828792305
Opcode ID: 988f73feea19c19780a82991391233920308659d8bb219763f8dbafc80c0926e
Instruction ID: 60b951644eb9112bf46b66f7020656823336d84522de0ad36a9b8337dc4cb7e7
Opcode Fuzzy Hash: 988f73feea19c19780a82991391233920308659d8bb219763f8dbafc80c0926e
Instruction Fuzzy Hash: 1F71E37190D3439BD721DA28EE06FAB7AD46F85328F04051DF884C6241E779D948E792

Function 00F9EBA0 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 213COMMON

Download Yara Rule

APIs

_swscanf.LIBCMT ref: 00F9EBC6

Part of subcall function 00FDFA6E: _vscan_fn.LIBCMT ref: 00FDFA85

__wcstoi64.LIBCMT ref: 00F9EDCB

Strings

;type=%c, xrefs: 00F9ECCA
], xrefs: 00F9EBD7
%s://%s%s%s:%d%s%s%s, xrefs: 00F9ED2D
[%*45[0123456789abcdefABCDEF:.]%c, xrefs: 00F9EBC0
IPv6 closing bracket followed by '%c', xrefs: 00F9EC15
Port number out of range, xrefs: 00F9EE2F
Port number ended with '%c', xrefs: 00F9EDE8

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __wcstoi64_swscanf_vscan_fn
String ID: %s://%s%s%s:%d%s%s%s$;type=%c$IPv6 closing bracket followed by '%c'$Port number ended with '%c'$Port number out of range$[%*45[0123456789abcdefABCDEF:.]%c$]
API String ID: 1561003206-1118921868
Opcode ID: 932ff04b7b43c39ffe9d53387b2f26310519870496b4cf2a81b94a73487e3127
Instruction ID: f4cddb245682867d40492aad11084c28f24d539d498a57027c1f612c25be45aa
Opcode Fuzzy Hash: 932ff04b7b43c39ffe9d53387b2f26310519870496b4cf2a81b94a73487e3127
Instruction Fuzzy Hash: A1712E719047459BFB20DF39DC41BAB73D5EF84711F48442EE48E8B341E639A544DB62

Function 00F54E90 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 208COMMON

Download Yara Rule

APIs

MapWindowPoints.USER32(?,00000000,?,00000002), ref: 00F54FF1
MonitorFromWindow.USER32(?,00000001), ref: 00F55030
GetMonitorInfoW.USER32(00000000), ref: 00F55037
MapWindowPoints.USER32(?,00000000,?,00000002), ref: 00F55098
GetParent.USER32(?), ref: 00F550DF
GetParent.USER32(?), ref: 00F550E6
GetParent.USER32(00000000), ref: 00F550EB
ShowWindow.USER32(?,00000005), ref: 00F550F7

Strings

(, xrefs: 00F55028

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Window$Parent$MonitorPoints$FromInfoShow
String ID: (
API String ID: 2070885993-3887548279
Opcode ID: 8198028913a203e7bb5c922ec64bf11d3dbb1bc1dd74355fac5f2f5cda053f76
Instruction ID: 2f1b10d178b97d8d94fa27c65969ce0d36a081a880a6e0c6cedb5f2df73a4e19
Opcode Fuzzy Hash: 8198028913a203e7bb5c922ec64bf11d3dbb1bc1dd74355fac5f2f5cda053f76
Instruction Fuzzy Hash: 5E81E2B4A087019FC354CF28C990A5ABBE1BF88700F508A2DF999C7351EB74E945CF96

Function 00F538E0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 176COMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 00F5390B
GetClientRect.USER32(?,?), ref: 00F5391A
IsZoomed.USER32(?), ref: 00F53924
__wcsicoll.LIBCMT ref: 00F53A67
__wcsicoll.LIBCMT ref: 00F53A82
__wcsicoll.LIBCMT ref: 00F53A9D

Strings

Option, xrefs: 00F53A78
Text, xrefs: 00F53A93
Button, xrefs: 00F53A5D

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __wcsicoll$Client$RectScreenZoomed
String ID: Button$Option$Text
API String ID: 1353371937-3941267017
Opcode ID: 7631092a3edd9658a4e9d08ee77def54899f821c4626912fcb9dfa571847f31d
Instruction ID: 20cb75fe60fece96b2ffa41ad08c550075c7c6ffa70fa08fef5f9c651ac9fbc6
Opcode Fuzzy Hash: 7631092a3edd9658a4e9d08ee77def54899f821c4626912fcb9dfa571847f31d
Instruction Fuzzy Hash: FD519E367042014BC324CE6DE880D6BB3E6FBC8351F044A2EF985C7345D635ED599B91

Function 00FB5280 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 144COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00FB5292

Part of subcall function 00FDB986: GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,00F163C6,00000000,8F2D4ADD), ref: 00FDB991
Part of subcall function 00FDB986: __aulldiv.LIBCMT ref: 00FDB9B1

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FB52E4
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FB5348
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FB53A0
__time64.LIBCMT ref: 00FB53D6

Strings

gfff, xrefs: 00FB52FC
Connection time-out, xrefs: 00FB52B7
gfff, xrefs: 00FB5369
set timeouts for state %d; Total %ld, retry %d maxtry %d, xrefs: 00FB53C7

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$Time__time64$FileSystem__aulldiv
String ID: Connection time-out$gfff$gfff$set timeouts for state %d; Total %ld, retry %d maxtry %d
API String ID: 2699399908-870032562
Opcode ID: 2886c78874be5151cd1a8a7a3b2330ff376f62281bad66c071fac13d72fa5036
Instruction ID: 93fee85771e7f8c66f84a5768800404bc0c6a273b712beb09b01fc3e778f65cf
Opcode Fuzzy Hash: 2886c78874be5151cd1a8a7a3b2330ff376f62281bad66c071fac13d72fa5036
Instruction Fuzzy Hash: 684184B1A01B049BD724DF2ADC41B57B3EABB88740F088A2DE885CB745E778F8019B50

Function 00F544F0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 134windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00F54563
PostMessageW.USER32(?,00000010,00000001,00000000), ref: 00F54577
SendMessageW.USER32(?,00000112,0000F020,?), ref: 00F545DE
SendMessageW.USER32(?,00000112,0000F030,?), ref: 00F5462E
SendMessageW.USER32(?,00000112,0000F120,00000000), ref: 00F5465B

Strings

maxbtn, xrefs: 00F545E6
minbtn, xrefs: 00F54593
closebtn, xrefs: 00F54525
restorebtn, xrefs: 00F54639

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Message$Send$PostWindow
String ID: closebtn$maxbtn$minbtn$restorebtn
API String ID: 1810902224-318950520
Opcode ID: 8c655eea359cd9363a2a04c7cebafc22814839bf3dab4bd3f962a53fa3161402
Instruction ID: 0c6c77c8fa8ebc4348728e8af6d13882ec67fd3adf76a526a5cb2f1dd54cb3ef
Opcode Fuzzy Hash: 8c655eea359cd9363a2a04c7cebafc22814839bf3dab4bd3f962a53fa3161402
Instruction Fuzzy Hash: 5C41C9366002019BD624DF24D841BB67362AB74B69F488628FF96CB185F732F989E750

Function 00FDE2EA Relevance: 15.1, APIs: 10, Instructions: 95COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00FDE303

Part of subcall function 00FE4289: __calloc_impl.LIBCMT ref: 00FE429A
Part of subcall function 00FE4289: Sleep.KERNEL32(00000000), ref: 00FE42B1

__calloc_crt.LIBCMT ref: 00FDE327
__calloc_crt.LIBCMT ref: 00FDE343
__copytlocinfo_nolock.LIBCMT ref: 00FDE368
__setlocale_nolock.LIBCMT ref: 00FDE375
___removelocaleref.LIBCMT ref: 00FDE381
___freetlocinfo.LIBCMT ref: 00FDE388
__setmbcp_nolock.LIBCMT ref: 00FDE3A0
___removelocaleref.LIBCMT ref: 00FDE3B5
___freetlocinfo.LIBCMT ref: 00FDE3BC

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __calloc_crt$___freetlocinfo___removelocaleref$Sleep__calloc_impl__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 2969281212-0
Opcode ID: 4726374a0838e7108ad883b03bf632fda5dd2b077191c32fe51a532393524c2b
Instruction ID: 614a5712a22284c84c494b4ea24e23bfd79d585442dc89a030d3213c702844a3
Opcode Fuzzy Hash: 4726374a0838e7108ad883b03bf632fda5dd2b077191c32fe51a532393524c2b
Instruction Fuzzy Hash: 8C21D636504600EBE7217F2ADC06A2E7BE7EF91760B28442FF4845B391DB399800B651

Function 00FAE8B0 Relevance: 14.3, APIs: 2, Strings: 6, Instructions: 343COMMON

Download Yara Rule

Strings

After %ldms connect time, move on!, xrefs: 00FAEA22
Connection failed, xrefs: 00FAEB85
Connection time-out, xrefs: 00FAE94F
connect to %s port %ld failed: %s, xrefs: 00FAEB14
L', xrefs: 00FAEA30
Failed to connect to %s port %ld: %s, xrefs: 00FAED1E

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID:
String ID: After %ldms connect time, move on!$Connection failed$Connection time-out$Failed to connect to %s port %ld: %s$L'$connect to %s port %ld failed: %s
API String ID: 0-47163629
Opcode ID: 61b9a277a8441a9cc06fc7954ae686d84b6a4331c4fc2644101babe06d864c42
Instruction ID: a6fb1820dc79768a594c15dbf48cc0996e5bc79864f1ae00a4cd2de0aec16dcd
Opcode Fuzzy Hash: 61b9a277a8441a9cc06fc7954ae686d84b6a4331c4fc2644101babe06d864c42
Instruction Fuzzy Hash: E9D1DDB5A04701AFD314DF28D885B6BB7E5FF8A324F444A1DF85987391E734A840DB92

Function 00FA53A0 Relevance: 14.3, APIs: 5, Strings: 3, Instructions: 317COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00FA53EA

Strings

public key hash: sha256//%s, xrefs: 00FA546E
;sha256//, xrefs: 00FA54D0
sha256//, xrefs: 00FA53E4, 00FA554C

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _strncmp
String ID: public key hash: sha256//%s$;sha256//$sha256//
API String ID: 909875538-2998214618
Opcode ID: d1e656d4bf6d89656f9101653dbd08a7d91498001927218d8fa91d62313d1f93
Instruction ID: 1d719dc42f001e31a80d1478d24dab7a6629a0af060ee47121712f424388ceae
Opcode Fuzzy Hash: d1e656d4bf6d89656f9101653dbd08a7d91498001927218d8fa91d62313d1f93
Instruction Fuzzy Hash: D3A17EF2E047015BD7209E24CC9076FB79AEB82B34F884529FD855B301E73AED459791

Function 00F65120 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 284COMMON

Download Yara Rule

Strings

@, xrefs: 00F65406
headerclick, xrefs: 00F6543A

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID:
String ID: @$headerclick
API String ID: 0-2283687668
Opcode ID: 3d8c8ec5e1ae89cdc6574ff041d6b6d48357fd171eb43ab5dd9f641d640e07e2
Instruction ID: 4dc7767bd990fa3c69872468703474f6e3a271afc430da93c5113d263aefb613
Opcode Fuzzy Hash: 3d8c8ec5e1ae89cdc6574ff041d6b6d48357fd171eb43ab5dd9f641d640e07e2
Instruction Fuzzy Hash: 0DA1B172B006008BCB20DF68D881A6973A2EF85761F1846BADD49DF346DA36D845DBA0

Function 00F7AF30 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

PtInRect.USER32(?,?,?), ref: 00F7AFAC
PtInRect.USER32(?,?,?), ref: 00F7B005
PtInRect.USER32(?,?,?), ref: 00F7B057
PtInRect.USER32(?,?,?), ref: 00F7B0D1
LoadCursorW.USER32(00000000,00007F89), ref: 00F7B0F2
SetCursor.USER32(00000000), ref: 00F7B0F9

Strings

link, xrefs: 00F7B114

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Rect$Cursor$Load
String ID: link
API String ID: 1264107634-917281265
Opcode ID: a081a4ad510c9eef572e7064ace3a7d6090ef8a7c57e094bb8b393b6fc40471d
Instruction ID: d4e7b7287df24df47681b5bfe179eecc34ccff7e73af8b7a4cd3a619aeb3a01a
Opcode Fuzzy Hash: a081a4ad510c9eef572e7064ace3a7d6090ef8a7c57e094bb8b393b6fc40471d
Instruction Fuzzy Hash: 3381A771B002029BC724DF58D880BAAF3A5FBC5321F50866BE968D7241DB71EC65D7D2

Function 00FC8900 Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 245COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00FC898C

Strings

/../, xrefs: 00FC8A15
/./, xrefs: 00FC89BF
/.., xrefs: 00FC8A43
../, xrefs: 00FC89A3

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _strncmp
String ID: ../$/..$/../$/./
API String ID: 909875538-456519384
Opcode ID: a0e956f3ffb2306993312dbd70e2906e91df17678884f6d18288683d2d5dcd72
Instruction ID: 582cbc701d739054d9d7525f44abe1c57c4e362380eebb2be5e6177ad16651af
Opcode Fuzzy Hash: a0e956f3ffb2306993312dbd70e2906e91df17678884f6d18288683d2d5dcd72
Instruction Fuzzy Hash: 1871E852D081836AD7211A345E53F767F965B627E4F1C016ED8C6CB282EA2BCD0EE352

Function 00F53196 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 228COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 00F5319C
__wcsicoll.LIBCMT ref: 00F531DD
_memset.LIBCMT ref: 00F533AE

Part of subcall function 00FDB3B2: _malloc.LIBCMT ref: 00FDB3CC

Part of subcall function 00F666B0: _memset.LIBCMT ref: 00F66754

Strings

ListHBoxElement, xrefs: 00F531D7
ListTextElement, xrefs: 00F53196
true, xrefs: 00F533E2
", xrefs: 00F53200
cover, xrefs: 00F533CB

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __wcsicoll_memset$_malloc
String ID: "$ListHBoxElement$ListTextElement$cover$true
API String ID: 2079756205-2093988976
Opcode ID: 8671c8351e3e6e4c35d9183243c3ad473e94867b00e9f00ba9c9c3b21401551d
Instruction ID: e87ee6a1d2c2dd4d4498261e65c1e45c9fe7ff85efcaa09c639203b152549bb6
Opcode Fuzzy Hash: 8671c8351e3e6e4c35d9183243c3ad473e94867b00e9f00ba9c9c3b21401551d
Instruction Fuzzy Hash: B981E671A043429FD720DF58C881B6EB3E5AFC8395F14052DEE8987241EB75DE49EB82

Function 00F53239 Relevance: 14.2, APIs: 3, Strings: 5, Instructions: 220COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 00F5323F
__wcsicoll.LIBCMT ref: 00F53278
_memset.LIBCMT ref: 00F533AE

Part of subcall function 00FDB3B2: _malloc.LIBCMT ref: 00FDB3CC

Strings

HorizontalLayout, xrefs: 00F53239
true, xrefs: 00F533E2
ListLabelElement, xrefs: 00F53272
cover, xrefs: 00F533CB
$, xrefs: 00F53295

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __wcsicoll$_malloc_memset
String ID: $$HorizontalLayout$ListLabelElement$cover$true
API String ID: 1497606448-4185467953
Opcode ID: 15ebfa1d5f9a62091b8038ac446ed091ad4d96519a57ecc9853b246b1f840b73
Instruction ID: 4af6350f168bfd0fca44a8f5edb69a7a82231092790456bede499f9391e599a1
Opcode Fuzzy Hash: 15ebfa1d5f9a62091b8038ac446ed091ad4d96519a57ecc9853b246b1f840b73
Instruction Fuzzy Hash: 9F71E671A043428BDB20DF58C881B6EB3E5AFC8395F44052DEE8987241EB35DE49EB42

Function 00F26B50 Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 195COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00F26C62

Strings

result_abort, xrefs: 00F26E27
Installing, xrefs: 00F26DCC
Click_Exit_Bottomwindow, xrefs: 00F26BBE, 00F26D06, 00F26DBE
Downloading, xrefs: 00F26D14
Elapsedtime, xrefs: 00F26C93
wizardTab, xrefs: 00F26B9A
Download_Failed, xrefs: 00F26BCC

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __time64
String ID: Click_Exit_Bottomwindow$Download_Failed$Downloading$Elapsedtime$Installing$result_abort$wizardTab
API String ID: 399556195-3862032578
Opcode ID: 3ecd60537c8dca39c0cc6a9db65c781ee45997fc033d6c4e05ee3353f59ed224
Instruction ID: f33165fad6b72b0931bbbbc9e5f8524c8d3be110dd5c7ae7b16bc59cc28544be
Opcode Fuzzy Hash: 3ecd60537c8dca39c0cc6a9db65c781ee45997fc033d6c4e05ee3353f59ed224
Instruction Fuzzy Hash: F871B2311083809BC361EBA4DC51BCBB7E9AF95310F444A2DF59867286EB78A548D7B3

Function 00F44060 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 156timeCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,00000048,00000104,8F2D4ADD,00000008,?,?,00000000), ref: 00F440AF
_strrchr.LIBCMT ref: 00F440BC
GetLocalTime.KERNEL32 ref: 00F44105
_fprintf.LIBCMT ref: 00F441BE
_fprintf.LIBCMT ref: 00F441DF
OutputDebugStringA.KERNEL32(?), ref: 00F44205

Strings

MyLogInfo: %d:%d:%d:%d , xrefs: 00F441B8
\log.txt, xrefs: 00F44110

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _fprintf$DebugFileLocalModuleNameOutputStringTime_strrchr
String ID: MyLogInfo: %d:%d:%d:%d $\log.txt
API String ID: 3038678317-2026191470
Opcode ID: a02f129a6c82d1d660290990a860e39067eba2ea2eed06cd1ccdf0f7537bb6d4
Instruction ID: c98665ce31713459e4185a3be6e4a0f910d8e10701353d902b2635569cf72fdc
Opcode Fuzzy Hash: a02f129a6c82d1d660290990a860e39067eba2ea2eed06cd1ccdf0f7537bb6d4
Instruction Fuzzy Hash: 27519EB18083809FD321DF64C881AABFBE9BFC9700F44492EF58997201EA79A544DB57

Function 00FC7020 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 134COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FC7060
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FC7090
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FC70EF
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FC7121

Strings

%3I64dd %02I64dh, xrefs: 00FC712E
%7I64dd, xrefs: 00FC7149
%2I64d:%02I64d:%02I64d, xrefs: 00FC70D1
--:--:--, xrefs: 00FC7034

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: %2I64d:%02I64d:%02I64d$%3I64dd %02I64dh$%7I64dd$--:--:--
API String ID: 885266447-1858174321
Opcode ID: 15338b7c3e701f3f768655810094a0576890726ff5fe5e878f98e0279806a853
Instruction ID: 7830abdd30a35e4b85e5e4ac364316b45a56cc8f3e8e825cc4a195f1847c4783
Opcode Fuzzy Hash: 15338b7c3e701f3f768655810094a0576890726ff5fe5e878f98e0279806a853
Instruction Fuzzy Hash: 7B316A727483457EF220EA69AC83F3BB79CDBC5F54F04461CF204AB182D9A5AC8093A0

Function 00F7EF60 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 447COMMON

Download Yara Rule

Strings

valuechanged, xrefs: 00F7F0BF, 00F7F11C, 00F7F14F, 00F7F276
@, xrefs: 00F7F3CA

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID:
String ID: @$valuechanged
API String ID: 0-1855188102
Opcode ID: 3c6a608ec26089c6d83bceef656ff8e4b5eda84f54d39b287f04899addd9e04b
Instruction ID: 293969a59251687270ec7b075f9791561457ac6e3cd368e4ffe4ce9cff663986
Opcode Fuzzy Hash: 3c6a608ec26089c6d83bceef656ff8e4b5eda84f54d39b287f04899addd9e04b
Instruction Fuzzy Hash: 34F18276B002418BCB14DE3CC8C579977A2BBC4720F1982BADD0D9F28ECA75AC59D791

