Edit tour

Windows Analysis Report
StretchInstall.exe

Overview

General Information

Sample name:	StretchInstall.exe
Analysis ID:	1467084
MD5:	3f82a2195043cd2877b674cb321e2cf7
SHA1:	c2925fed17cba166db7164abdc0eb1f41de9717d
SHA256:	8f77b3b68bdfa80e0688a09c5e08ed765b6783192f4792524b8a1eec7ed7b608
Infos:

Detection

Score:	24
Range:	0 - 100
Whitelisted:	false
Confidence:	0%

Signatures

Contains functionality to register a low level keyboard hook

Installs a global keyboard hook

Checks for available system drives (often done to infect USB drives)

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query locales information (e.g. system language)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected potential crypto function

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

Installs a global mouse hook

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Potential key logger detected (key state polling based)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

StretchInstall.exe (PID: 884 cmdline: "C:\Users\user\Desktop\StretchInstall.exe" MD5: 3F82A2195043CD2877B674CB321E2CF7)

setup.exe (PID: 5788 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe MD5: E98B8B16179129CC1B75C3D0A7B67CD4)

msiexec.exe (PID: 5040 cmdline: "C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\user\AppData\Local\Temp\IXP000.TMP\StretchWare.msi" MD5: 9D09DC1EDA745A5F87553048E57620CF)

msiexec.exe (PID: 6936 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

rundll32.exe (PID: 2156 cmdline: "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\" MD5: EF3179D498793BF4234F708D3BE28633)

StchCtrl.exe (PID: 3360 cmdline: "C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe" MD5: A76894A90372756D69A9F51704EF43F5)

cleanup

Sigma Signatures

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: rundll32.exe C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\StretchInstall.exe, ProcessId: 884, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Users\user\Desktop\StretchInstall.exe

Code function: 0_2_01006205 GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,

0_2_01006205

Source: StretchInstall.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe

File created: C:\Users\user\AppData\Local\Temp\VSDAAAD.tmp\install.log

Jump to behavior

Source:	Binary string: wextract.pdb source: StretchInstall.exe
Source:	Binary string: setup.pdb source: setup.exe, setup.exe, 00000002.00000000.2092317947.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, setup.exe, 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, setup.exe.0.dr

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: C:\Users\user\Desktop\StretchInstall.exe	Code function: 0_2_01002A96 FindFirstFileA,lstrcmpA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_01002A96
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: 2_2_00D2DE9F __EH_prolog3_GS,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_00D2DE9F
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00F83089 GetModuleHandleA,GetProcAddress,FindFirstFileA,	11_2_00F83089
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00F83477 _strcpy_s,lstrlenA,SetLastError,FindFirstFileA,GetLastError,__fullpath,__splitpath_s,__makepath_s,	11_2_00F83477
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00F7D99C __EH_prolog3_GS,GetFullPathNameA,__cftof,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,_strcpy_s,	11_2_00F7D99C

Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Installer\{1D2F2573-A76A-47DA-BB96-6860D17CC45B}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Installer	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: StchCtrl.exe, 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmp, Stretch.exe.4.dr, StchCtrl.exe.4.dr	String found in binary or memory: http://activate.esellerate.net
Source: StchCtrl.exe.4.dr	String found in binary or memory: http://activate.esellerate.net).
Source: setup.exe, 00000002.00000002.3342719410.0000000002356000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.c
Source: StchCtrl.exe, 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmp, Stretch.exe.4.dr, StchCtrl.exe.4.dr	String found in binary or memory: http://www.esellerate.net/papolicy
Source: StchCtrl.exe, 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmp, Stretch.exe.4.dr, StchCtrl.exe.4.dr	String found in binary or memory: http://www.esellerate.net/papolicyhttp://activate.esellerate.netSelect
Source: StchCtrl.exe, 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmp, Stretch.exe.4.dr, StchCtrl.exe.4.dr	String found in binary or memory: http://www.esellerate.net/privacy.asp
Source: StchCtrl.exe, 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmp, Stretch.exe.4.dr, StchCtrl.exe.4.dr	String found in binary or memory: http://www.esellerate.net/privacy.aspCONNECTION
Source: StchCtrl.exe, 0000000B.00000002.3342928233.000000006BCFA000.00000002.00000001.01000000.0000000A.sdmp, StretchRes.dll.4.dr	String found in binary or memory: http://www.shelterpub.com/
Source: StchCtrl.exe, 0000000B.00000002.3342928233.000000006BCFA000.00000002.00000001.01000000.0000000A.sdmp, StretchRes.dll.4.dr	String found in binary or memory: http://www.stretchware.com/
Source: StchCtrl.exe.4.dr	String found in binary or memory: http://www.stretchware.com/expire.html
Source: StchCtrl.exe, 0000000B.00000002.3342928233.000000006BCFA000.00000002.00000001.01000000.0000000A.sdmp, StretchRes.dll.4.dr	String found in binary or memory: http://www.stretchware.com/expire.htmlPAMornKeybWrisStrsLbakStanStifSpon
Source: StretchRes.dll.4.dr	String found in binary or memory: http://www.stretchware.com/stretching_resources.html(http://www.stretchware.com/products.html

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to register a low level keyboard hook

Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe

Code function: 11_2_73F712A0 SetWindowsHookExA 00000002,?KeyboardProc@@YGJHIJ@Z,?,00000000