Function 00F167B0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 188libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,GetNativeSystemInfo,H4f,ProductTestidSubKeyName,00000017), ref: 00F16908
GetProcAddress.KERNEL32(00000000), ref: 00F1690F

Part of subcall function 00F15860: RegOpenKeyExW.ADVAPI32(80000002,?,00000000,?,8F2D4ADD), ref: 00F15903
Part of subcall function 00F15860: _memset.LIBCMT ref: 00F1591D
Part of subcall function 00F15860: RegQueryValueExW.ADVAPI32(00000200,?,00000000,?,?,00000200), ref: 00F15959
Part of subcall function 00F15860: RegCloseKey.ADVAPI32(8F2D4ADD), ref: 00F1598F

Strings

ProductTestidSubKeyName, xrefs: 00F16899
H4f, xrefs: 00F16864, 00F168E0
ProductVerSubKey, xrefs: 00F1681B
GetNativeSystemInfo, xrefs: 00F168F6
kernel32, xrefs: 00F168FB

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: AddressCloseHandleModuleOpenProcQueryValue_memset
String ID: GetNativeSystemInfo$H4f$ProductTestidSubKeyName$ProductVerSubKey$kernel32
API String ID: 2143101283-471212024
Opcode ID: 0ef3557093f78fa46212ae35d840a7aed18e20b8892e4be5bd7ae1abd3d7edea
Instruction ID: 8ca9c0f0530d6f4ee6ab564d42003360d4d5f14ecad141d302ce9def49f76618
Opcode Fuzzy Hash: 0ef3557093f78fa46212ae35d840a7aed18e20b8892e4be5bd7ae1abd3d7edea
Instruction Fuzzy Hash: FC71A0B1908380DFD324DF29D842B4BBBE5AB94714F44891DF0C987282D7B9D548DBA3

Function 00F66980 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

PtInRect.USER32(?,?,?), ref: 00F669F0
PtInRect.USER32(?,?,?), ref: 00F66A42
PtInRect.USER32(?,?,?), ref: 00F66A9A
LoadCursorW.USER32(00000000,00007F89), ref: 00F66ABB
SetCursor.USER32(00000000), ref: 00F66AC2
PtInRect.USER32(?,?,?), ref: 00F66B3D

Strings

link, xrefs: 00F66ADD

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Rect$Cursor$Load
String ID: link
API String ID: 1264107634-917281265
Opcode ID: 1b1b83621634787303fb7fd482934a9f62e297385e939b1a8227915c012d1b36
Instruction ID: daa2805777f53bac52784927eabfd7d42d6d108bdda903b81f9216f2cdcb0377
Opcode Fuzzy Hash: 1b1b83621634787303fb7fd482934a9f62e297385e939b1a8227915c012d1b36
Instruction Fuzzy Hash: 0B518171B007029BC724DF68D881A6AF3A5FFC5724F008629E968E7241DB75EC25DBD1

Function 00FB9210 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 128networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(?), ref: 00FB926B
htons.WS2_32(?), ref: 00FB927C
send.WS2_32(?,?,00000003,00000000), ref: 00FB9303
WSAGetLastError.WS2_32 ref: 00FB930F
send.WS2_32(?,?,00000002,00000000), ref: 00FB934B
WSAGetLastError.WS2_32 ref: 00FB9351

Strings

Sending data failed (%d), xrefs: 00FB9316, 00FB9358

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ErrorLasthtonssend
String ID: Sending data failed (%d)
API String ID: 2027122571-2319402659
Opcode ID: a93629e9e2fefcad7fe71ca32a99386f0dcc3efc2d84bd0bb9f1f18ef70d0a44
Instruction ID: e088868b03e28116f44a329963a5cfc92ed96a6de594d21898b4a09fc30dfbc7
Opcode Fuzzy Hash: a93629e9e2fefcad7fe71ca32a99386f0dcc3efc2d84bd0bb9f1f18ef70d0a44
Instruction Fuzzy Hash: 2941F6746083829FD712CF69CC81AA67BA9FF69350F240645FA99CB381D774A910CF61

Function 00F25200 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 127fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F25280
GetTempPathW.KERNEL32(00000104,?,?,00000000,?), ref: 00F25292
CreateFileW.KERNEL32(00000000,C0000000,00000003,00000000,00000002,00000080,00000000,?,00000000,000000FF,01016248,00000001,?,?,H4f,SetupLogName), ref: 00F2536F
CloseHandle.KERNEL32(00000000), ref: 00F25388
DeleteFileW.KERNEL32(00000000), ref: 00F25396

Strings

H4f, xrefs: 00F252F7
SetupLogName, xrefs: 00F252AD

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: File$CloseCreateDeleteHandlePathTemp_memset
String ID: H4f$SetupLogName
API String ID: 1280845822-4248536123
Opcode ID: 98777dc4125db281de4be29f6e0d1f16656fe827b25aee8a4b6a76deccb8f2c0
Instruction ID: c3216586e4bee3b55fbd9d119bb30f8e04a4f851eb0ed2027b91e5dd65d736c8
Opcode Fuzzy Hash: 98777dc4125db281de4be29f6e0d1f16656fe827b25aee8a4b6a76deccb8f2c0
Instruction Fuzzy Hash: 4B41E7B1504380AFD320EF28DC8AB5FBBE9AB84714F44451DF5858B281D7BEE944CB92

Function 00F17220 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(00000059), ref: 00F172BE
GetSystemMetrics.USER32(00000059), ref: 00F172CF

Strings

Microsoft Windows 2000, xrefs: 00F172FF
Microsoft Windows Server 2003, xrefs: 00F172C6
Microsoft Windows Server 2003 R2, xrefs: 00F172D6
Microsoft Windows XP Professional x64 Edition, xrefs: 00F17298
Microsoft Windows XP, xrefs: 00F172F6

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: MetricsSystem
String ID: Microsoft Windows 2000$Microsoft Windows Server 2003$Microsoft Windows Server 2003 R2$Microsoft Windows XP$Microsoft Windows XP Professional x64 Edition
API String ID: 4116985748-3210145729
Opcode ID: f3f1116fe4d4371abd652585206cecd0fd7390a625f0c3eb29e422519b7a2576
Instruction ID: ab58702335ae6b4095356c64d6f5fcf877bacd3b1f5c77315bdac29065251934
Opcode Fuzzy Hash: f3f1116fe4d4371abd652585206cecd0fd7390a625f0c3eb29e422519b7a2576
Instruction Fuzzy Hash: D821D372A4C3419BC328EF2DDD01B8777E4EB88B24F00452EF449C7680D6BAD444ABA6

Function 00FA8990 Relevance: 12.3, APIs: 8, Instructions: 310networkCOMMON

Download Yara Rule

APIs

select.WS2_32(00000005,00000000,00000000,?,?), ref: 00FA8C0E
WSAGetLastError.WS2_32(?,?,?,?,?), ref: 00FA8C19

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ErrorLastselect
String ID:
API String ID: 215497628-0
Opcode ID: 90110b64aca4798e881c43d85ebd21e0251e27c9ffabac253ce4d95fc283a305
Instruction ID: 253755a187dd112395ad90a38a63d49d7f5473fa84e653e1c4846af8b60d997e
Opcode Fuzzy Hash: 90110b64aca4798e881c43d85ebd21e0251e27c9ffabac253ce4d95fc283a305
Instruction Fuzzy Hash: 5AB1B5B1D047418FC734DF18C88066BB7E5FFC53B0F148A2EE499872A0EBB599469B52

Function 00F16F80 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 33libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Wininet.dll), ref: 00F16F86
GetProcAddress.KERNEL32(00000000,InternetCheckConnectionA), ref: 00F16F99
FreeLibrary.KERNEL32(00000000), ref: 00F16FCA

Strings

InternetCheckConnectionA, xrefs: 00F16F93
https://www.baidu.com/, xrefs: 00F16FB7
Wininet.dll, xrefs: 00F16F81
https://www.google.com/, xrefs: 00F16FA9

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: InternetCheckConnectionA$Wininet.dll$https://www.baidu.com/$https://www.google.com/
API String ID: 145871493-516931071
Opcode ID: cdd7b4bb04d1daec8f5ff7b414c00cda550df2e4700d06a50e3c94008395125d
Instruction ID: 9b288e5ba372378635a31c706b73daa34e6cd35182ad64c60073d86e58ca21ea
Opcode Fuzzy Hash: cdd7b4bb04d1daec8f5ff7b414c00cda550df2e4700d06a50e3c94008395125d
Instruction Fuzzy Hash: F8F0A03265431166D632123A7C49FEB2E994BD7F60F040018F880E914CEAAFC88292A1

Function 00F822E0 Relevance: 12.2, APIs: 8, Instructions: 240fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4A110: _wcsncpy.LIBCMT ref: 00F4A1A1

GetFileSize.KERNEL32(00000000,00000000), ref: 00F823BC
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00F8240A
CloseHandle.KERNEL32(00000000), ref: 00F82411
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00F82388

Part of subcall function 00F49FD0: _malloc.LIBCMT ref: 00F4A01D

CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 00F82564
GetFileSize.KERNEL32(00000000,00000000), ref: 00F82574
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000,00000000), ref: 00F8259D
CloseHandle.KERNEL32(00000000), ref: 00F825A4

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: File$CloseCreateHandleReadSize$_malloc_wcsncpy
String ID:
API String ID: 2364347979-0
Opcode ID: fda2a26ceb2d5541a7bacb2f65598bb733f46030c73cd4c4cf0c8ab2b382fd41
Instruction ID: 27defbf14e486dc9a574019af6678d9bae09f8258e3ab1b7087761b3e0dbc3c0
Opcode Fuzzy Hash: fda2a26ceb2d5541a7bacb2f65598bb733f46030c73cd4c4cf0c8ab2b382fd41
Instruction Fuzzy Hash: 8D8127B2948340EBD771EF24DC85B5F73E8AF84720F184A19F4859B281EB79E9049793

Function 00FC58E0 Relevance: 10.9, APIs: 4, Strings: 2, Instructions: 377COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00FC5970

Strings

I64, xrefs: 00FC598D
I32, xrefs: 00FC596A

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _strncmp
String ID: I32$I64
API String ID: 909875538-3980630743
Opcode ID: a721b5086170cd4b312f56f87b49f4a64a00086f1a063d9ea115adb2e21f665f
Instruction ID: 2493a578f697aa50c19855cdf246f645135cf3b7ea5dbcbd22d99d45181f0fd5
Opcode Fuzzy Hash: a721b5086170cd4b312f56f87b49f4a64a00086f1a063d9ea115adb2e21f665f
Instruction Fuzzy Hash: 18E1F2B2904706CFD304CF14CA81F69B7A0FF84B58F28896DD84A4B252E77AF596DB41

Function 00F4B2A0 Relevance: 10.8, APIs: 7, Instructions: 274COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 00F4B379
DestroyWindow.USER32(?,?,?,?,?,?), ref: 00F4B3A9
DeleteDC.GDI32(?), ref: 00F4B3CC
DeleteDC.GDI32(?), ref: 00F4B3D9
DeleteObject.GDI32(?), ref: 00F4B3E6
DeleteObject.GDI32(?), ref: 00F4B3F3
ReleaseDC.USER32(?,?), ref: 00F4B407

Part of subcall function 00FDB0A2: __lock.LIBCMT ref: 00FDB0C0
Part of subcall function 00FDB0A2: ___sbh_find_block.LIBCMT ref: 00FDB0CB
Part of subcall function 00FDB0A2: ___sbh_free_block.LIBCMT ref: 00FDB0DA
Part of subcall function 00FDB0A2: RtlFreeHeap.NTDLL(00000000,?,01028420,0000000C,00FE4923,00000000,01028990,0000000C,00FE495D,?,?,?,00FEF11D,00000004,01028BE0,0000000C), ref: 00FDB10A
Part of subcall function 00FDB0A2: GetLastError.KERNEL32(?,00FEF11D,00000004,01028BE0,0000000C,00FE429F,?,?,00000000,00000000,00000000,?,00FE58EA,00000001,00000214), ref: 00FDB11B

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Delete$Object$DestroyErrorFreeHeapLastReleaseWindow___sbh_find_block___sbh_free_block__lock
String ID:
API String ID: 3455866663-0
Opcode ID: 0b3fd8d9a1a71ff3f85aecfceb5fc63407e8deb29d3832b7dc0132c3079f0916
Instruction ID: f2ca030349259713afd61ae885b38c43b5d3339c14ed0dc01f8643277d2204e3
Opcode Fuzzy Hash: 0b3fd8d9a1a71ff3f85aecfceb5fc63407e8deb29d3832b7dc0132c3079f0916
Instruction Fuzzy Hash: 329162B1A007019BE620DF75CC85BABB7EDAF54710F094929F85AC7242EB39F904E761

Function 00F532AD Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 204COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 00F532B3
_memset.LIBCMT ref: 00F533AE

Part of subcall function 00FDB3B2: _malloc.LIBCMT ref: 00FDB3CC

Strings

true, xrefs: 00F533E2
%, xrefs: 00F532D0
cover, xrefs: 00F533CB
ListContainerElement, xrefs: 00F532AD

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __wcsicoll_malloc_memset
String ID: %$ListContainerElement$cover$true
API String ID: 773177119-1578051369
Opcode ID: 9223701dd2c9b29cda44e4ed79d1a4d30e423b7800a6add8428d7de364116896
Instruction ID: f32b8645be6f3d81c304bfad5ee8ce9bda4679fd52e60325f482e22fce5bad35
Opcode Fuzzy Hash: 9223701dd2c9b29cda44e4ed79d1a4d30e423b7800a6add8428d7de364116896
Instruction Fuzzy Hash: CD71A331A042429BD720DF58C881B6EB3E5BFC8395F54052DEE8987241EB35DE49EB42

Function 00F83390 Relevance: 10.7, APIs: 7, Instructions: 177COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F01), ref: 00F833F4
SetCursor.USER32(00000000), ref: 00F833FB
IsWindow.USER32(?), ref: 00F83488
ShowWindow.USER32(?,00000001), ref: 00F83498
ReleaseCapture.USER32 ref: 00F83510
IsWindow.USER32(?), ref: 00F8356E
ShowWindow.USER32(?,00000001), ref: 00F8357E

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Window$CursorShow$CaptureLoadRelease
String ID:
API String ID: 3716655541-0
Opcode ID: 7893e792a19c5c6e7d94c990d3acc79aea55da8e8694db57f6afa281d646bc40
Instruction ID: 86753e78d66a5da91f901fc3214c523d9ab964ba0173f497e498c8556000dcda
Opcode Fuzzy Hash: 7893e792a19c5c6e7d94c990d3acc79aea55da8e8694db57f6afa281d646bc40
Instruction Fuzzy Hash: 2951D671B002039BDA25EF68D884BF9B396BF84720F184265E919CB361CB36ED51E7D1

Function 00F978D0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 165threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00F1A270: std::_String_base::_Xlen.LIBCPMT ref: 00F1A2BF
Part of subcall function 00F1A270: _memcpy_s.LIBCMT ref: 00F1A32A

Part of subcall function 00F121D0: _memcpy_s.LIBCMT ref: 00F12255

CreateThread.KERNEL32(00000000,00000000,00F97BC0,?,00000000,00000000), ref: 00F979EA
CreateThread.KERNEL32(00000000,00000000,00F98910,?,00000000,00000000), ref: 00F97A7B

Part of subcall function 00F96740: PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 00F9676E
Part of subcall function 00F96740: TranslateMessage.USER32(?), ref: 00F9678A
Part of subcall function 00F96740: DispatchMessageW.USER32(?), ref: 00F96791

CloseHandle.KERNEL32(00000000), ref: 00F97A8B
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00F97A90
CloseHandle.KERNEL32(00000000), ref: 00F97A9D

Strings

.temp, xrefs: 00F97939

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Message$CloseCreateHandleThread_memcpy_s$DispatchObjectPeekSingleString_base::_TranslateWaitXlenstd::_
String ID: .temp
API String ID: 1980237086-2462334126
Opcode ID: a1724b3a6fc0cd0fd65286c36de05f4e3eafe135c8f9fac9127f95b8e4f04b27
Instruction ID: c3f999f346d093d654eac3018cab34a18906df074970aa29f73ff3f277124252
Opcode Fuzzy Hash: a1724b3a6fc0cd0fd65286c36de05f4e3eafe135c8f9fac9127f95b8e4f04b27
Instruction Fuzzy Hash: 2A51CFB150C3849BEB21EF28CC41B8FBBE5AB85710F104A2DF69847391DB79A544CB93

Function 00F48EB0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 141COMMON

Download Yara Rule

APIs

CharNextW.USER32(00000000,00000000,?,?,?,00F48BDA,?), ref: 00F48F21
CharNextW.USER32(00000000,00000000,?,?,?,00F48BDA,?), ref: 00F48F59
CharNextW.USER32(00000000,?,00000022,00000000,?,?,?,00F48BDA,?), ref: 00F48FBC

Strings

Error while parsing attributes, xrefs: 00F48FDF
Error while parsing attribute string, xrefs: 00F49012
Expected attribute value, xrefs: 00F48FF4

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CharNext
String ID: Error while parsing attribute string$Error while parsing attributes$Expected attribute value
API String ID: 3213498283-2127762582
Opcode ID: d83515d12f6113d2ac9dd944ee209c528f4b14767aabdea35b6326f85715d91a
Instruction ID: 04e0fe2cd9cef2d505c202ade01157af88520ee849857a98e4bf14f62c145407
Opcode Fuzzy Hash: d83515d12f6113d2ac9dd944ee209c528f4b14767aabdea35b6326f85715d91a
Instruction Fuzzy Hash: 9B41B332A002408FD320BF6CD840A5AB7F6FF553B0B50486AE985CB291EBB55CC6E794

Function 00FC8E30 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 116COMMON

Download Yara Rule

APIs

_fseek.LIBCMT ref: 00FC8F4E

Strings

the ioctl callback returned %d, xrefs: 00FC8F0E
Cannot rewind mime/post data, xrefs: 00FC8F7E
seek callback returned error %d, xrefs: 00FC8ECA
necessary data rewind wasn't possible, xrefs: 00FC8F5B
ioctl callback returned error %d, xrefs: 00FC8F21

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _fseek
String ID: Cannot rewind mime/post data$ioctl callback returned error %d$necessary data rewind wasn't possible$seek callback returned error %d$the ioctl callback returned %d
API String ID: 2937370855-959247533
Opcode ID: 83edd4a473566c26c98f117314977a9f7a735672a6815dc600c8702af63a3ffe
Instruction ID: 0b40d5615ed0a6a05acda21db3ed71e51286a5b2534084b8131a76ed7a3e8d3c
Opcode Fuzzy Hash: 83edd4a473566c26c98f117314977a9f7a735672a6815dc600c8702af63a3ffe
Instruction Fuzzy Hash: D8314671A107006FF231A638ED47FEB72859F927A0F14052CF5589A1C1EBB8B887D295

Function 00FD0DE0 Relevance: 10.6, APIs: 7, Instructions: 109COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00FD0E64
VerSetConditionMask.KERNEL32(00000000,00000000,00000002,?), ref: 00FD0EB6
VerSetConditionMask.KERNEL32(00000000,?,00000001,?), ref: 00FD0EC1
VerSetConditionMask.KERNEL32(00000000,?,00000020,?,?,00000001,?), ref: 00FD0ECC
VerSetConditionMask.KERNEL32(00000000,?,00000010,?,?,00000020,?,?,00000001,?), ref: 00FD0ED7
VerSetConditionMask.KERNEL32(00000000,?,00000008,00000001,?,00000010,?,?,00000020,?,?,00000001,?), ref: 00FD0EE3
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 00FD0EEE

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion_memset
String ID:
API String ID: 3299124433-0
Opcode ID: a6c7c7710ed49577f6624fb819bdb4c302d97da356c7af47ad9aaa199365a495
Instruction ID: 23b77942c1cbfceb3a30da6782033972657225172bbe9156991f3e69a42b1215
Opcode Fuzzy Hash: a6c7c7710ed49577f6624fb819bdb4c302d97da356c7af47ad9aaa199365a495
Instruction Fuzzy Hash: A2317271508385ABD325DF648C45BABBBE9ABD9700F084D0EF1C84B381CBB59544DBA3

Function 00F45650 Relevance: 10.6, APIs: 7, Instructions: 109processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00F456C9
Process32FirstW.KERNEL32(00000000,?), ref: 00F456E2
OpenProcess.KERNEL32(00000001,00000000,0000022C,?,?,?), ref: 00F4571C
TerminateProcess.KERNEL32(00000000,00000009), ref: 00F45727
CloseHandle.KERNEL32(00000000), ref: 00F4572A
Process32NextW.KERNEL32(?,?), ref: 00F45736
CloseHandle.KERNEL32(00000000,?), ref: 00F45742

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 2696918072-0
Opcode ID: d24e92740dcca68b24f88c38127fa079be4ba4096537e9efe5bd08023053dff1
Instruction ID: 4ce5246297ceac6d528515fd2632de7fbfab34defe722cd61ae666ab43d9b107
Opcode Fuzzy Hash: d24e92740dcca68b24f88c38127fa079be4ba4096537e9efe5bd08023053dff1
Instruction Fuzzy Hash: 0D31B071504344ABD320EF64CC86F6BB7E9FF85754F044A2EF5858B241E639A8048796

Function 00F4EF30 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 102windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 00F4EF3D
SetFocus.USER32(?), ref: 00F4EF65
GetTickCount.KERNEL32 ref: 00F4EFAD
GetTickCount.KERNEL32 ref: 00F4F053

Strings

setfocus, xrefs: 00F4F07C
killfocus, xrefs: 00F4EFD6

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CountFocusTick
String ID: killfocus$setfocus
API String ID: 3897604831-1991930995
Opcode ID: 03279e378b21e4665a070d12c95195e9d09d0decdcbf5ff6cdf8538ce11f245c
Instruction ID: 957e36a1f14af2126f949741c1b11f61a525614ab5583e919eeb11ddcae716fa
Opcode Fuzzy Hash: 03279e378b21e4665a070d12c95195e9d09d0decdcbf5ff6cdf8538ce11f245c
Instruction Fuzzy Hash: 58411B70A04742AFC754DF28C881B5AFBE1BB88710F108A2DE99DD7381DB75A949CBC5

Function 00F80AF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 97threadCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00F80B02
GetGUIThreadInfo.USER32 ref: 00F80B6D
ClientToScreen.USER32(?,?), ref: 00F80B95
ScreenToClient.USER32(?,?), ref: 00F80BB4
PtInRect.USER32(?,?,00000000), ref: 00F80BC9

Part of subcall function 00F74080: CreatePenIndirect.GDI32(?), ref: 00F740B9
Part of subcall function 00F74080: SelectObject.GDI32(?,00000000), ref: 00F740C9
Part of subcall function 00F74080: MoveToEx.GDI32(?,00000000,?,?), ref: 00F740E6
Part of subcall function 00F74080: LineTo.GDI32(?,?,?), ref: 00F740F5
Part of subcall function 00F74080: SelectObject.GDI32(?,?), ref: 00F74101
Part of subcall function 00F74080: DeleteObject.GDI32(00000000), ref: 00F74104

Strings

0, xrefs: 00F80B65

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ClientObject$RectScreenSelect$CreateDeleteIndirectInfoLineMoveThread
String ID: 0
API String ID: 3254868366-4108050209
Opcode ID: 839c113e0a3776b00368b4c5238fd661f377f3d7e7a2c2562526565dc6f16972
Instruction ID: 66e253d44f79faa3547b5400331a531c45d1c719bc9ca2cca771d8067aa357d0
Opcode Fuzzy Hash: 839c113e0a3776b00368b4c5238fd661f377f3d7e7a2c2562526565dc6f16972
Instruction Fuzzy Hash: 3241D4B46043019FD314DF14C884B5ABBE5BBC9714F108A5DF989873A0DB71E945CB96

Function 00F1EA40 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F1EA6B
std::_Lockit::_Lockit.LIBCPMT ref: 00F1EA91
std::bad_exception::bad_exception.LIBCMT ref: 00F1EB15
__CxxThrowException@8.LIBCMT ref: 00F1EB24
std::locale::facet::facet_Register.LIBCPMT ref: 00F1EB3B

Strings

bad cast, xrefs: 00F1EB0C

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::facet_
String ID: bad cast
API String ID: 2820251361-3145022300
Opcode ID: 2ee1d4a28977cf59a28cc38c5e09c7b1667a850d4bb237b4e80165e6ea0231c4
Instruction ID: 2d65020bbd5c99011f71204aca9987b6d55c9cbef68220357e3f3b9d668a88ac
Opcode Fuzzy Hash: 2ee1d4a28977cf59a28cc38c5e09c7b1667a850d4bb237b4e80165e6ea0231c4
Instruction Fuzzy Hash: 7C31C3719043009FC725EF14D881B9A77E8FF54320F48451EF89297281DB3EAE45EB92

Function 00F1EB70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F1EB9B
std::_Lockit::_Lockit.LIBCPMT ref: 00F1EBC1
std::bad_exception::bad_exception.LIBCMT ref: 00F1EC45
__CxxThrowException@8.LIBCMT ref: 00F1EC54
std::locale::facet::facet_Register.LIBCPMT ref: 00F1EC6B

Strings

bad cast, xrefs: 00F1EC3C

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::facet_
String ID: bad cast
API String ID: 2820251361-3145022300
Opcode ID: b21602d6fffe706c7fe12f932dff95747533cf1eb6a361f3d4158f48cacf07d9
Instruction ID: 128a428f332b99c22822f38752ea478c44610f49fb9cce4a3e766027b791ac2d
Opcode Fuzzy Hash: b21602d6fffe706c7fe12f932dff95747533cf1eb6a361f3d4158f48cacf07d9
Instruction Fuzzy Hash: 7A31C171904300DFD724EF14DC81B9A77E4FB44320F480A1EE89297391EB3AAA84DBD2

Function 00F1ED70 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F1ED9B
std::_Lockit::_Lockit.LIBCPMT ref: 00F1EDC1
std::bad_exception::bad_exception.LIBCMT ref: 00F1EE45
__CxxThrowException@8.LIBCMT ref: 00F1EE54
std::locale::facet::facet_Register.LIBCPMT ref: 00F1EE6B

Strings

bad cast, xrefs: 00F1EE3C

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::facet_
String ID: bad cast
API String ID: 2820251361-3145022300
Opcode ID: 5f0b68dcec54bd8ccd716d2c98e750ce9b139f4672ea36edf2e398e455898cc5
Instruction ID: 6180fedf4caabf067371dc9f7f576252bda4c0f8c4a50238b8748ef23bec5992
Opcode Fuzzy Hash: 5f0b68dcec54bd8ccd716d2c98e750ce9b139f4672ea36edf2e398e455898cc5
Instruction Fuzzy Hash: 1931E4759043409FD728EF24D881B9A73E4BF44720F09461EFC9297281DB3AED85DB92

Function 00F1EF00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F1EF2B
std::_Lockit::_Lockit.LIBCPMT ref: 00F1EF51
std::bad_exception::bad_exception.LIBCMT ref: 00F1EFD5
__CxxThrowException@8.LIBCMT ref: 00F1EFE4
std::locale::facet::facet_Register.LIBCPMT ref: 00F1EFFB

Strings

bad cast, xrefs: 00F1EFCC

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::facet_
String ID: bad cast
API String ID: 2820251361-3145022300
Opcode ID: 046b0dfbe01ec775997db1192db0a21e1316bd4e773e9467513c98899804d53c
Instruction ID: 99510f017487bd8d42e998e08142e1f3c294525478436c2c0c712e3aeafedb94
Opcode Fuzzy Hash: 046b0dfbe01ec775997db1192db0a21e1316bd4e773e9467513c98899804d53c
Instruction Fuzzy Hash: F431D2719043009FC724EF10D881BAA73E4BB44324F48061EFD92973D2DB3AA985DB92

Function 00F2B4D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00F2B4FB
std::_Lockit::_Lockit.LIBCPMT ref: 00F2B521
std::bad_exception::bad_exception.LIBCMT ref: 00F2B5A5
__CxxThrowException@8.LIBCMT ref: 00F2B5B4
std::locale::facet::facet_Register.LIBCPMT ref: 00F2B5CB

Strings

bad cast, xrefs: 00F2B59C

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::facet_
String ID: bad cast
API String ID: 2820251361-3145022300
Opcode ID: c5972d1d6e66128ff6c504413ce4a5f895692d71130cc3cfff85ca33c69bc39e
Instruction ID: 542e912b07c4adae914ec5af5e11488ee9ad1d3f102ac5051474438e28b320dc
Opcode Fuzzy Hash: c5972d1d6e66128ff6c504413ce4a5f895692d71130cc3cfff85ca33c69bc39e
Instruction Fuzzy Hash: 6331B2719043109FC728DF24E882B5A73E4EB54720F08465EFD929B295DB39ED05EB92

Function 00F173D0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 87registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32 ref: 00F1744D
_memset.LIBCMT ref: 00F1746D
RegQueryValueExW.ADVAPI32 ref: 00F17497
RegCloseKey.ADVAPI32(8F2D4ADD), ref: 00F174D3

Strings

ProductName, xrefs: 00F17489
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 00F17430

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CloseOpenQueryValue_memset
String ID: ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion
API String ID: 3211720786-1787575317
Opcode ID: 6339b5e8f84fd0180a79a37ce0f29e9c54f31a80719df9408604018967ff0553
Instruction ID: 7b443a9755f1a4ac302a002e2ad288467176abd9aa84495dd5d5157315173d83
Opcode Fuzzy Hash: 6339b5e8f84fd0180a79a37ce0f29e9c54f31a80719df9408604018967ff0553
Instruction Fuzzy Hash: BC318C75548341ABD321DF15D849AABBBF9FFC8714F508A1EF089C7240E778A604CB92

Function 00F4C05E Relevance: 10.6, APIs: 7, Instructions: 83windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F4AB50: GetKeyState.USER32(00000011), ref: 00F4AB5C
Part of subcall function 00F4AB50: GetKeyState.USER32(00000002), ref: 00F4AB6A
Part of subcall function 00F4AB50: GetKeyState.USER32(00000001), ref: 00F4AB76
Part of subcall function 00F4AB50: GetKeyState.USER32(00000010), ref: 00F4AB82
Part of subcall function 00F4AB50: GetKeyState.USER32(00000012), ref: 00F4AB8E

GetTickCount.KERNEL32 ref: 00F4C0C3
GetActiveWindow.USER32 ref: 00F4C13D
GetWindow.USER32(?,00000004), ref: 00F4C14A
GetWindowLongW.USER32(?,000000F0), ref: 00F4C15B
GetParent.USER32(?), ref: 00F4C16F
SetFocus.USER32(00000000), ref: 00F4C17C
DestroyWindow.USER32(?), ref: 00F4C191

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: State$Window$ActiveCountDestroyFocusLongParentTick
String ID:
API String ID: 3380778118-0
Opcode ID: 389a7f34a0e7b704a4f5465511104da7c113c998cca5241bfd3c2f3a4a4ffe63
Instruction ID: 8b5706c51c72f323182de2ee329769aa101e3c068d8d34113f3df151d8c64e88
Opcode Fuzzy Hash: 389a7f34a0e7b704a4f5465511104da7c113c998cca5241bfd3c2f3a4a4ffe63
Instruction Fuzzy Hash: E3310A74509341CFE775CF64C894B9AB7E2BF88310F048A6EE989DB345DB359801DBA2

Function 00FE225C Relevance: 10.6, APIs: 7, Instructions: 71threadCOMMON

Download Yara Rule

APIs

___set_flsgetvalue.LIBCMT ref: 00FE228D
__calloc_crt.LIBCMT ref: 00FE2299
__getptd.LIBCMT ref: 00FE22A6
__initptd.LIBCMT ref: 00FE22AF
CreateThread.KERNEL32(?,?,00FE21D9,00000000,?,?), ref: 00FE22DD
GetLastError.KERNEL32(?,?,?,?,?,?,00000000), ref: 00FE22E7
__dosmaperr.LIBCMT ref: 00FE22FF

Part of subcall function 00FE0A22: __getptd_noexit.LIBCMT ref: 00FE0A22

Part of subcall function 00FDB267: __decode_pointer.LIBCMT ref: 00FDB272

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CreateErrorLastThread___set_flsgetvalue__calloc_crt__decode_pointer__dosmaperr__getptd__getptd_noexit__initptd
String ID:
API String ID: 3358092440-0
Opcode ID: 1136aaf259c273efb5d7107d289f555ab043edaeca62755a3fa932230286b8e7
Instruction ID: bbd6052cacfb758a813b6de954321f9904b36191ae9e3b105dc7f5110ed25c4a
Opcode Fuzzy Hash: 1136aaf259c273efb5d7107d289f555ab043edaeca62755a3fa932230286b8e7
Instruction Fuzzy Hash: AD11E772500289EFDB11BFA6DC4689E77A9EF14724B10403AF50192151EB79D950BB60

Function 00F967A0 Relevance: 10.6, APIs: 7, Instructions: 71fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000000,00000000,00000002,00000080,00000000,?,00F97CC5), ref: 00F967C3
CloseHandle.KERNEL32(00000000,?,00F97CC5), ref: 00F967EE
SetFilePointerEx.KERNEL32(00000000,?,?,00000000,00000000,?,00F97CC5), ref: 00F9681E
CloseHandle.KERNEL32(00000000,?,00F97CC5), ref: 00F96829
SetEndOfFile.KERNEL32(00000000,?,00F97CC5), ref: 00F9683F
CloseHandle.KERNEL32(00000000,?,00F97CC5), ref: 00F9684A
CloseHandle.KERNEL32(00000000,?,00F97CC5), ref: 00F96860

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CloseHandle$File$CreatePointer
String ID:
API String ID: 2551779904-0
Opcode ID: 3eac5a71462ef0fa6fd2c7897296c405380c78232adc1bfa8036d073214d721a
Instruction ID: 2b2f694d2d26e11a5e5f53084234e4b8e5fc3ed09bff95012201879364f2bf01
Opcode Fuzzy Hash: 3eac5a71462ef0fa6fd2c7897296c405380c78232adc1bfa8036d073214d721a
Instruction Fuzzy Hash: 2A11E131508311ABEA21A778EC09B9F37D5AF80334F008B18F1A5E62D4DB39D9858B96

Function 00FB5508 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 71COMMON

Download Yara Rule

APIs

__wcstoi64.LIBCMT ref: 00FB5576

Strings

got option=(%s) value=(%s), xrefs: 00FB5542
blksize parsed from OACK, xrefs: 00FB55B3
requested, xrefs: 00FB55AD
blksize, xrefs: 00FB555F
%s (%d) %s (%d), xrefs: 00FB55B8

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __wcstoi64
String ID: %s (%d) %s (%d)$blksize$blksize parsed from OACK$got option=(%s) value=(%s)$requested
API String ID: 398114495-3145650287
Opcode ID: b4692bcdb8db6647b7ac53cda252c1d3d6213aa9a6133aa3c543ac3666947cf1
Instruction ID: e09529230b07fc7249e75050de73b0ec040232864e79db2595e000d77ba65cf8
Opcode Fuzzy Hash: b4692bcdb8db6647b7ac53cda252c1d3d6213aa9a6133aa3c543ac3666947cf1
Instruction Fuzzy Hash: 4E113B71A043025FE611EE12DC86FF77399DB81B19F440928FC88D6243F66DDA449EA2

Function 00F44410 Relevance: 10.6, APIs: 7, Instructions: 68COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00F4441D
CreateFontW.GDI32(00000014,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,01018708), ref: 00F44444
SelectObject.GDI32(00000000,00000000), ref: 00F44454
GetTextExtentPoint32W.GDI32(00000000,?,?,00000008), ref: 00F4448E
SelectObject.GDI32(00000000,?), ref: 00F4449A
DeleteObject.GDI32(00000000), ref: 00F4449D
ReleaseDC.USER32(00000000,00000000), ref: 00F444A6

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Object$Select$CreateDeleteExtentFontPoint32ReleaseText
String ID:
API String ID: 518467826-0
Opcode ID: 95e7510706cd72c88e652e4708781d8a3f21595426a1eb17b436c54f2544e4ca
Instruction ID: aac67e195212f2f7ca2f9f08c6478a52682a7f86d67b8c59915072016dcb6f0c
Opcode Fuzzy Hash: 95e7510706cd72c88e652e4708781d8a3f21595426a1eb17b436c54f2544e4ca
Instruction Fuzzy Hash: 57115E31144201ABC711DF549C85FAB7BA5EB89711F054429F98586204D73AA519CBB1

Function 00FFA399 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

FindMITargetTypeInstance.LIBCMT ref: 00FFA3EF

Part of subcall function 00FFA13B: PMDtoOffset.LIBCMT ref: 00FFA1CB

FindVITargetTypeInstance.LIBCMT ref: 00FFA3F6
PMDtoOffset.LIBCMT ref: 00FFA406
std::bad_exception::bad_exception.LIBCMT ref: 00FFA42C
__CxxThrowException@8.LIBCMT ref: 00FFA43A

Strings

Bad dynamic_cast!, xrefs: 00FFA424

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: FindInstanceOffsetTargetType$Exception@8Throwstd::bad_exception::bad_exception
String ID: Bad dynamic_cast!
API String ID: 3308565544-2956939130
Opcode ID: 36527a05574329f61a04614f31670203b3dd12199ec91c406b796b4a16ccd89b
Instruction ID: eb39197076780f91310257799ff805f0a5ca332f3436d8a67991b12d075c368b
Opcode Fuzzy Hash: 36527a05574329f61a04614f31670203b3dd12199ec91c406b796b4a16ccd89b
Instruction Fuzzy Hash: 3611D5B2A002189FCB04EF74CC42BBE77B5AF44721F144059F609A7262EB39D941AB52

Function 00F95650 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00F9567A
_sprintf.LIBCMT ref: 00F956A5
_sprintf.LIBCMT ref: 00F956E0

Strings

%.0f, xrefs: 00F9569F
%lf, xrefs: 00F956F7

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _sprintf$__floor_pentium4
String ID: %.0f$%lf
API String ID: 175470247-628172926
Opcode ID: 265fa272b820e4591ed472b12e4966ebe7441752e13081294f036852a50bb1c7
Instruction ID: dcb226c758ed7a2af3b75e9e4792d243691100f62d36de9ef3bbcf0903a6ef0c
Opcode Fuzzy Hash: 265fa272b820e4591ed472b12e4966ebe7441752e13081294f036852a50bb1c7
Instruction Fuzzy Hash: 37112C71E0092153D7117E5CEE0A2AA7A60FF01781FC50ED5F9D455296FA3A452C4BC7

Function 00F70A50 Relevance: 10.6, APIs: 7, Instructions: 61COMMON

Download Yara Rule

APIs

GetClipBox.GDI32(?,?), ref: 00F70A6C
CreateRectRgnIndirect.GDI32(?), ref: 00F70A7D
CreateRectRgnIndirect.GDI32(?), ref: 00F70A87
CreateRoundRectRgn.GDI32(?,?,?,?,?,?), ref: 00F70AAC
CombineRgn.GDI32(?,?,00000000,00000001), ref: 00F70ABC
ExtSelectClipRgn.GDI32(?,?,00000001), ref: 00F70AC9
DeleteObject.GDI32(00000000), ref: 00F70AEE