11_2_73F712A0

Installs a global keyboard hook

Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Windows user hook set: 0 keyboard C:\Program Files (x86)\Shelter Publications\StretchWare\StretchHook.dll			Jump to behavior
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Windows user hook set: 0 mouse C:\Program Files (x86)\Shelter Publications\StretchWare\StretchHook.dll			Jump to behavior

Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe

Code function: 11_2_0100969E __EH_prolog3_catch_GS,CreateCompatibleDC,CreateCompatibleBitmap,FillRect,OpenClipboard,EmptyClipboard,CloseClipboard,SetClipboardData,CloseClipboard,

11_2_0100969E

Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe

Code function: 11_2_00F7A00F GetPropA,GlobalLock,SendMessageA,SendMessageA,GlobalUnlock,RemovePropA,GlobalFree,GlobalUnlock,GetAsyncKeyState,SendMessageA,

11_2_00F7A00F

Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe

Windows user hook set: 0 mouse C:\Program Files (x86)\Shelter Publications\StretchWare\StretchHook.dll

Jump to behavior

Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00FC0035 MessageBeep,SendMessageA,SendMessageA,SendMessageA,SendMessageA,GetKeyState,SendMessageA,GetKeyState,SendMessageA,SendMessageA,GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,SendMessageA,GetKeyState,SendMessageA,GetKeyState,SendMessageA,SendMessageA,	11_2_00FC0035
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00FB235A GetKeyState,GetKeyState,GetKeyState,	11_2_00FB235A
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00F94665 IsWindow,SendMessageA,GetCapture,GetKeyState,GetKeyState,GetKeyState,ImmGetContext,ImmGetOpenStatus,ImmReleaseContext,GetFocus,IsWindow,IsWindow,IsWindow,ClientToScreen,IsWindow,ClientToScreen,	11_2_00F94665
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00F927D9 IsWindow,SendMessageA,GetCapture,GetKeyState,GetKeyState,GetKeyState,ImmGetContext,ImmGetOpenStatus,ImmReleaseContext,GetFocus,IsWindow,IsWindow,IsWindow,ClientToScreen,IsWindow,ClientToScreen,	11_2_00F927D9
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00FC0BF8 GetParent,GetKeyState,GetKeyState,GetKeyState,SendMessageA,SendMessageA,SendMessageA,	11_2_00FC0BF8
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00F6F1C6 SendMessageA,UpdateWindow,GetKeyState,GetKeyState,GetKeyState,GetParent,PostMessageA,	11_2_00F6F1C6
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00FB3910 ScreenToClient,_memset,_free,GetKeyState,GetKeyState,GetKeyState,KillTimer,IsWindow,	11_2_00FB3910
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00F6DAD0 GetKeyState,GetKeyState,GetKeyState,	11_2_00F6DAD0
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00F6DA80 GetKeyState,GetKeyState,GetKeyState,MessageBeep,	11_2_00F6DA80
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00FDBC1B GetWindowRect,GetKeyState,GetKeyState,GetKeyState,KillTimer,GetFocus,SetTimer,	11_2_00FDBC1B
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00F75E51 GetKeyState,GetKeyState,GetKeyState,GetKeyState,SendMessageA,	11_2_00F75E51
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00FCDF74 GetKeyState,GetKeyState,GetKeyState,GetKeyState,	11_2_00FCDF74
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_73F71160 GetKeyState,GetKeyState,GetKeyState,GetKeyState,FindWindowA,PostMessageA,	11_2_73F71160

Source: C:\Users\user\Desktop\StretchInstall.exe	Code function: 0_2_01002251 ExitWindowsEx,	0_2_01002251
Source: C:\Users\user\Desktop\StretchInstall.exe	Code function: 0_2_010019C3 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,	0_2_010019C3
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: 2_2_00D4509A __EH_prolog3_catch_GS,HeapSetInformation,CoInitialize,CloseHandle,CoUninitialize,FreeLibrary,MessageBoxW,ExitWindowsEx,CloseHandle,CoUninitialize,FreeLibrary,MessageBoxW,KiUserCallbackDispatcher,CloseHandle,CoUninitialize,FreeLibrary,CloseHandle,CoUninitialize,FreeLibrary,CloseHandle,CoUninitialize,FreeLibrary,CoUninitialize,FreeLibrary,__CxxThrowException@8,CoUninitialize,MessageBoxW,Sleep,CoUninitialize,FreeLibrary,MessageBoxW,CoUninitialize,CoUninitialize,CoUninitialize,	2_2_00D4509A
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: 2_2_00D41C67 __EH_prolog3_GS,CloseHandle,ExitWindowsEx,	2_2_00D41C67
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00F61CE0 _memset,CreateProcessA,MessageBoxA,ExitWindowsEx,PostQuitMessage,	11_2_00F61CE0

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3ad363.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{1D2F2573-A76A-47DA-BB96-6860D17CC45B}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSID586.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3ad365.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\3ad365.msi	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\3ad365.msi

Jump to behavior

Source: C:\Users\user\Desktop\StretchInstall.exe	Code function: 0_2_0100871A	0_2_0100871A
Source: C:\Users\user\Desktop\StretchInstall.exe	Code function: 0_2_01009A1F	0_2_01009A1F
Source: C:\Users\user\Desktop\StretchInstall.exe	Code function: 0_2_01008A3E	0_2_01008A3E