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CreateRect$ClipIndirect$CombineDeleteObjectRoundSelect
String ID:
API String ID: 2381484079-0
Opcode ID: 8b2a79a0897ccdc27766e70f26e13650400ec9f6e6658e7cd42429db75b9d991
Instruction ID: dae1cd8c780245e3d5db08bbf29cbd914547653f4c5cfe32a01172fa08d19243
Opcode Fuzzy Hash: 8b2a79a0897ccdc27766e70f26e13650400ec9f6e6658e7cd42429db75b9d991
Instruction Fuzzy Hash: CA21C0B4508700AFD325DF69D98496BBBF9FB88700F008A1DF98AC3214D776E9448F62

Function 00F95710 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 00F95758
_sprintf.LIBCMT ref: 00F9576C
_sprintf.LIBCMT ref: 00F9578A
_sprintf.LIBCMT ref: 00F9579E

Strings

%lld, xrefs: 00F95766
%llu, xrefs: 00F95798

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _sprintf
String ID: %lld$%llu
API String ID: 1467051239-2099202303
Opcode ID: 4fd795b2fe63c65c027c410ec324753811d2c543fe9e1bfec613db4dea8e172a
Instruction ID: ef6aa32dc90012c3742c735b948080374d1be88d8fe999ec2e420b6e0ff13e7d
Opcode Fuzzy Hash: 4fd795b2fe63c65c027c410ec324753811d2c543fe9e1bfec613db4dea8e172a
Instruction Fuzzy Hash: 5601F560F40B04D6BD26B9ADBC8693E315BCBC1F71B5C032DF8208A3D5E6559E416327

Function 00F74110 Relevance: 10.6, APIs: 7, Instructions: 50COMMON

Download Yara Rule

APIs

CreatePen.GDI32(?,?,?), ref: 00F74138
SelectObject.GDI32(?,00000000), ref: 00F74148
GetStockObject.GDI32(00000005), ref: 00F74150
SelectObject.GDI32(?,00000000), ref: 00F74158
Rectangle.GDI32(?,?,?,?,?), ref: 00F7416A
SelectObject.GDI32(?,?), ref: 00F74176
DeleteObject.GDI32(00000000), ref: 00F74179

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Object$Select$CreateDeleteRectangleStock
String ID:
API String ID: 2689421921-0
Opcode ID: ef6f275079df2addd82fc0ff9e147e635e11a6715225ad099a8c7e670a01e92b
Instruction ID: d2d442830a6e7839a15894891987b7354154dcbad7ff3829658706cea27aca63
Opcode Fuzzy Hash: ef6f275079df2addd82fc0ff9e147e635e11a6715225ad099a8c7e670a01e92b
Instruction Fuzzy Hash: 460186B45002007FE215DB25DC88C3BB7FEEBC9612B00C61DF98682645DB7AE8419B31

Function 00F12280 Relevance: 9.2, APIs: 6, Instructions: 217COMMON

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 00F122C8
_memmove_s.LIBCMT ref: 00F1234F
_memcpy_s.LIBCMT ref: 00F12384

Part of subcall function 00FDA084: __EH_prolog3.LIBCMT ref: 00FDA08B
Part of subcall function 00FDA084: __CxxThrowException@8.LIBCMT ref: 00FDA0B6

_memmove_s.LIBCMT ref: 00F123C3
_memmove_s.LIBCMT ref: 00F12453
_memmove_s.LIBCMT ref: 00F12481

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _memmove_s$Exception@8H_prolog3String_base::_ThrowXlen_memcpy_sstd::_
String ID:
API String ID: 3227841680-0
Opcode ID: a5e64057cd0c634ee189a8e3185c677f7be18b40037446ea06c33f1560c36865
Instruction ID: 843eeb84b33ae59b25dc30c434b2a74c88831f24f6e3fe30fff450eb3bb2e332
Opcode Fuzzy Hash: a5e64057cd0c634ee189a8e3185c677f7be18b40037446ea06c33f1560c36865
Instruction Fuzzy Hash: 10719F716042058F8708CFA8C9808AEB7E6FFC4754F244A2DE456C7345DB34EE65EB95

Function 00FD8A50 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 376COMMON

Download Yara Rule

Strings

GSSAPI handshake failure (invalid security layer), xrefs: 00FD8C22
GSSAPI handshake failure (invalid security data), xrefs: 00FD8BC8
GSSAPI handshake failure (empty security message), xrefs: 00FD8AA8, 00FD8B96

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID:
String ID: GSSAPI handshake failure (empty security message)$GSSAPI handshake failure (invalid security data)$GSSAPI handshake failure (invalid security layer)
API String ID: 0-242323837
Opcode ID: 9819995ea9e41e9ce23d56683fbd90c83d91f997c3f005c7d8bcd605a2c31bac
Instruction ID: e74cd9194cd97cc7448f3a076f808ce39d35a7f0e7d3cf58832d376cf32119d9
Opcode Fuzzy Hash: 9819995ea9e41e9ce23d56683fbd90c83d91f997c3f005c7d8bcd605a2c31bac
Instruction Fuzzy Hash: 8ED17DB55043019FC324DB68E894B9BFBE9BFC8354F14491AF58987300DB3AE946CB92

Function 00FBB2F0 Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 348COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00FBB4C6
_strncmp.LIBCMT ref: 00FBB654

Strings

Request has same path as previous transfer, xrefs: 00FBB66F
Uploading to a URL without a file name!, xrefs: 00FBB5C4
no memory, xrefs: 00FBB491

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _strncmp_strrchr
String ID: Request has same path as previous transfer$Uploading to a URL without a file name!$no memory
API String ID: 2449643776-2111548750
Opcode ID: eb6fd737cda5a42fb95380256ca0c8a1bff800fa0e187f239816f9ffd09d262e
Instruction ID: 62497c34ef314b0b2a0b48e4f49bde74641cf34da36a6b54da9b19c827b37fc8
Opcode Fuzzy Hash: eb6fd737cda5a42fb95380256ca0c8a1bff800fa0e187f239816f9ffd09d262e
Instruction Fuzzy Hash: CFC1F071A043018FC720DF2ADC80BA677E6FF85320F18452CE9868B245EBB6E909DF51

Function 00F82600 Relevance: 9.1, APIs: 6, Instructions: 58memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00F825CD,00000000), ref: 00F82609
GlobalLock.KERNEL32(00000000,?,00F825CD,00000000), ref: 00F82612
CreateStreamOnHGlobal.OLE32 ref: 00F82637
GdipAlloc.GDIPLUS(00000010), ref: 00F82643
GdipLoadImageFromStream.GDIPLUS(00000000,00000004,00000010), ref: 00F8265F
GlobalUnlock.KERNEL32(00000000), ref: 00F82688

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Global$AllocGdipStream$CreateFromImageLoadLockUnlock
String ID:
API String ID: 1747925419-0
Opcode ID: e18ba1e529d8ab625c2e8c1e1922545b0b72cb929e2879027a32b769d054e2b1
Instruction ID: 4e96aea22583e844c75b951be7175ae264e1fe30e26130fccf0ae1828119c136
Opcode Fuzzy Hash: e18ba1e529d8ab625c2e8c1e1922545b0b72cb929e2879027a32b769d054e2b1
Instruction Fuzzy Hash: D6118EB6204200AFE2209B55EC88B6BF7ECEF84761F10851EF649C7250E7B69800CBA1

Function 00F74080 Relevance: 9.1, APIs: 6, Instructions: 54COMMON

Download Yara Rule

APIs

CreatePenIndirect.GDI32(?), ref: 00F740B9
SelectObject.GDI32(?,00000000), ref: 00F740C9
MoveToEx.GDI32(?,00000000,?,?), ref: 00F740E6
LineTo.GDI32(?,?,?), ref: 00F740F5
SelectObject.GDI32(?,?), ref: 00F74101
DeleteObject.GDI32(00000000), ref: 00F74104

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Object$Select$CreateDeleteIndirectLineMove
String ID:
API String ID: 191790629-0
Opcode ID: 0daff17e1bc81a006bf18b883e516831d8636d21ba32707fe2aca8536a99edf0
Instruction ID: 14ea35d6db85078cd36f9211eb40b686db4deb4b6a9430265acecba441b2694f
Opcode Fuzzy Hash: 0daff17e1bc81a006bf18b883e516831d8636d21ba32707fe2aca8536a99edf0
Instruction Fuzzy Hash: 0F115BB4504301AF9305DF29D88487BBBE9EBCC611F408A1DF8DAC3205DB39E9569F62

Function 00FE34D8 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 00FE3500

Part of subcall function 00FE2A78: __getptd.LIBCMT ref: 00FE2A86
Part of subcall function 00FE2A78: __getptd.LIBCMT ref: 00FE2A94

__getptd.LIBCMT ref: 00FE350A

Part of subcall function 00FE5938: __getptd_noexit.LIBCMT ref: 00FE593B
Part of subcall function 00FE5938: __amsg_exit.LIBCMT ref: 00FE5948

__getptd.LIBCMT ref: 00FE3518
__getptd.LIBCMT ref: 00FE3526
__getptd.LIBCMT ref: 00FE3531
_CallCatchBlock2.LIBCMT ref: 00FE3557

Part of subcall function 00FE2B1D: __CallSettingFrame@12.LIBCMT ref: 00FE2B69

Part of subcall function 00FE35FE: __getptd.LIBCMT ref: 00FE360D
Part of subcall function 00FE35FE: __getptd.LIBCMT ref: 00FE361B

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: 01f9273c1e752075a77bd985d297317fc27766dabb1430974e6391f25ece5a78
Instruction ID: b1134464fdde0b51307aa4237c0353445699eccd11a164b759086ea24ff91869
Opcode Fuzzy Hash: 01f9273c1e752075a77bd985d297317fc27766dabb1430974e6391f25ece5a78
Instruction Fuzzy Hash: 8511C6B1D01249DFDB00EFA5C846AED7BB0FF08715F50806AF854AB352DB389A51AF54

Function 00F80DE0 Relevance: 9.0, APIs: 6, Instructions: 37COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00F80DE9
GetDeviceCaps.GDI32(00000000,00000058), ref: 00F80DFA
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F80E03
ReleaseDC.USER32(00000000,00000000), ref: 00F80E0A
MulDiv.KERNEL32(000009EC,?,?), ref: 00F80E23
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00F80E31

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CapsDevice$Release
String ID:
API String ID: 1035833867-0
Opcode ID: 02a13ed2e1459db4d980cc7c3940f60bb63d93d633cba36de94bc00907dbc062
Instruction ID: 918d252e59b7d79e3a62d0df484aea4b0bbf1ca146ae6402f4d6b5259466a69f
Opcode Fuzzy Hash: 02a13ed2e1459db4d980cc7c3940f60bb63d93d633cba36de94bc00907dbc062
Instruction Fuzzy Hash: 15F090B1640314AFE310DBA1CC46F1BBFADEB49751F018015FA4087280DB77A8108BA1

Function 00FAE340 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 262COMMON

Download Yara Rule

Strings

Trying %s..., xrefs: 00FAE405
sa_addr inet_ntop() failed with errno %d: %s, xrefs: 00FAE3DF
Immediate connect fail for %s: %s, xrefs: 00FAE5FC

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID:
String ID: Trying %s...$Immediate connect fail for %s: %s$sa_addr inet_ntop() failed with errno %d: %s
API String ID: 0-3338264681
Opcode ID: 47cb5c3aff3eb733cb310cb919566d362cfe0c699a530b8111488a40237c67b3
Instruction ID: 0ad9eeb041086fa32715dbde56e8ac7e82c9cecec85581e0838a043c755252a7
Opcode Fuzzy Hash: 47cb5c3aff3eb733cb310cb919566d362cfe0c699a530b8111488a40237c67b3
Instruction Fuzzy Hash: 7091EAB19043409FD720EF24DC42BAF73D9AF99314F44492EF94987242EB799944DBA3

Function 00F3F0D0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 227COMMON

Download Yara Rule

Strings

true, xrefs: 00F3F11D, 00F3F1CB
visible, xrefs: 00F3F142, 00F3F1F0, 00F3F29F
false, xrefs: 00F3F27B

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _memcpy_s
String ID: false$true$visible
API String ID: 2001391462-2506262893
Opcode ID: d665033a87ef6eff4696a8a779e6ce35b4850f307c842cfc8debfce5dbf13efa
Instruction ID: 9864fb1dd68bf9f380690b28c3211267c06ac1233be70995596989348cafd816
Opcode Fuzzy Hash: d665033a87ef6eff4696a8a779e6ce35b4850f307c842cfc8debfce5dbf13efa
Instruction Fuzzy Hash: 3D913AB1908780DBD330DF2AC881A5BFBE5BF94710F448A1EE48987711D775A948CB93

Function 00F3F3F0 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 227COMMON

Download Yara Rule

Strings

true, xrefs: 00F3F59B
visible, xrefs: 00F3F462, 00F3F510, 00F3F5BF
false, xrefs: 00F3F43D, 00F3F4EB

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _memcpy_s
String ID: false$true$visible
API String ID: 2001391462-2506262893
Opcode ID: 291badb6312c1d9da63db1babf92bc119ba966f8454d316d000e889b9224647c
Instruction ID: fae4d9c154ed4284e76d38de4130157ba88ba7fb964015e328f0e7b834dff481
Opcode Fuzzy Hash: 291badb6312c1d9da63db1babf92bc119ba966f8454d316d000e889b9224647c
Instruction Fuzzy Hash: 42914A719087809BD330DF2AC882A5BFBF5BF94710F448A1EE48A87721D775A944CB93

Function 00F5308D Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 204COMMON

Download Yara Rule

APIs

__wcsicoll.LIBCMT ref: 00F53093
_memset.LIBCMT ref: 00F533AE

Part of subcall function 00FDB3B2: _malloc.LIBCMT ref: 00FDB3CC

Strings

true, xrefs: 00F533E2
ChildLayout, xrefs: 00F5308D
cover, xrefs: 00F533CB

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __wcsicoll_malloc_memset
String ID: ChildLayout$cover$true
API String ID: 773177119-1244660982
Opcode ID: 19b91dc77e054871dbd79b95e6100eeac8f0db237bf824b252a079cf4385a19b
Instruction ID: 06ba1b37be6d49ea3fa0ee12b578fcfd0a18f86752ec42e160cbc71dca50cbdd
Opcode Fuzzy Hash: 19b91dc77e054871dbd79b95e6100eeac8f0db237bf824b252a079cf4385a19b
Instruction Fuzzy Hash: D271A3316042429BDB20DF58C881B6EB3E5BFC8395F54052DEE8987241EB35DE49EB82

Function 00FAE977 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 188networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(?), ref: 00FAEADD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FAEBA6

Strings

After %ldms connect time, move on!, xrefs: 00FAEA22
connect to %s port %ld failed: %s, xrefs: 00FAEB14
L', xrefs: 00FAEA30
Failed to connect to %s port %ld: %s, xrefs: 00FAED1E

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ErrorLastUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: After %ldms connect time, move on!$Failed to connect to %s port %ld: %s$L'$connect to %s port %ld failed: %s
API String ID: 4282017882-3625044609
Opcode ID: 399adb0f4e180356eda6f0d038ebd364367adcd7615fdbe09d7b876470262be3
Instruction ID: d37336efc3deeb6c536898583de583e0f7cc3aa39dd5129809e82231fb874aa2
Opcode Fuzzy Hash: 399adb0f4e180356eda6f0d038ebd364367adcd7615fdbe09d7b876470262be3
Instruction Fuzzy Hash: E0716CB4A047019FD728DF28C885A6AF7E5FF89720F148A2DF85887351E734E950DB92

Function 00FAE975 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 187networkCOMMON

Download Yara Rule

APIs

WSASetLastError.WS2_32(?), ref: 00FAEADD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00FAEBA6

Strings

After %ldms connect time, move on!, xrefs: 00FAEA22
connect to %s port %ld failed: %s, xrefs: 00FAEB14
L', xrefs: 00FAEA30
Failed to connect to %s port %ld: %s, xrefs: 00FAED1E

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ErrorLastUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: After %ldms connect time, move on!$Failed to connect to %s port %ld: %s$L'$connect to %s port %ld failed: %s
API String ID: 4282017882-3625044609
Opcode ID: 654bc6d0d876242ce2185693f2ebe1c928fa366ce57065467ccb91128892788f
Instruction ID: fa1d8761d7185d61b5f0348b85d7d9d2f310224658ebbe58bc8a3e195e344a45
Opcode Fuzzy Hash: 654bc6d0d876242ce2185693f2ebe1c928fa366ce57065467ccb91128892788f
Instruction Fuzzy Hash: D2718BB4A047019FD718DF28C885A6AF7E5FF89320F148A2DF85887351E734E950DB92

Function 00F2D320 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155timestringCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F2D39C
lstrlenA.KERNEL32(?,?,?,8F2D4ADD), ref: 00F2D3B3
KillTimer.USER32(?,?,00000000,8F2D4ADD), ref: 00F2D4BE
KillTimer.USER32(?,00000015), ref: 00F2D4C6

Strings

receivedAdUrl, xrefs: 00F2D3E8

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: KillTimer$_memsetlstrlen
String ID: receivedAdUrl
API String ID: 1213864165-2842485071
Opcode ID: 28aab179f0e70d3e9e60512e531a3a4d7d91479192dd6ab4db62de31531cc547
Instruction ID: 64f965a087b2bd34c425b0fb7cbcaa2ca6f954ba2c56db58aeeed9a54150367c
Opcode Fuzzy Hash: 28aab179f0e70d3e9e60512e531a3a4d7d91479192dd6ab4db62de31531cc547
Instruction Fuzzy Hash: 9C5129B2900258AFDF20EFA4DC81BEE73B8BF48310F544569F605A7241DB78AE85D761

Function 00F401B0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 153COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00F40343

Strings

open, xrefs: 00F4033D
ProductPrivacyUrl, xrefs: 00F40215
H4f, xrefs: 00F402A9
ProductLicenseUrl, xrefs: 00F40207, 00F40239, 00F4023A

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ExecuteShell
String ID: H4f$ProductLicenseUrl$ProductPrivacyUrl$open
API String ID: 587946157-3632432762
Opcode ID: 99759e3041eb072b694ab254892416577e557c6c5bb4e46ff1dfc4d15a1099dd
Instruction ID: 0e329c02d79b22df3e486ccf7645ed6b22f1156844eb71b67531b492db6d938e
Opcode Fuzzy Hash: 99759e3041eb072b694ab254892416577e557c6c5bb4e46ff1dfc4d15a1099dd
Instruction Fuzzy Hash: A451D0B19083809FD720DF64C885B6BBFE9AB84314F54492DF59887381DB7AD848CB93

Function 00F3F840 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 150COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00F3F9C5

Strings

open, xrefs: 00F3F9BF
ProductPrivacyUrl, xrefs: 00F3F898
H4f, xrefs: 00F3F92B
ProductLicenseUrl, xrefs: 00F3F88A, 00F3F8BB, 00F3F8BC

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ExecuteShell
String ID: H4f$ProductLicenseUrl$ProductPrivacyUrl$open
API String ID: 587946157-3632432762
Opcode ID: b564eff52430b8a0f7b8f9e3f0c2e6cdba0d06753330c172e5f9a0446256498b
Instruction ID: 97f1cbd981764b45976bd8438b056061dd784319e1b855b335ba6b1955d7d6ab
Opcode Fuzzy Hash: b564eff52430b8a0f7b8f9e3f0c2e6cdba0d06753330c172e5f9a0446256498b
Instruction Fuzzy Hash: A251D0B19083C0AFD720DF28C885B5BBBE9AB94324F54492DF49987381D779D848CB93

Function 00F86D50 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 135COMMON

Download Yara Rule

APIs

__wcstoi64.LIBCMT ref: 00F86DB2
__wcstoi64.LIBCMT ref: 00F86DCB

Strings

columns, xrefs: 00F86DE5
itemsize, xrefs: 00F86D61
childvpadding, xrefs: 00F86E3B

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __wcstoi64
String ID: childvpadding$columns$itemsize
API String ID: 398114495-1858099967
Opcode ID: 0ba8e2a1b6483425cad543f543ae2cdb25a6f488b752d3ce0e0cbac2ff4aa634
Instruction ID: f4f015e199f3dbfa4a683b59cd1e77ee430de992c42ba2fbe3c42b0ccedd6954
Opcode Fuzzy Hash: 0ba8e2a1b6483425cad543f543ae2cdb25a6f488b752d3ce0e0cbac2ff4aa634
Instruction Fuzzy Hash: 6E411993B0010157DB20BF28DC419FAB396EBB5B30F84463AF945CB285E622DD44E352

Function 00F14820 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 109windowCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000008,00000000), ref: 00F14927

Strings

btn_ClosePic, xrefs: 00F1490B
btn_ok, xrefs: 00F148CA
click, xrefs: 00F14853
btn_close, xrefs: 00F1488F

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: MessagePost
String ID: btn_ClosePic$btn_close$btn_ok$click
API String ID: 410705778-604021180
Opcode ID: 28c1a3a1b6dea339484c04b822b51586c7027ec0751935a253d06eecd2b8b98a
Instruction ID: a0d2135f2a24c4257b32b061ddb87937f5e3d7b088ad46529e27b8109c51fda9
Opcode Fuzzy Hash: 28c1a3a1b6dea339484c04b822b51586c7027ec0751935a253d06eecd2b8b98a
Instruction Fuzzy Hash: 7931F471A102429AE624AF24C801BF673A6BFB4B74F844628E585DB2D4E733FCC0E300

Function 00F355C0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 102threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,00F35730,00000000,00000000,00000000), ref: 00F3569D
CloseHandle.KERNEL32(00000000,?,00F21C99), ref: 00F356A8

Strings

load h5 SetWebBrowserEventHandler, xrefs: 00F3566F
load h5 FindControl, xrefs: 00F3564A
load h5 end, xrefs: 00F356AE

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CloseCreateHandleThread
String ID: load h5 FindControl$load h5 SetWebBrowserEventHandler$load h5 end
API String ID: 3032276028-2305745512
Opcode ID: 3a6965f0b0bc4dc3071ee254b401f4a2949779ed576e2ffd94fd9c696545fb53
Instruction ID: e471eaf1ec8a9893517e61acf424db33c6c04c487698eabd0c9f6f259cb01670
Opcode Fuzzy Hash: 3a6965f0b0bc4dc3071ee254b401f4a2949779ed576e2ffd94fd9c696545fb53
Instruction Fuzzy Hash: B731B1B1908740AFE610EB24CC46B5B77E4BFC0B24F40492CF49686280E779E104DF97

Function 00F537F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

IsZoomed.USER32(?), ref: 00F53800
MonitorFromWindow.USER32 ref: 00F5384B
GetMonitorInfoW.USER32(00000000), ref: 00F53852
OffsetRect.USER32(?,?,?), ref: 00F5388B

Strings

(, xrefs: 00F53843

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Monitor$FromInfoOffsetRectWindowZoomed
String ID: (
API String ID: 1941046686-3887548279
Opcode ID: dcf9ae1819b74b88dfda9d51d98dea4392d777ab6052159152072cfe6de47711
Instruction ID: 8df8292c7c66be6b4509905c94ab62dadf09cc865c9414339c8a7bc488fe4f81
Opcode Fuzzy Hash: dcf9ae1819b74b88dfda9d51d98dea4392d777ab6052159152072cfe6de47711
Instruction Fuzzy Hash: 7721C2B59083019FC354CF68D584A1BBBE9BB88310F008A2EF899C3351EB35D914CF96

Function 00FAD630 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58networkCOMMON

Download Yara Rule

APIs

setsockopt.WS2_32(?,0000FFFF,00000008,00000004,00000004), ref: 00FAD651
WSAIoctl.WS2_32(?,98000004,?,0000000C,00000000,00000000,?,00000000,00000000), ref: 00FAD6C7
WSAGetLastError.WS2_32(?,?), ref: 00FAD6D1

Strings

Failed to set SIO_KEEPALIVE_VALS on fd %d: %d, xrefs: 00FAD6D9
Failed to set SO_KEEPALIVE on fd %d, xrefs: 00FAD65C

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ErrorIoctlLastsetsockopt
String ID: Failed to set SIO_KEEPALIVE_VALS on fd %d: %d$Failed to set SO_KEEPALIVE on fd %d
API String ID: 1819429192-277924715
Opcode ID: f928c6fc2807f99619be029aee2af142a1f61a665656e6f637e5d60458a274e1
Instruction ID: 781db8188114b4d63aafd8a9e7aae07779e8c6152df786e19ed87a5c5e231366
Opcode Fuzzy Hash: f928c6fc2807f99619be029aee2af142a1f61a665656e6f637e5d60458a274e1
Instruction Fuzzy Hash: 5611A7F0D44700AFE350AF359C06F1B76E8BF85B00F44892CB64DD61C5FA7996049B66

Function 00FA8D90 Relevance: 7.8, APIs: 5, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e45f4219e71d25050929f85fd50689448d533c19a058c3f42da1df0faefec3aa
Instruction ID: f0b35b350909f531621ac4f538b176deca015773534577d94d9c4ea6ad6d83ec
Opcode Fuzzy Hash: e45f4219e71d25050929f85fd50689448d533c19a058c3f42da1df0faefec3aa
Instruction Fuzzy Hash: DDA1C4B1A083418FC734DF68C88066EF7E5EFC5360F148A2EE499C7250EBB5D9469B42

Function 00F28680 Relevance: 7.8, APIs: 5, Instructions: 269COMMON

Download Yara Rule

APIs

_fgetc.LIBCMT ref: 00F286FE
_fgetc.LIBCMT ref: 00F2872C
_ungetc.LIBCMT ref: 00F2899E

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _fgetc$_ungetc
String ID:
API String ID: 1266601628-0
Opcode ID: 013c416185d509c2390c6ba62f34b5dd52a433ce836ea21a280326ed883bd7c4
Instruction ID: 19d9e445d11bdbffc8935dec692dbb3616b3e6a4c79a70ecd092c02e3047ecf0
Opcode Fuzzy Hash: 013c416185d509c2390c6ba62f34b5dd52a433ce836ea21a280326ed883bd7c4
Instruction Fuzzy Hash: A1A1C231A093618FC714DF28D88096EB3E6FF857A4F544A1DF49187281DB35EC46EB92

Function 00F82E30 Relevance: 7.6, APIs: 5, Instructions: 124COMMON

Download Yara Rule

APIs

Part of subcall function 00F4F730: GetWindowRect.USER32(?,?), ref: 00F4F754
Part of subcall function 00F4F730: ScreenToClient.USER32(?,?), ref: 00F4F76C
Part of subcall function 00F4F730: ScreenToClient.USER32(?,?), ref: 00F4F77A

CallWindowProcW.USER32(?,?,?,?,?), ref: 00F82F57

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ClientScreenWindow$CallProcRect
String ID:
API String ID: 364371123-0
Opcode ID: 8ba3b717d3f25bf3b1f3b44a6e7dafca54d53b7e5b9112881751ec801750b56d
Instruction ID: 608df94276d080965c46f81a0e54302ef67a271f6d8741c6f8dc88720e1fd7c2
Opcode Fuzzy Hash: 8ba3b717d3f25bf3b1f3b44a6e7dafca54d53b7e5b9112881751ec801750b56d
Instruction Fuzzy Hash: 38419376700200AFCB24DF59DCC4EAAB76AEB88721F154599FD088B385CA76EC50C7A0

Function 00F358B0 Relevance: 7.6, APIs: 5, Instructions: 108COMMON

Download Yara Rule

APIs

GetWindowDC.USER32(00000000), ref: 00F35983
SelectObject.GDI32(00000000,00000000), ref: 00F359AE
GetTextExtentPointW.GDI32(00000000,?,?,8F2D4ADD), ref: 00F359DD
DeleteObject.GDI32(00000000), ref: 00F359E4
ReleaseDC.USER32(00000000,00000000), ref: 00F359EF

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Object$DeleteExtentPointReleaseSelectTextWindow
String ID:
API String ID: 344252577-0
Opcode ID: eaf1ecee85966ca5438f01a2883c9c997b4dcabebad93f0135b90c3fdf3126b8
Instruction ID: 054cc1dad362d8d7164677501e6971c7374cb9bec837f0680f31e0dcdfe4ff9f
Opcode Fuzzy Hash: eaf1ecee85966ca5438f01a2883c9c997b4dcabebad93f0135b90c3fdf3126b8
Instruction Fuzzy Hash: C4419D71504741DFDB31DB24C885FABB3E9BF88714F004A1DE58D97241DB39A948DBA2

Function 00F257EC Relevance: 7.6, APIs: 1, Strings: 4, Instructions: 105sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00F96980: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00F96A11

Part of subcall function 00F12580: _memcpy_s.LIBCMT ref: 00F125FD

Sleep.KERNEL32(?), ref: 00F2591F

Strings

slrProgress, xrefs: 00F258FB
progressValue, xrefs: 00F2586F
value, xrefs: 00F258D3
text, xrefs: 00F25843

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Ios_base_dtorSleep_memcpy_sstd::ios_base::_
String ID: progressValue$slrProgress$text$value
API String ID: 421451183-1230163402
Opcode ID: 57fb7e4bc13627b9b593316d850bc3cb374466612884288222f76b416ab3336b
Instruction ID: 771103fb91f12b8ca796a49902ab98b80419979a2284cd99d203a08afcb62b49
Opcode Fuzzy Hash: 57fb7e4bc13627b9b593316d850bc3cb374466612884288222f76b416ab3336b
Instruction Fuzzy Hash: B3411770D01384EBDB20EF69DD4678EBBB1AF00704F14815DE8456B342DB79AA58D792

Function 00F82BD0 Relevance: 7.6, APIs: 5, Instructions: 91windowtimeCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000030,?,00000001), ref: 00F82C5A
GetLocalTime.KERNEL32(?), ref: 00F82C96
SendMessageW.USER32(00000000,00001002,00000000,?), ref: 00F82CB1
ShowWindow.USER32(00000000,00000004), ref: 00F82CB9
SetFocus.USER32(00000000), ref: 00F82CC3

Part of subcall function 00F82CE0: IntersectRect.USER32(?,?,?), ref: 00F82D68

Part of subcall function 00F506E0: __itow.LIBCMT ref: 00F5071D
Part of subcall function 00F506E0: SelectObject.GDI32(?,00000000), ref: 00F5077A
Part of subcall function 00F506E0: GetTextMetricsW.GDI32(?,00000090), ref: 00F50788
Part of subcall function 00F506E0: SelectObject.GDI32(?,?), ref: 00F5079A

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: MessageObjectSelectSend$FocusIntersectLocalMetricsRectShowTextTimeWindow__itow
String ID:
API String ID: 353493054-0
Opcode ID: 7d9f73196c5af7c15c1b779becc26e9a1e30182ff1ad5044924fed59954f695d
Instruction ID: 21ede7c5443c13f624b134314b1890654c57a4143dd4b5ba14914af491ee665c
Opcode Fuzzy Hash: 7d9f73196c5af7c15c1b779becc26e9a1e30182ff1ad5044924fed59954f695d
Instruction Fuzzy Hash: 293129752407009FD224DF28CC85F2BB3E6ABC8710F108918F59597391DB7AF809CBA4

Function 00FA25A0 Relevance: 7.6, APIs: 5, Instructions: 68networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCACC0: getaddrinfo.WS2_32(?,?,?,?), ref: 00FCACE7
Part of subcall function 00FCACC0: freeaddrinfo.WS2_32(?), ref: 00FCAE19

WSAGetLastError.WS2_32 ref: 00FA25F3
WSAGetLastError.WS2_32 ref: 00FA25F9
EnterCriticalSection.KERNEL32(00000000), ref: 00FA2611
LeaveCriticalSection.KERNEL32 ref: 00FA2620
LeaveCriticalSection.KERNEL32 ref: 00FA2641

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CriticalSection$ErrorLastLeave$Enterfreeaddrinfogetaddrinfo
String ID:
API String ID: 4097228590-0
Opcode ID: 3d87713b8d70c042324505cd96bc37c949394fff961bd8a7567965bd09bdabe0
Instruction ID: 879125fe307a624330c9c031b61932baf6b6cfef3eee41f146fc0715bdfbd5d7
Opcode Fuzzy Hash: 3d87713b8d70c042324505cd96bc37c949394fff961bd8a7567965bd09bdabe0
Instruction Fuzzy Hash: DC21ACB16007019FD320EF69C985E57B7E9AF88314F00891DF88683644EB3AE844DB61

Function 00FDA0BC Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

____lc_handle_func.LIBCMT ref: 00FDA0CA

Part of subcall function 00FE3007: __getptd.LIBCMT ref: 00FE3007

____lc_codepage_func.LIBCMT ref: 00FDA0D2

Part of subcall function 00FE2FE1: __getptd.LIBCMT ref: 00FE2FE1

__GetLocaleForCP.LIBCPMT ref: 00FDA101

Part of subcall function 00FDA8E1: __malloc_crt.LIBCMT ref: 00FDA91F
Part of subcall function 00FDA8E1: __CreateLocForCP.LIBCPMT ref: 00FDA92F
Part of subcall function 00FDA8E1: InterlockedCompareExchange.KERNEL32(00F1F396,00000000,00000000), ref: 00FDA946

____mb_cur_max_l_func.LIBCMT ref: 00FDA10E

Part of subcall function 00FE2FC5: __getptd.LIBCMT ref: 00FE2F9C

WideCharToMultiByte.KERNEL32(00000000,00000000,000000FF,00000001,?,00000000,00000000,00000000,00000000,?,00000000,-00000050,01028E9C,-00000028,invalid string position,00000044), ref: 00FDA121

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __getptd$ByteCharCompareCreateExchangeInterlockedLocaleMultiWide____lc_codepage_func____lc_handle_func____mb_cur_max_l_func__malloc_crt
String ID:
API String ID: 4077685425-0
Opcode ID: 0d4e2e285f07a43c935a29d47a7ed90cc12e7ca8853eb8ea1cf19e60bf5f5582
Instruction ID: 8ade8a903bbb3f4ec0fee506e117d005ba39dcfc6d03a14c3ddfa5c88447f1a1
Opcode Fuzzy Hash: 0d4e2e285f07a43c935a29d47a7ed90cc12e7ca8853eb8ea1cf19e60bf5f5582
Instruction Fuzzy Hash: F7010432600245AFDB216F24DC09FBA376ADB41770F194026FD049B291EA75EC42EB66

Function 00FEA053 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00FEA05F

Part of subcall function 00FE5938: __getptd_noexit.LIBCMT ref: 00FE593B
Part of subcall function 00FE5938: __amsg_exit.LIBCMT ref: 00FE5948

__amsg_exit.LIBCMT ref: 00FEA07F
__lock.LIBCMT ref: 00FEA08F
InterlockedDecrement.KERNEL32(?), ref: 00FEA0AC
InterlockedIncrement.KERNEL32(006617F0), ref: 00FEA0D7

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: e7c16a39b8cfd04113606703cfa4eaac5459979b256a6261d1f8932abd6cdeba
Instruction ID: aa2d7f9dde4e625e1923cccf9bac7e0809777e71d2557ff7b1435178bcf29c99
Opcode Fuzzy Hash: e7c16a39b8cfd04113606703cfa4eaac5459979b256a6261d1f8932abd6cdeba
Instruction Fuzzy Hash: 7901C032D41B61EBD721AB66984A75E77A0BF00B31F044149F950AB2C4C73D7981FBD2

Function 00F96CD0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 234sleepstringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 00F96D5D
WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,?,00000000,00000000), ref: 00F96D8E
Sleep.KERNEL32(00000064), ref: 00F96ECB

Strings

iTry=%d,lastCode=%d, xrefs: 00F96E2B

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ByteCharMultiSleepWidelstrlen
String ID: iTry=%d,lastCode=%d
API String ID: 2904403760-260061475
Opcode ID: 0bf17ac87defaf7cf6eb1bd8b1c148266513532fcedee77ca791f6a1d44ebfac
Instruction ID: 0d95409c0b83379854afed95ba346e8547fc5860fcab5d685b529791ff7c9ab3
Opcode Fuzzy Hash: 0bf17ac87defaf7cf6eb1bd8b1c148266513532fcedee77ca791f6a1d44ebfac
Instruction Fuzzy Hash: 458125B1D00318ABEF11EFA4CC42BDE7775AF04704F144229F919AB281EB7DA944DB96

Function 00F772C0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 201COMMON

Download Yara Rule

APIs

Part of subcall function 00FDB3B2: _malloc.LIBCMT ref: 00FDB3CC

__wcsicoll.LIBCMT ref: 00F77589

Strings

TreeNode, xrefs: 00F7757F
left, xrefs: 00F774C5
align, xrefs: 00F774CA

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __wcsicoll_malloc
String ID: TreeNode$align$left
API String ID: 3412207354-2292253626
Opcode ID: ff52d0a92228521d6f15d2acea597da19161b36faa9b87603b2336631abbe6e5
Instruction ID: 154f734cf158643a37f2b5ecb2c2a3b9b8104939224e51d1af6a35b33626f36f
Opcode Fuzzy Hash: ff52d0a92228521d6f15d2acea597da19161b36faa9b87603b2336631abbe6e5
Instruction Fuzzy Hash: 2891AC757057429FD304EF38C880B96FBE2BF98704F0446AEE49C97351DB36A8649B92

Function 00F983D0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 191COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F98450
_sprintf.LIBCMT ref: 00F98472

Strings

curl_easy_perform Code:%d , xrefs: 00F98541
%lld-%lld, xrefs: 00F9846C

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _memset_sprintf
String ID: %lld-%lld$curl_easy_perform Code:%d
API String ID: 1557529856-2717882131
Opcode ID: 38751920830aaa25645f0d785e4535a153babb4bd8ba36847164f43bb9cd62bf
Instruction ID: e4feaae2da689d2b3895cc885acc31187abb34124b16127825a867fd33320af9
Opcode Fuzzy Hash: 38751920830aaa25645f0d785e4535a153babb4bd8ba36847164f43bb9cd62bf
Instruction Fuzzy Hash: DC512F71A00600ABFB14EF18DC42F5BB365BF45314F044229F5089B282DB75ED65DBE6

Function 00FA6CC0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 00FA5D60: __time64.LIBCMT ref: 00FA5D69

_fputs.LIBCMT ref: 00FA6D69

Part of subcall function 00FDD02A: __fsopen.LIBCMT ref: 00FDD037

Strings

# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk., xrefs: 00FA6D64
## Fatal libcurl error, xrefs: 00FA6E36
%s, xrefs: 00FA6DC5

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __fsopen__time64_fputs
String ID: ## Fatal libcurl error$# Netscape HTTP Cookie File# https://curl.haxx.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk.$%s
API String ID: 601048091-1525338603
Opcode ID: b011abe6c98ef231865f6e6cc5f5a49da01b8a988dff2e55103b60030b8a685c
Instruction ID: 26b1d928355bbdde49896636bf497d0e52a56b657bda54262389b7f7b2e8aa8d
Opcode Fuzzy Hash: b011abe6c98ef231865f6e6cc5f5a49da01b8a988dff2e55103b60030b8a685c
Instruction Fuzzy Hash: 18415DB2B002015BD7206A78FC857A7B799EF42375F4C0039FD85C6201EB6EED4996A2

Function 00FB65D0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 150COMMON

Download Yara Rule

APIs

recvfrom.WS2_32(?,?,?,00000000,?), ref: 00FB662F

Strings

Internal error: Unexpected packet, xrefs: 00FB67B7
Received too short packet, xrefs: 00FB6672
TFTP error: %s, xrefs: 00FB6762

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: recvfrom
String ID: Internal error: Unexpected packet$Received too short packet$TFTP error: %s
API String ID: 846543921-477593554
Opcode ID: 138f4ee88b2fafb67b28f5dc385a4cc4690edae8713fed88fc648e444443d810
Instruction ID: c4bdb34bc591d5eb8a5e502ceaa1727ccdf5d439e514f081025d6fb3217f6551
Opcode Fuzzy Hash: 138f4ee88b2fafb67b28f5dc385a4cc4690edae8713fed88fc648e444443d810
Instruction Fuzzy Hash: 1851D4B16002009BD710DF26DC81BAB73A5EB84718F54822DF94DCF246EB3DE9059FA1

Function 00FB4D00 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 119COMMON

Download Yara Rule

APIs

_swscanf.LIBCMT ref: 00FB4D36

Part of subcall function 00FDFA6E: _vscan_fn.LIBCMT ref: 00FDFA85

Strings

Select failed, xrefs: 00FB4E31
OK [UIDVALIDITY %19[0123456789]], xrefs: 00FB4D30
Mailbox UIDVALIDITY has changed, xrefs: 00FB4DA8

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _swscanf_vscan_fn
String ID: Mailbox UIDVALIDITY has changed$OK [UIDVALIDITY %19[0123456789]]$Select failed
API String ID: 1942008592-3309259123
Opcode ID: 8f5b77daa2c2e256b76a91d3b6b71c5a91fa4beb53536944e1817b44dcc959fa
Instruction ID: f76213464b30d332fb6f64eaf4adc8cd5268ecd8579a506ec405dff84a7364ca
Opcode Fuzzy Hash: 8f5b77daa2c2e256b76a91d3b6b71c5a91fa4beb53536944e1817b44dcc959fa
Instruction Fuzzy Hash: 8A311A72B006005BD614FF39EC9266EB3D5FF8C321FC4453EE1498B302E639A8589B92

Function 00F16FE0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 115timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(01014D18,01014D18), ref: 00F1705D

Part of subcall function 00F12580: _memcpy_s.LIBCMT ref: 00F125FD

swprintf.LIBCMT ref: 00F17110

Strings

%02d:%02d, xrefs: 00F170D5
GMT, xrefs: 00F17065

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: InformationTimeZone_memcpy_sswprintf
String ID: %02d:%02d$GMT
API String ID: 2755296731-3921161529
Opcode ID: ab940c4711130b8ecf3e13cd6836d44fbebf921f2e99b1e543a237cdc9357c3e
Instruction ID: 6c585ee2c37d3f72957dc8840d04ee3792909c447420feea3c108cbca1beb5c1
Opcode Fuzzy Hash: ab940c4711130b8ecf3e13cd6836d44fbebf921f2e99b1e543a237cdc9357c3e
Instruction Fuzzy Hash: 6A41A2716087409BD328DF69CC51B9BB7E6EFC9700F458A2EE04ACB344DB79A5448792

Function 00FBA930 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 104COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00FBA983

Strings

%s%s%s, xrefs: 00FBA9E0
LIST, xrefs: 00FBA9D8
NLST, xrefs: 00FBA9D1

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _strrchr
String ID: %s%s%s$LIST$NLST
API String ID: 3213747228-959297966
Opcode ID: b7521366ec0344f633a3cebe0da349ebedbd2087bc51955c2823e4f9357d39fa
Instruction ID: 8db25bef2713b3ef7c7924c330bad9495ad7cb2bd414f6b80b2d80ec871b5aa0
Opcode Fuzzy Hash: b7521366ec0344f633a3cebe0da349ebedbd2087bc51955c2823e4f9357d39fa
Instruction Fuzzy Hash: C1312B71B04602ABE7249625DC45BFBB799EFC0761F04012DF989C7241E724D845EBA2

Function 00F2C060 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 94COMMON

Download Yara Rule

APIs

IsZoomed.USER32(?), ref: 00F2C137
CallWindowProcW.USER32(?,?,?,?,?), ref: 00F2C14A
IsZoomed.USER32(?), ref: 00F2C156

Part of subcall function 00F4A110: _wcsncpy.LIBCMT ref: 00F4A1A1

Part of subcall function 00FDB0A2: __lock.LIBCMT ref: 00FDB0C0
Part of subcall function 00FDB0A2: ___sbh_find_block.LIBCMT ref: 00FDB0CB
Part of subcall function 00FDB0A2: ___sbh_free_block.LIBCMT ref: 00FDB0DA
Part of subcall function 00FDB0A2: RtlFreeHeap.NTDLL(00000000,?,01028420,0000000C,00FE4923,00000000,01028990,0000000C,00FE495D,?,?,?,00FEF11D,00000004,01028BE0,0000000C), ref: 00FDB10A
Part of subcall function 00FDB0A2: GetLastError.KERNEL32(?,00FEF11D,00000004,01028BE0,0000000C,00FE429F,?,?,00000000,00000000,00000000,?,00FE58EA,00000001,00000214), ref: 00FDB11B

Strings

syscommandclose, xrefs: 00F2C088

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Zoomed$CallErrorFreeHeapLastProcWindow___sbh_find_block___sbh_free_block__lock_wcsncpy
String ID: syscommandclose
API String ID: 1480196746-397309504
Opcode ID: e099c1917d66bbe6fd930bb7ae028b94413ac698614afe58c5e236f85031226f
Instruction ID: 2b6ef06654b06c60305877743e626f3312c6526edf32817a97bd8126ca36d1ad
Opcode Fuzzy Hash: e099c1917d66bbe6fd930bb7ae028b94413ac698614afe58c5e236f85031226f
Instruction Fuzzy Hash: BB31E476A002209BCB10DF69DC4185FB3A9EF88320F154A1AFC5997242D735FD0497E2

Function 00F268F0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 90windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F12580: _memcpy_s.LIBCMT ref: 00F125FD

IsWindow.USER32(?), ref: 00F269F2
PostMessageW.USER32(?,00000010,00000001,00000000), ref: 00F26A05

Strings

Download_Failed, xrefs: 00F26951
Click_Exit, xrefs: 00F2692A

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: MessagePostWindow_memcpy_s
String ID: Click_Exit$Download_Failed
API String ID: 2951890172-778600294
Opcode ID: ce62f6bfc8e77b6238573e601273f7a0084a1cee34e312c06d9cc8a433770f76
Instruction ID: f36c4b04de12a14eaadc24063fca0fe1e74e2fabc360f74268dad4bd80052fd3
Opcode Fuzzy Hash: ce62f6bfc8e77b6238573e601273f7a0084a1cee34e312c06d9cc8a433770f76
Instruction Fuzzy Hash: 9231D0719083409BC720DF25C841B5BFBE9AF85B14F004A1EF59897280EB7AE944CB93

Function 00F5D780 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 00F5D79B
SetCursor.USER32(00000000,?,75BF3FC0,?,00F5690F,?), ref: 00F5D7A2

Strings

timer, xrefs: 00F5D7F8
menu, xrefs: 00F5D82E

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Cursor$Load
String ID: menu$timer
API String ID: 1675784387-2593718399
Opcode ID: 1ebd2edebe9a1431e42a06b10bf4856ffae57f7531de7c43f57c79df6aa23525
Instruction ID: f62db0e4150740ca754fe26527f2d76becb2eeb4d6d2a5e1ba94c70cfcc6c9ca
Opcode Fuzzy Hash: 1ebd2edebe9a1431e42a06b10bf4856ffae57f7531de7c43f57c79df6aa23525
Instruction Fuzzy Hash: 74212B72B051046BD630DB5CAC41FA9F399EBD5332F10026BFF45C7681CA61AC6583E5

Function 00F3A940 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 88COMMON

Download Yara Rule

APIs

Part of subcall function 00F1BB00: std::_String_base::_Xlen.LIBCPMT ref: 00F1BB5C
Part of subcall function 00F1BB00: _memcpy_s.LIBCMT ref: 00F1BBB6

ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00F3AA24

Strings

open, xrefs: 00F3AA1E
receivedAdUrl, xrefs: 00F3A9DD
ShowWebAds, xrefs: 00F3A987

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ExecuteShellString_base::_Xlen_memcpy_sstd::_
String ID: ShowWebAds$open$receivedAdUrl
API String ID: 3969413188-545737717
Opcode ID: 2abffc23ce9212eb5dd5dee4c9c4945075e67f9dcb6f48a9c6fe8cfd24fee568
Instruction ID: 25a3aaebecaafd505601740f1c6c1a3ab0e8624b922e3b5417a0e78b48aa23ea
Opcode Fuzzy Hash: 2abffc23ce9212eb5dd5dee4c9c4945075e67f9dcb6f48a9c6fe8cfd24fee568
Instruction Fuzzy Hash: E931A0B1108380DFD710EF39C88671BBBE5AB89718F500A2DF1954B282D67AD849DB93

Function 00F30BE0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32 ref: 00F30C45

Part of subcall function 00F96740: PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 00F9676E
Part of subcall function 00F96740: TranslateMessage.USER32(?), ref: 00F9678A
Part of subcall function 00F96740: DispatchMessageW.USER32(?), ref: 00F96791

CloseHandle.KERNEL32(00000000), ref: 00F30C65

Strings

netFailed, xrefs: 00F30C73
netOK, xrefs: 00F30C1C

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Message$CloseCreateDispatchHandlePeekThreadTranslate
String ID: netFailed$netOK
API String ID: 2582738287-1194257295
Opcode ID: de30c7643998bae573fa189f1eab36bcea14911921df6865b18513f9d3517a7c
Instruction ID: 97be0279bf56f2569566de81e6c26edf46d19e71b0bce15c74b1cfaf40621fb5
Opcode Fuzzy Hash: de30c7643998bae573fa189f1eab36bcea14911921df6865b18513f9d3517a7c
Instruction Fuzzy Hash: 5611E770648344AFD311DF199C81B2BBBECF788B58F40061EF4C587741C77A99049B92

Function 00FA8520 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00FA8470: recv.WS2_32(?,?,?,00000000), ref: 00FA84FB

send.WS2_32(?,00FD6295,?,00000000), ref: 00FA8544
WSAGetLastError.WS2_32 ref: 00FA855C

Strings

Send failure: %s, xrefs: 00FA8583
3', xrefs: 00FA8564

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ErrorLastrecvsend
String ID: 3'$Send failure: %s
API String ID: 3418755260-1925326815
Opcode ID: e54ff782e29c3a27baab7861704f23a6be1245114f0adc25ee3a66b2985b32af
Instruction ID: f964c65eeaae2e3e7714c556a2d49a1f539c0b0444d1bdc2c047dd67fd3d4826
Opcode Fuzzy Hash: e54ff782e29c3a27baab7861704f23a6be1245114f0adc25ee3a66b2985b32af
Instruction Fuzzy Hash: 5501FCB66002155FD710DF58DC84FAB77A8EB89371F000559F944C7381D77AAC5197A1

Function 00F162F0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F16318
GetVersionExW.KERNEL32 ref: 00F1632D

Strings

home, xrefs: 00F16342, 00F16369, 00F1636A
server, xrefs: 00F1633B

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Version_memset
String ID: home$server
API String ID: 963298953-1141258394
Opcode ID: 7be96f2c0daab1607ac3f7ddc89ec8269b5eddb3f3da1991f741097517876b5d
Instruction ID: ee2c029288402426277b34ea325d9f9004e94607f170629cf3933765847d391c
Opcode Fuzzy Hash: 7be96f2c0daab1607ac3f7ddc89ec8269b5eddb3f3da1991f741097517876b5d
Instruction Fuzzy Hash: 6A0184706043405BE325DF14D81A7EBBBE5ABC9704F44841CE4C9CB681DB799548C796

Function 00FB8240 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000002,8F2D4ADD), ref: 00FB825A
WSACleanup.WS2_32 ref: 00FB8275

Strings

WSAStartup failed (%d), xrefs: 00FB8265
insufficient winsock version to support telnet, xrefs: 00FB82A0

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CleanupStartup
String ID: WSAStartup failed (%d)$insufficient winsock version to support telnet
API String ID: 915672949-1763879679
Opcode ID: 87c2e1b4f77735250082566f7c022affe54a54fd0959c0b555930e8f7a5af2c6
Instruction ID: 5acf57f04ae69bc432c14661f0ee07e94eaf4b3ca26568951bf4bc7e87dc5529
Opcode Fuzzy Hash: 87c2e1b4f77735250082566f7c022affe54a54fd0959c0b555930e8f7a5af2c6
Instruction Fuzzy Hash: 98F0F674A106109BDB36AB359C17BFA33DDAF8D781F800019F889C6281EE3E5407DA67

Function 00F44A70 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32,GetNativeSystemInfo,?,?,?,?,00F3B2FC,8F2D4ADD,?,?,?), ref: 00F44A7D
GetProcAddress.KERNEL32(00000000), ref: 00F44A84

Strings

GetNativeSystemInfo, xrefs: 00F44A73
kernel32, xrefs: 00F44A78

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNativeSystemInfo$kernel32
API String ID: 1646373207-3846845290
Opcode ID: d0e2d625c561b0fb39a0ba2e37010e015411a8fbc0ec1a4e2bd4a3c56793eb8c
Instruction ID: 70de872c76ff8d88082e33a735d2afee6dda6d96d0c7feb73e6b600ac2e03cd9
Opcode Fuzzy Hash: d0e2d625c561b0fb39a0ba2e37010e015411a8fbc0ec1a4e2bd4a3c56793eb8c
Instruction Fuzzy Hash: 60F017B480C3019BC71CDF19A48440ABBE1BB88700F84892EF4D9D2304E339C6999B9A

Function 00FB8440 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 31networkCOMMON

Download Yara Rule

APIs

send.WS2_32(?,?,00000003,00000000), ref: 00FB8465
WSAGetLastError.WS2_32 ref: 00FB846F

Strings

Sending data failed (%d), xrefs: 00FB8476
SENT, xrefs: 00FB848A

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ErrorLastsend
String ID: SENT$Sending data failed (%d)
API String ID: 1802528911-3459338696
Opcode ID: af4b759edc72715a76a3072d9ac4bf47a67c8d87c482139cf13c2cd6f64336ec
Instruction ID: 826e65d31cfe9aae6f7848a2b02bf9e11da77df1fb0f838f86839b9d08b5c84b
Opcode Fuzzy Hash: af4b759edc72715a76a3072d9ac4bf47a67c8d87c482139cf13c2cd6f64336ec
Instruction Fuzzy Hash: 59F05971309341AFD301DF649C01A8BBB989F85320F08414CF4D4832C2EB29A509CBA3

Function 00FA85F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,InitSecurityInterfaceW), ref: 00FA8636

Strings

InitSecurityInterfaceW, xrefs: 00FA8630
secur32.dll, xrefs: 00FA8614
security.dll, xrefs: 00FA860D

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: AddressProc
String ID: InitSecurityInterfaceW$secur32.dll$security.dll
API String ID: 190572456-1950755585
Opcode ID: a4640e01dc6a2820f23d1158bcb4c2762308747fba47a91294257884ecee0b0f
Instruction ID: d35e34387bdf00ccdb51d3b159b609de4874a992a6c0a9f151a47f24829ee84b
Opcode Fuzzy Hash: a4640e01dc6a2820f23d1158bcb4c2762308747fba47a91294257884ecee0b0f
Instruction Fuzzy Hash: 6AF065F0F8030275FB3156669C07B2636955B12BA5F844025A584D52C6FFEAED01A651

Function 00FC5830 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00FC5838
_strncmp.LIBCMT ref: 00FC584C

Strings

I64, xrefs: 00FC5846
I32, xrefs: 00FC5832

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _strncmp
String ID: I32$I64
API String ID: 909875538-3980630743
Opcode ID: 4fe609d8a1a833ec944f3c9371e5f9a1e5ffc595922d1ad41e2f1957cbff04d1
Instruction ID: 4e218b6bdbcaabd8f3c6eba38b5e9f8a0eccdd3e685e609d420336269ddba80d
Opcode Fuzzy Hash: 4fe609d8a1a833ec944f3c9371e5f9a1e5ffc595922d1ad41e2f1957cbff04d1
Instruction Fuzzy Hash: FDE08C04A80DA216F62292356E13F2931980F13FDAF8D02B5FC85EC2E3F64CD784A0A1

Function 00F7CE90 Relevance: 6.3, APIs: 4, Instructions: 323COMMON

Download Yara Rule

APIs

PtInRect.USER32(?,?,?), ref: 00F7CEE9

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Rect
String ID:
API String ID: 400858303-0
Opcode ID: cef82c41fe936b793f27018889ecefeb7a78ea1c6970ecea8b6b97ea5c6c63bd
Instruction ID: 3a2c4e04f38f9e6166e5fbeb621dbe6d9e03a261dfad7d94c08bc3af6b6eec4a
Opcode Fuzzy Hash: cef82c41fe936b793f27018889ecefeb7a78ea1c6970ecea8b6b97ea5c6c63bd
Instruction Fuzzy Hash: A1D14A757006029FC718DF78C490AAAF7E2BFC8310F54872AE96D97741DB31A821DB92

Function 00F962B0 Relevance: 6.3, APIs: 4, Instructions: 284COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F9632D
_memset.LIBCMT ref: 00F96336
_memset.LIBCMT ref: 00F964B3
_memset.LIBCMT ref: 00F96583

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: e1df5051348a7ba1d804936acbc4818e09b4ec4685c9a8b39234a20f7dd74bc9
Instruction ID: 6cb2f37c8b4b382c324176b1cc8ba533124ed823d59e82085695fd196a9da646
Opcode Fuzzy Hash: e1df5051348a7ba1d804936acbc4818e09b4ec4685c9a8b39234a20f7dd74bc9
Instruction Fuzzy Hash: 8FA1BF719083429FEB21DF28D844B5ABBE4EF85354F19052CE8C5CB342E739E959CB92

Function 00F98A90 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

std::_String_base::_Xlen.LIBCPMT ref: 00F98ABC
_memmove_s.LIBCMT ref: 00F98B22
_memmove_s.LIBCMT ref: 00F98B58

Part of subcall function 00FDA084: __EH_prolog3.LIBCMT ref: 00FDA08B
Part of subcall function 00FDA084: __CxxThrowException@8.LIBCMT ref: 00FDA0B6

_memcpy_s.LIBCMT ref: 00F98B88

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _memmove_s$Exception@8H_prolog3String_base::_ThrowXlen_memcpy_sstd::_
String ID:
API String ID: 3227841680-0
Opcode ID: f9f300eca6b53c5c574d2dc483831d698c79f107efb1f8eda9b31c240aa2a296
Instruction ID: 055acb388e0ca82d77887f65b670bfd55c90507fca75e64e9ca17b153caeff7f
Opcode Fuzzy Hash: f9f300eca6b53c5c574d2dc483831d698c79f107efb1f8eda9b31c240aa2a296
Instruction Fuzzy Hash: 6431CA712002059F9B24DF69DCC486AB3B6FFD23A4728461EE04187765DF34E846E7A5

Function 00FDF473 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00FDF489

Part of subcall function 00FDC080: __getptd.LIBCMT ref: 00FDC093

__iswctype_l.LIBCMT ref: 00FDF4D9
_wcslen.LIBCMT ref: 00FDF4EE
__fltin2.LIBCMT ref: 00FDF4FA

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Locale$UpdateUpdate::___fltin2__getptd__iswctype_l_wcslen
String ID:
API String ID: 1398186946-0
Opcode ID: 1772f59a2ab1af357d02f5a0b74f0a78a815214a1b3ec1a4dcab6e1426b7f2bd
Instruction ID: f0493b98cd35dd00f1b7b7c5c1a7ebe58cc47229d260050184286f2d861d9e5b
Opcode Fuzzy Hash: 1772f59a2ab1af357d02f5a0b74f0a78a815214a1b3ec1a4dcab6e1426b7f2bd
Instruction Fuzzy Hash: 6431E672D00206E7DB21AF58EC45FAE7BB9BF41320F1C0066E99297391EB35C945E790

Function 00F15860 Relevance: 6.1, APIs: 4, Instructions: 104registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000002,?,00000000,?,8F2D4ADD), ref: 00F15903
_memset.LIBCMT ref: 00F1591D
RegQueryValueExW.ADVAPI32(00000200,?,00000000,?,?,00000200), ref: 00F15959
RegCloseKey.ADVAPI32(8F2D4ADD), ref: 00F1598F

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CloseOpenQueryValue_memset
String ID:
API String ID: 3211720786-0
Opcode ID: db00afe65826c438ffcd88d9cc4c4a2447d7092cc3b1028614785b09702cb9f0
Instruction ID: edfba5abe8ce79333d034851a6a556b1f0f512bdb06ccff6d7f8f479a6be7a90
Opcode Fuzzy Hash: db00afe65826c438ffcd88d9cc4c4a2447d7092cc3b1028614785b09702cb9f0
Instruction Fuzzy Hash: 14418D71504305DBD720DF55C889B9BB7F8FB88B18F404A1DF4898B240E779E548DBA2

Function 00FF2DA8 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00FF2DDC
__isleadbyte_l.LIBCMT ref: 00FF2E10
MultiByteToWideChar.KERNEL32(00000080,00000009,00FE6BB8,?,00000000,00000000,?,?,?,?,00FE6BB8,00000000,?), ref: 00FF2E41
MultiByteToWideChar.KERNEL32(00000080,00000009,00FE6BB8,00000001,00000000,00000000,?,?,?,?,00FE6BB8,00000000,?), ref: 00FF2EAF

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 6adf598cf46bb1836b102d571be3b7d8818fd52f2362f64951b41355810fdd65
Instruction ID: a4733578ff2828605c4c09c23ddfd3025ee96414448255f7c8218052ca03c767
Opcode Fuzzy Hash: 6adf598cf46bb1836b102d571be3b7d8818fd52f2362f64951b41355810fdd65
Instruction Fuzzy Hash: 9C31C531A0024AEFDB60DF64C884ABE3BA5FF01321F248569E5659B1B1E731DD90EB90

Function 00F4AC00 Relevance: 6.1, APIs: 4, Instructions: 96COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F4AC6C
_memset.LIBCMT ref: 00F4ACA7
_memset.LIBCMT ref: 00F4ACE2
_memset.LIBCMT ref: 00F4AD1D

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _memset
String ID:
API String ID: 2102423945-0
Opcode ID: c2dbc699ef43b3df4ba9a78e73585351e7c4cf8a52eaf4f84ad892fb1aa47c26
Instruction ID: 06804197c0cd8e89ccaacd6306f9611c5aec94a5056d35fb1d470c6d6c53d6fd
Opcode Fuzzy Hash: c2dbc699ef43b3df4ba9a78e73585351e7c4cf8a52eaf4f84ad892fb1aa47c26
Instruction Fuzzy Hash: E3318FB1A05780DBD364DF3A9C42B97FAE8EB95700F04492FB19BC3391DAB9A4048B55

Function 00F821F0 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

GdipCreateFromHDC.GDIPLUS(?,?), ref: 00F82253
GdipDrawImageRectI.GDIPLUS(?,00000000,?,?,?,?,?,?), ref: 00F82293
GdipImageSelectActiveFrame.GDIPLUS(?,?,?,?,00000000,?,?,?,?,?,?), ref: 00F822AE
GdipDeleteGraphics.GDIPLUS(?,?,00000000,?,?,?,?,?,?), ref: 00F822C2

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Gdip$Image$ActiveCreateDeleteDrawFrameFromGraphicsRectSelect
String ID:
API String ID: 3422746491-0
Opcode ID: 9db526a64d6ca18c2bac43a6c88c75d97d3aaefd1003009745ed7d7eee6efaca
Instruction ID: 2b6d0d99d6a2de03ec943690d56652b4d7f0b944c5aaf509ff3f1e1b792e91e4
Opcode Fuzzy Hash: 9db526a64d6ca18c2bac43a6c88c75d97d3aaefd1003009745ed7d7eee6efaca
Instruction Fuzzy Hash: 992136B1608745DFD3A4DF69D980AA7B7E9FBC8300F044A1DE59983210DB39F944CB61

Function 00F506E0 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

__itow.LIBCMT ref: 00F5071D

Part of subcall function 00FDCACA: _xtow@16.LIBCMT ref: 00FDCAEA

SelectObject.GDI32(?,00000000), ref: 00F5077A
GetTextMetricsW.GDI32(?,00000090), ref: 00F50788
SelectObject.GDI32(?,?), ref: 00F5079A

Part of subcall function 00F4FE00: SelectObject.GDI32(?,060A0EEB), ref: 00F4FE2B
Part of subcall function 00F4FE00: GetTextMetricsW.GDI32(?,01037A0C), ref: 00F4FE3B
Part of subcall function 00F4FE00: SelectObject.GDI32(?,00000000), ref: 00F4FE49

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ObjectSelect$MetricsText$__itow_xtow@16
String ID:
API String ID: 2423145084-0
Opcode ID: 4317ff867fe7994e363fca7881422ca0b246f588b4bd3b6d30b4651c02e62450
Instruction ID: c37c5cf995a2c7f88e2c65e9c180e70ed495951eb47a9096087d5071b337eb10
Opcode Fuzzy Hash: 4317ff867fe7994e363fca7881422ca0b246f588b4bd3b6d30b4651c02e62450
Instruction Fuzzy Hash: 53214CB56047019FC310DF39D881BABB7E9FB88750F44492DFA98C3241EB35E9488B92

Function 00F9E8A0 Relevance: 6.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F9E8C9
_memset.LIBCMT ref: 00F9E8E3
_strncpy.LIBCMT ref: 00F9E900
_strncpy.LIBCMT ref: 00F9E927

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _memset_strncpy
String ID:
API String ID: 3140232205-0
Opcode ID: c7b8543afa97410a496567bd8ca39ee9e8feeb602525b288dabfa04bb53b63bc
Instruction ID: ae22300335fac710f5a078c9e7a68c4463d573210108d1a5080af486a68a923c
Opcode Fuzzy Hash: c7b8543afa97410a496567bd8ca39ee9e8feeb602525b288dabfa04bb53b63bc
Instruction Fuzzy Hash: 5D110AB29043816FE331EA548CC2FFB739CABD4304F44093DF29982142E638691892A7

Function 00F357E0 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

SHGetSpecialFolderLocation.SHELL32(00000000,00000011,00000000), ref: 00F3582D
_memset.LIBCMT ref: 00F35880
SHBrowseForFolderW.SHELL32(?), ref: 00F3588D
SHGetPathFromIDListW.SHELL32(00000000,00000000), ref: 00F35899

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Folder$BrowseFromListLocationPathSpecial_memset
String ID:
API String ID: 1492392336-0
Opcode ID: 1ffe2b9faae5f6d63b044d209c3e5feb7cc9fa7bc9ae0dfc30ec89ffb9d2d09f
Instruction ID: cf54b849f1a34cce4bf1495f18af262f9221fe689969c50a15fdf58d49a346bc
Opcode Fuzzy Hash: 1ffe2b9faae5f6d63b044d209c3e5feb7cc9fa7bc9ae0dfc30ec89ffb9d2d09f
Instruction Fuzzy Hash: CE215BB1A083009FD350DF69980575BBBE8EF98B24F004A2EF598D3241E7B5D9048BD6

Function 00F82F70 Relevance: 6.1, APIs: 4, Instructions: 55windowCOMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,?,?,?,?,?,00F82E70,?,?), ref: 00F82F81
SendMessageW.USER32(?,00001001,00000000,?), ref: 00F82FAF
SendMessageW.USER32(?,00000008,?,?), ref: 00F82FF2
SendMessageW.USER32(?,00000010,00000000,00000000), ref: 00F82FFE

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: MessageSend$ProcWindow
String ID:
API String ID: 1247960604-0
Opcode ID: a10aaee6882c763698c6553887a184e3d3fd6d3a5c87eccbf838c7e724aca47e
Instruction ID: d339a72083235d176e19ff0aef3a3917245e144166aa05d10d7fb372917710d1
Opcode Fuzzy Hash: a10aaee6882c763698c6553887a184e3d3fd6d3a5c87eccbf838c7e724aca47e
Instruction Fuzzy Hash: 2D11F8B9340705BFD214DB68CC85F66B3B9BB88B04F108558F65897291CB76F890CB64

Function 00F814A0 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F814DB
_wcsncpy.LIBCMT ref: 00F814E8
CLSIDFromString.OLE32(?,?), ref: 00F81500
CLSIDFromProgID.OLE32(?,?), ref: 00F81512

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: From$ProgString_memset_wcsncpy
String ID:
API String ID: 2240319475-0
Opcode ID: 532ffab6ba5e13da2b54810aacf7de2d87c25cafc6011f9c06b6bb77fdf8e53b
Instruction ID: 134ac0b5de43f903fe64c3f003a10db7059a3c81b427da341c2ee1c16340f719
Opcode Fuzzy Hash: 532ffab6ba5e13da2b54810aacf7de2d87c25cafc6011f9c06b6bb77fdf8e53b
Instruction Fuzzy Hash: 54110A719043419FD314EF24C845AABBBE5FFC8710F448A1EB48A9B250EB39D5448B92

Function 00F88180 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

GetDeviceCaps.GDI32(?,00000058), ref: 00F881B2
GetDeviceCaps.GDI32(?,0000005A), ref: 00F881C9
MulDiv.KERNEL32(?,000009EC,00000000), ref: 00F881E0
MulDiv.KERNEL32(?,000009EC,00000000), ref: 00F881F2

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CapsDevice
String ID:
API String ID: 328075279-0
Opcode ID: 36b089b3e0686c4ad3e779cf15aa04ed2229fbe2aa65fe66213971496d4ffe2a
Instruction ID: 31a52970ba8cbfc3c2a6c4a6063f3974164f702a27afab04c099fccebaa22379
Opcode Fuzzy Hash: 36b089b3e0686c4ad3e779cf15aa04ed2229fbe2aa65fe66213971496d4ffe2a
Instruction Fuzzy Hash: C7119075640B009FD360DB69C984E16B7F9BF8C710B118559E68A8B7A1DA72F801CB10

Function 00F6B1C0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,0000003C,?), ref: 00F6B1E5
GdipCreateFontFromLogfontA.GDIPLUS(?,?), ref: 00F6B1F9
GdipCreateFontFromDC.GDIPLUS(?), ref: 00F6B206
GdipCreateFontFromDC.GDIPLUS(?), ref: 00F6B22B

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CreateFontFromGdip$LogfontObject
String ID:
API String ID: 3733165904-0
Opcode ID: b5592b5759f17b97432c73b6fbfbfb9b1b9a6cbceb7fb0b72669506a45807eff
Instruction ID: 2d91a3d62a06b1c05956e540d595317a97cf82465a6a8b35e87ef80ce2967f88
Opcode Fuzzy Hash: b5592b5759f17b97432c73b6fbfbfb9b1b9a6cbceb7fb0b72669506a45807eff
Instruction Fuzzy Hash: 86011BB46042059BC325EF28C892A2FB7F5BF98740F00491DE2C6C7350E735A941DB56

Function 00F966D0 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00F96D3B,000000FF,00000000,00000000,00000000,00000000,00000008,00000000,?,?,00F96D3B,?), ref: 00F966F5
_malloc.LIBCMT ref: 00F96701
_memset.LIBCMT ref: 00F9670C
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00F96D3B,000000FF,00000000,00000000,00000000,00000000,?,?,00F96D3B,?), ref: 00F96724

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ByteCharMultiWide$_malloc_memset
String ID:
API String ID: 1563474556-0
Opcode ID: dab30f1b262daf1a99f367909859568ca887e8095d641eb696082f4704e6a876
Instruction ID: 1524ca01f33e7025861f76f9c62bd2c7605cc21c3bf45153541404f918926830
Opcode Fuzzy Hash: dab30f1b262daf1a99f367909859568ca887e8095d641eb696082f4704e6a876
Instruction Fuzzy Hash: 0DF0823238431536F630365A9C46F97BB5DDB81FB4F344212B628AE1C1D996742052B9

Function 00F181D0 Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F181F7
VerSetConditionMask.KERNEL32 ref: 00F18225
VerSetConditionMask.KERNEL32(00000000,?,00000001,00000003), ref: 00F1822D
VerifyVersionInfoW.KERNEL32(?,00000003,00000000), ref: 00F18238

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion_memset
String ID:
API String ID: 3299124433-0
Opcode ID: 8c42779d31930181e89c991305eabfda57b046cdb18ed96d5dcbfe7bec660f91
Instruction ID: 692ae61d8695a1b82f1b427ad8e5d2b8bc866d38d060c1e26272be1ddf82aa81
Opcode Fuzzy Hash: 8c42779d31930181e89c991305eabfda57b046cdb18ed96d5dcbfe7bec660f91
Instruction Fuzzy Hash: 3B01A9706443046BE230AF70DC0BFAB7BADAB84B14F00450DB6845B1C0DBBA951487D6

Function 00F709E0 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

GetClipBox.GDI32(?,?), ref: 00F709FC
CreateRectRgnIndirect.GDI32(?), ref: 00F70A0D
CreateRectRgnIndirect.GDI32(?), ref: 00F70A17
ExtSelectClipRgn.GDI32(?,00000000,00000001), ref: 00F70A20

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ClipCreateIndirectRect$Select
String ID:
API String ID: 4223180713-0
Opcode ID: 62f7d984f951722428b0b112051dce8146108b29bdb03cfb2c4d5cae7f0bee11
Instruction ID: 9f449504e9fed3ccc66349e7a927505c6bec3db35b5d1c245b005c4b5b531eee
Opcode Fuzzy Hash: 62f7d984f951722428b0b112051dce8146108b29bdb03cfb2c4d5cae7f0bee11
Instruction Fuzzy Hash: CD0160B49047019FD320DF69D88095BBBF5FB88604F508A1EB99993214E779E6448F92

Function 00FDD6BE Relevance: 6.0, APIs: 4, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00FDD6CA

Part of subcall function 00FE5938: __getptd_noexit.LIBCMT ref: 00FE593B
Part of subcall function 00FE5938: __amsg_exit.LIBCMT ref: 00FE5948

__getptd.LIBCMT ref: 00FDD6E1
__amsg_exit.LIBCMT ref: 00FDD6EF
__lock.LIBCMT ref: 00FDD6FF

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID:
API String ID: 3521780317-0
Opcode ID: 5ada57b4ba1ad6bb07791735af866bc2963ada0e053e7edd19839f7a86cb9334
Instruction ID: 9a5c605864f90604e007019992990065b4e2bde590770f7655f4bf1154f514ee
Opcode Fuzzy Hash: 5ada57b4ba1ad6bb07791735af866bc2963ada0e053e7edd19839f7a86cb9334
Instruction Fuzzy Hash: 4BF06D32942B44CBD720FB75880674D73A16F00B24F48425BE484AB3C2CB3CA941AF91

Function 00FE215B Relevance: 6.0, APIs: 4, Instructions: 19threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__IsNonwritableInCurrentImage.LIBCMT ref: 00FE216E

Part of subcall function 00FF2590: __FindPESection.LIBCMT ref: 00FF25EB

__getptd_noexit.LIBCMT ref: 00FE217E
__freeptd.LIBCMT ref: 00FE2188
ExitThread.KERNEL32 ref: 00FE2191

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CurrentExitFindImageNonwritableSectionThread__freeptd__getptd_noexit
String ID:
API String ID: 3182216644-0
Opcode ID: d76ef977911c9eeeb145a32cdf057033d64fd51e3ae9e3b2eda9e781c8252f77
Instruction ID: c7e6cd24e30f5519cb2a761c91d1d4161aa0ec3c3d4e1b3071efe4c314e90787
Opcode Fuzzy Hash: d76ef977911c9eeeb145a32cdf057033d64fd51e3ae9e3b2eda9e781c8252f77
Instruction Fuzzy Hash: 0FD0C73040068E6BD6603BB3EC0E62A36CDAB80721F280020B640940A2EF2DCA82E221

Function 00F38C80 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 274stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00F12580: _memcpy_s.LIBCMT ref: 00F125FD

lstrlenW.KERNEL32(?,00000000,00000000,000000FF,?,?,01017170,00000001,00000000,00000001,?,00000000,000000FF,01014D18,00000000), ref: 00F38E7E
WideCharToMultiByte.KERNEL32(00000003,00000000,?,000000FF,?,?,00000000,00000000), ref: 00F38EAC

Strings

.exe, xrefs: 00F38D1D

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ByteCharMultiWide_memcpy_slstrlen
String ID: .exe
API String ID: 154246496-4119554291
Opcode ID: 0ec4dc3f04c5eba7cddfa94e11bc6db625f2e071d8333dafb2d978d6d1ae2070
Instruction ID: 69e5c78753931cc749f21fa9833b4c4d8d2f83c1ec9aa927cde659d5f3b906a3
Opcode Fuzzy Hash: 0ec4dc3f04c5eba7cddfa94e11bc6db625f2e071d8333dafb2d978d6d1ae2070
Instruction Fuzzy Hash: 78A1B0B1900348EBCB10EFA8CC81BDE7BB5BF04364F144619F915A7281DB79E985DB91

Function 00F1F480 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 194COMMON

Download Yara Rule

APIs

_localeconv.LIBCMT ref: 00F1F4AE

Part of subcall function 00FDB62C: __getptd.LIBCMT ref: 00FDB62C

Part of subcall function 00FDA143: ____lc_handle_func.LIBCMT ref: 00FDA146
Part of subcall function 00FDA143: ____lc_codepage_func.LIBCMT ref: 00FDA14E

Strings

false, xrefs: 00F1F515
true, xrefs: 00F1F534

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ____lc_codepage_func____lc_handle_func__getptd_localeconv
String ID: false$true
API String ID: 679402580-2658103896
Opcode ID: 5ec4873523b531e4324f1edba47e5a082fdf708f972ac0c11f93b3e899fe3994
Instruction ID: 390c82feeb939ce6986ae2f3299b08b375ced887cc1be66bdfbd5e449316e0b5
Opcode Fuzzy Hash: 5ec4873523b531e4324f1edba47e5a082fdf708f972ac0c11f93b3e899fe3994
Instruction Fuzzy Hash: 6F716FB1C042499FCB00DFA8C8819EEBBF5FF48300F18856EE559AB301E7799644DBA5

Function 00F678D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 192COMMON

Download Yara Rule

APIs

PtInRect.USER32(?,?,?), ref: 00F679B8
PtInRect.USER32(?,?,?), ref: 00F679FC

Strings

itemclick, xrefs: 00F67A99

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Rect
String ID: itemclick
API String ID: 400858303-803468992
Opcode ID: ea391a473023dd23885a45278a36eb1bf30d27e9592429fa126c605bc0eeaf61
Instruction ID: 30c2bd9ae6b2ceab0e8677fe1e24471a06d43bed6e645dcecfff4365acde66b7
Opcode Fuzzy Hash: ea391a473023dd23885a45278a36eb1bf30d27e9592429fa126c605bc0eeaf61
Instruction Fuzzy Hash: 5951AE76B043019BCB14EE68DCC0F6973A1AF86324F1486B9E9099F356CA35EC19E790

Function 00F658F0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 179COMMON

Download Yara Rule

APIs

IntersectRect.USER32(?,?,?), ref: 00F65A33
IntersectRect.USER32(?,?,?), ref: 00F65AB3

Strings

Container, xrefs: 00F65933

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: IntersectRect
String ID: Container
API String ID: 481094312-1163095736
Opcode ID: 5da15813978cc4c08d08df0af801b104263a79659eaedc9095837d1e4697c367
Instruction ID: 8bfe76f110a0c929a56b5d5a5ed5553ef8ffa4f324d7e357653c741a460b6dde
Opcode Fuzzy Hash: 5da15813978cc4c08d08df0af801b104263a79659eaedc9095837d1e4697c367
Instruction Fuzzy Hash: 9D611474604A028FC718DF68C49096AF3E2BFCC720F148A6DE98997355DB34ED45CB82

Function 00F957B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 170COMMON

Download Yara Rule

Strings

%4x, xrefs: 00F95871, 00F958CA

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID:
String ID: %4x
API String ID: 0-607344608
Opcode ID: 81df35b6cb632c5b31979d4bcb2cee0a0cfcf1e4049c464ce79fbc05f4f2292f
Instruction ID: 2cf8fd5262d87199cc905631a132b01a84bb6c0bfae91849a42a8ccb267d72cf
Opcode Fuzzy Hash: 81df35b6cb632c5b31979d4bcb2cee0a0cfcf1e4049c464ce79fbc05f4f2292f
Instruction Fuzzy Hash: BF513C71808B81CFFF278F18C850368BBD1EB91B30F18996ED1C687242D2798989E752

Function 00FB1490 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 00FD3BA0: _memset.LIBCMT ref: 00FD3C00

_memset.LIBCMT ref: 00FB155F

Strings

curl, xrefs: 00FB16BD
i386-pc-win32, xrefs: 00FB168F

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _memset
String ID: curl$i386-pc-win32
API String ID: 2102423945-3250060130
Opcode ID: 2da30f058f9b15b72206808a366e922ce53cd0aa412cb2f910294a7a836f147a
Instruction ID: 342f93fef2e3a07c36a892a430b9555572c5c827974c03ab6541196d96fae502
Opcode Fuzzy Hash: 2da30f058f9b15b72206808a366e922ce53cd0aa412cb2f910294a7a836f147a
Instruction Fuzzy Hash: C9717E745083418FC725CF28C490AABB7E6FFCA304F44896DE9C98B356EA35A509CB56

Function 00F1B520 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 00F1B6B5

Strings

%, xrefs: 00F1B63D
+, xrefs: 00F1B64B

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: swprintf
String ID: %$+
API String ID: 233258989-2626897407
Opcode ID: e2cb5ecde8701e9621ec8b21552e024c4a290b91e57a2450e24dca99ee9221e3
Instruction ID: 067ee364d70c36e882a93827f26976c4189728f9d574d102ee45bfe40f4265ef
Opcode Fuzzy Hash: e2cb5ecde8701e9621ec8b21552e024c4a290b91e57a2450e24dca99ee9221e3
Instruction Fuzzy Hash: B0517B73E08300DBD7129E18C8947E77BE9EB55350F244988E9C593396E7398D849BD2

Function 00F1B700 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 164COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 00F1B885

Strings

%, xrefs: 00F1B80D
+, xrefs: 00F1B81B

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: swprintf
String ID: %$+
API String ID: 233258989-2626897407
Opcode ID: fe58e2f510e05391374ea220361bfa5a980ed2207d8c9a7184fc75aa9e170c48
Instruction ID: 24cf271aeb0ea4d561afed5d7e4ea8e4af3a0d47a1af0efad7b431e6db578167
Opcode Fuzzy Hash: fe58e2f510e05391374ea220361bfa5a980ed2207d8c9a7184fc75aa9e170c48
Instruction Fuzzy Hash: 18516873E08340DBD7159E18C8847EB7BE8EB85750F24494CF991833D2E7398C859B92

Function 00FBB8C0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 136networkCOMMON

Download Yara Rule

APIs

WSAGetLastError.WS2_32 ref: 00FBBA1C

Strings

FTP response timeout, xrefs: 00FBBA01
FTP response aborted due to select/poll error: %d, xrefs: 00FBBA27

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ErrorLast
String ID: FTP response aborted due to select/poll error: %d$FTP response timeout
API String ID: 1452528299-4057338436
Opcode ID: a27d0dfd6a69db3924d2084644bdc8220d564da7538ea085f34e3f81f70dec9f
Instruction ID: b355aa865ebd7ac8293614ca16be63c10a986928b5052bc4ff2e5782c5335822
Opcode Fuzzy Hash: a27d0dfd6a69db3924d2084644bdc8220d564da7538ea085f34e3f81f70dec9f
Instruction Fuzzy Hash: 4F41C075A083019BD714DF1ADC41B9BB3E4AF84325F440A2DFD98C6392E7B8D909DE92

Function 00F374E0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00F375ED

Strings

open, xrefs: 00F375E6
app:openWeb?url=, xrefs: 00F3757E

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ExecuteShell
String ID: app:openWeb?url=$open
API String ID: 587946157-1944791042
Opcode ID: 56f10f7c0a850e94631e91b9a249e7a83104dab439b595d1291a028b36c8d746
Instruction ID: 3574124b3fba92851452e7f338153dbe947983d116c85c1cae1599028379897d
Opcode Fuzzy Hash: 56f10f7c0a850e94631e91b9a249e7a83104dab439b595d1291a028b36c8d746
Instruction Fuzzy Hash: B741BCB1508340ABD710EF24CC46B5BB7E5FF88724F440A2DF5859B290D77AE948CB96

Function 00F9F010 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 101COMMON

Download Yara Rule

Strings

Use of IPv6 in *_CONNECT_TO without IPv6 support built-in!, xrefs: 00F9F058
No valid port number in connect to host string (%s), xrefs: 00F9F0E9

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID:
String ID: No valid port number in connect to host string (%s)$Use of IPv6 in *_CONNECT_TO without IPv6 support built-in!
API String ID: 0-4034642053
Opcode ID: ffe3564231872e0f46f718df85f6330458327ca4c2d7f0dcd6ceaddb1d1ff9d9
Instruction ID: 3858a3fd9e4007e889b379f577c6341dde32066a6d160262e5d76502aff5e75b
Opcode Fuzzy Hash: ffe3564231872e0f46f718df85f6330458327ca4c2d7f0dcd6ceaddb1d1ff9d9
Instruction Fuzzy Hash: 9A310B71A003415BFB219F65EC8072BBB98EF81731F144439F585CA282D73AC859E752

Function 00F3F710 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

Part of subcall function 00F44290: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,00000000,00000000), ref: 00F442F0

Part of subcall function 00F12BB0: std::_String_base::_Xlen.LIBCPMT ref: 00F12BE7
Part of subcall function 00F12BB0: _memcpy_s.LIBCMT ref: 00F12C36

ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00F3F800

Strings

open, xrefs: 00F3F7FA
ProductLicenseUrl, xrefs: 00F3F764

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ByteCharExecuteMultiShellString_base::_WideXlen_memcpy_sstd::_
String ID: ProductLicenseUrl$open
API String ID: 2277037791-3746290764
Opcode ID: f3f5552b10b94797c3eba3eff1c77e5da7fc7df7413044de7d9987cdf7ab018f
Instruction ID: ad9bc9290217e80b0c0496dffbcedcd6056e6f0b61eb1dac4c98619f3831f055
Opcode Fuzzy Hash: f3f5552b10b94797c3eba3eff1c77e5da7fc7df7413044de7d9987cdf7ab018f
Instruction Fuzzy Hash: A931A6B1908340AFD714EF64CC82A5BBBE8FB85764F500A2DF5514B281D77AE849CB93

Function 00F44940 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 83COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,8F2D4ADD,.ini,00000000), ref: 00F4499A
_strrchr.LIBCMT ref: 00F449A7

Strings

.ini, xrefs: 00F44963

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: FileModuleName_strrchr
String ID: .ini
API String ID: 1375183968-3921635435
Opcode ID: ce91a33f96403d7aabd5c6e8e1a3394649eddff20854dd4223fde5ace76ecea1
Instruction ID: 04b66f2c4f3453a93aae3cc121b59a993dee440dc52aa8c4551717ce3b556b5b
Opcode Fuzzy Hash: ce91a33f96403d7aabd5c6e8e1a3394649eddff20854dd4223fde5ace76ecea1
Instruction Fuzzy Hash: B531A2B15083809FD321DF24DC45B9BB7E9AB88710F444A2EF08987391DB39A548DB93

Function 00F14AB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 00F14AD2
GetClientRect.USER32(?,?), ref: 00F14AE1

Strings

Button, xrefs: 00F14B38

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: Client$RectScreen
String ID: Button
API String ID: 67810849-1034594571
Opcode ID: 13daae622d1aa9e38f6084673da7d5055c2459b74ea3e7f11508e692332bee38
Instruction ID: f47d15f5754e7881c03a3ae98bf6a397839d798fa3eebdd7d45bb8a236e79b35
Opcode Fuzzy Hash: 13daae622d1aa9e38f6084673da7d5055c2459b74ea3e7f11508e692332bee38
Instruction Fuzzy Hash: EC218E756087018BD724DF28C880AABB3E5EBD8321F044A2DE996C7390E338FD859794

Function 00F88770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73windowCOMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000F4), ref: 00F887F3
SendMessageW.USER32(?,0000004E,00000000,?), ref: 00F88826

Strings

textchanged, xrefs: 00F887AC

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: LongMessageSendWindow
String ID: textchanged
API String ID: 3360111000-1330398090
Opcode ID: 3110ec83694190cbc52bfe468399b02a5a21281bc59a3d89de846df905861a72
Instruction ID: 178bd09c860b61701a81ffa6b456ae714a393cf5384aaa9186f6ae534d5db9b0
Opcode Fuzzy Hash: 3110ec83694190cbc52bfe468399b02a5a21281bc59a3d89de846df905861a72
Instruction Fuzzy Hash: C321D571B402049FD730FB58ED84FAEB7E5BB88760F604216E25C87691DB7AE8018B90

Function 00F4F090 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32(?), ref: 00F4F0A6
GetTickCount.KERNEL32 ref: 00F4F0E7

Strings

killfocus, xrefs: 00F4F114

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: CountFocusTick
String ID: killfocus
API String ID: 3897604831-1616503811
Opcode ID: 2bcfbf4cdec5ef74577a81dacbffea9f281ce8a648ecd0b8994150581d6c2d41
Instruction ID: 1f4b4060de6f697e882a4e1f8756b7f1c7f4cab623f2a4c387e5ff7fb6f5d2c1
Opcode Fuzzy Hash: 2bcfbf4cdec5ef74577a81dacbffea9f281ce8a648ecd0b8994150581d6c2d41
Instruction Fuzzy Hash: DE312770A04742AFD355CF28C440B9AFBE1BF88704F148A2EE5AC97251D7B5A559CB82

Function 00FA81E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,?,00000000), ref: 00FA821F
WSAGetLastError.WS2_32 ref: 00FA8236

Strings

Recv failure: %s, xrefs: 00FA825D

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ErrorLastrecv
String ID: Recv failure: %s
API String ID: 2514157807-4276829032
Opcode ID: ea0793de7b57a3adbb3152fea8985d1045630f3f3662ad5ebf4c0bf0e3780d4b
Instruction ID: d16b0ad4431440b4c7b489e45999b48fd8f84e3f9d9c630b98520ee7fae5cdb0
Opcode Fuzzy Hash: ea0793de7b57a3adbb3152fea8985d1045630f3f3662ad5ebf4c0bf0e3780d4b
Instruction Fuzzy Hash: F011C6B67003045BD7109F59EC80BAAB3E9EBCA3A2F10046EF644C7381CB76A8059B61

Function 00F33550 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 00F335F7

Strings

open, xrefs: 00F335F0
ContrastPageBuyUrl, xrefs: 00F33598

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ExecuteShell
String ID: ContrastPageBuyUrl$open
API String ID: 587946157-2694527512
Opcode ID: ac386a8b07cdcb524c7688becbc8d9d4b2934d80f87d7693214108bdea9dff2f
Instruction ID: 7b39fadcfd0838da57bf7501a6e193bd942424de4d3e8b7911e35c712330bfc7
Opcode Fuzzy Hash: ac386a8b07cdcb524c7688becbc8d9d4b2934d80f87d7693214108bdea9dff2f
Instruction Fuzzy Hash: 32216DB1208380EFD714DF24C846B1BB7E5BB89B18F400A1DF4996A280D7BAE544DB57

Function 00F40400 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000112,0000F020,00000000), ref: 00F40459

Strings

Click_Min, xrefs: 00F4045F
Home_Installer, xrefs: 00F4046D

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: MessageSend
String ID: Click_Min$Home_Installer
API String ID: 3850602802-577197087
Opcode ID: 5ea28d958a4521a2f4c990978752114c577d4a2364d70cbe7d51d6d92e513ecf
Instruction ID: 154978a5e039121e88bbdc7710230e8651628c954e51b841a728e8841b649164
Opcode Fuzzy Hash: 5ea28d958a4521a2f4c990978752114c577d4a2364d70cbe7d51d6d92e513ecf
Instruction Fuzzy Hash: 8F21A231108340AFC310DB54CC45B9AB7E8FB84714F008A1CF598872D1EB79E548DBA2

Function 00F26830 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?), ref: 00F26861
ShellExecuteW.SHELL32(00000000,open,00000000,00000000,00000000,00000001), ref: 00F26899

Part of subcall function 00F11080: MultiByteToWideChar.KERNEL32(?,00000000,?,000000FF,?,00000001,00F243CD,00000003), ref: 00F11098

Strings

open, xrefs: 00F26892

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ByteCharExecuteMultiShellWidelstrlen
String ID: open
API String ID: 1978087685-2758837156
Opcode ID: b3b34ab3065b0c008d68ccb306814c16b0ab0830d3fe736becbc07b9a0bebf3e
Instruction ID: ad01e0c3af7214baf856b9010aa46a7d813af1c1ab53ac3fc833c6bab4c09029
Opcode Fuzzy Hash: b3b34ab3065b0c008d68ccb306814c16b0ab0830d3fe736becbc07b9a0bebf3e
Instruction Fuzzy Hash: 1C012831B00354ABDB209F69ECC1BAA73A9EF08721F500129F915DB186CB76EC449750

Function 00FE35FE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00FE2ACB: __getptd.LIBCMT ref: 00FE2AD1
Part of subcall function 00FE2ACB: __getptd.LIBCMT ref: 00FE2AE1

__getptd.LIBCMT ref: 00FE360D

Part of subcall function 00FE5938: __getptd_noexit.LIBCMT ref: 00FE593B
Part of subcall function 00FE5938: __amsg_exit.LIBCMT ref: 00FE5948

__getptd.LIBCMT ref: 00FE361B

Strings

csm, xrefs: 00FE3629

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: e19a74ec59e38886b2a6237d80a798923043fadc09895cd27ace22c509c2fcdc
Instruction ID: e23226c33dc140f2e265894cd81fb892984b4d062375ef66158434f08325e9e4
Opcode Fuzzy Hash: e19a74ec59e38886b2a6237d80a798923043fadc09895cd27ace22c509c2fcdc
Instruction Fuzzy Hash: 42012C34C02284AFCF349F36D85CAACB3B5AF10721FA4452EE04257361CB399A91EF95

Function 00FF6F90 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMONLIBRARYCODE

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?,?,00FF6FE0,?,00000000,00000007,00000007,?,00FF7125,00000000,?,?,01028DA8,0000000C,00FF0E3C,?), ref: 00FF6FB6

Strings

:, xrefs: 00FF6FAA
\, xrefs: 00FF6FAE

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: DriveType
String ID: :$\
API String ID: 338552980-1166558509
Opcode ID: 6eb2f599bc4c318b67039d000e7ba5ef7f14c0a607cb5be7d5d1b15bf3e9790b
Instruction ID: 5a46305cc8ee4f1b10f44b0132bc0c0d854fff126a5d1dd8aee568401de1c668
Opcode Fuzzy Hash: 6eb2f599bc4c318b67039d000e7ba5ef7f14c0a607cb5be7d5d1b15bf3e9790b
Instruction Fuzzy Hash: F8E0D83070828C5DEF11CE75A4447AA3FDC8F513A8F04C055F95CCE141E631D6158351

Function 00F49230 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

_wcsncpy.LIBCMT ref: 00F4923A
_wcsncpy.LIBCMT ref: 00F49257

Strings

Expected start tag, xrefs: 00F49235

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: _wcsncpy
String ID: Expected start tag
API String ID: 1735881322-1525701253
Opcode ID: ec737663a66544395df218353d4805d889d7e6ba48d3519f1579badbae41533b
Instruction ID: fd3ec085b5493984137971e2cdfc55c3f61ba8497ff96a68b909223c92a55939
Opcode Fuzzy Hash: ec737663a66544395df218353d4805d889d7e6ba48d3519f1579badbae41533b
Instruction Fuzzy Hash: 0FD05E72F8022533DA256164AC57EAB321D1BB1F10F09022AB800AE385E9DDDA9612E0

Function 00FDA084 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FDA08B
__CxxThrowException@8.LIBCMT ref: 00FDA0B6

Part of subcall function 00FE274B: RaiseException.KERNEL32(?,?,00FDB416,?,?,?,?,?,00FDB416,?,01028E28,010368F0,?,00F12B84,00000000,8F2D4ADD), ref: 00FE278D

Strings

invalid string position, xrefs: 00FDA090

Memory Dump Source

Source File: 00000001.00000002.2889996204.0000000000F11000.00000020.00000001.01000000.00000004.sdmp, Offset: 00F10000, based on PE: true

Associated: 00000001.00000002.2889967278.0000000000F10000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890154973.0000000001006000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890207740.0000000001033000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.2890245982.0000000001039000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_f10000_EDownloader.jbxd

Similarity

API ID: ExceptionException@8H_prolog3RaiseThrow
String ID: invalid string position
API String ID: 1961742612-1799206989
Opcode ID: 5187dfb88ea59550fb4e24c62cf2b8a0fa07c841a14e49647fff6f85d558cfd7
Instruction ID: 4263fb8826242dfceac2c6fba0ac5624502dc72766ae965a41887345a846d00c
Opcode Fuzzy Hash: 5187dfb88ea59550fb4e24c62cf2b8a0fa07c841a14e49647fff6f85d558cfd7
Instruction Fuzzy Hash: A7D01771A1011C9ACB08FBE1CC46FDDB778AF04310F501029F201BA052EBB89A49E764

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: mov dword ptr [esi+04h], 424D53FFh	1_2_00FB12F0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: mov dword ptr [esi+04h], 424D53FFh	2_2_6E2946B0
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: mov dword ptr [esi+04h], 424D53FFh	3_2_6C9D46B0

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00F15090 CreateFileW,CloseHandle,CryptAcquireContextW,CryptCreateHash,GetFileSize,ReadFile,CryptHashData,CloseHandle,CryptGetHashParam,CryptGetHashParam,CryptGetHashParam,_sprintf,CryptDestroyHash,CryptReleaseContext,	1_2_00F15090
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FD3A40 CryptAcquireContextW,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	1_2_00FD3A40
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: 1_2_00FD3C80 CryptAcquireContextW,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	1_2_00FD3C80
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2B4D40 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	2_2_6E2B4D40
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 2_2_6E2B4B00 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	2_2_6E2B4B00
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9F4D40 CryptAcquireContextA,CryptCreateHash,CryptHashData,CryptGetHashParam,CryptDestroyHash,CryptReleaseContext,	3_2_6C9F4D40
Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\aliyun\InfoForSetup.exe	Code function: 3_2_6C9F4B00 CryptAcquireContextA,CryptImportKey,CryptReleaseContext,CryptEncrypt,CryptDestroyKey,CryptReleaseContext,	3_2_6C9F4B00

Source: C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe	Code function: -----BEGIN PUBLIC KEY-----		1_2_00FA52D0
Source: EDownloader.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.
Tactics:	Lateral Movement
Data Sources:	Application Log: Application Log Content, Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report drw_free_installer.17163939163819b153.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Exploits

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\index[1].htm

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Arabic.ini

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Chinese.ini

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\ChineseTrad.ini

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Danish.ini

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Dutch.ini

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EDownloader.exe

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\EasyLog.log

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\French.ini

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\German.ini

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Indonesian.ini

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\InitConfigure.ini

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Italian.ini

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Japanese.ini

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Korean.ini

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\LanguageTransfor.ini

C:\Users\user\AppData\Local\Temp\downloader_easeus\2.0.0\2free\Malay.ini

Windows Analysis Report
drw_free_installer.17163939163819b153.exe

Function 0040338F Relevance: 84.4, APIs: 33, Strings: 15, Instructions: 410
stringfilecomCOMMON

Function 004065FD Relevance: 3.0, APIs: 2, Instructions: 14
fileCOMMON

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre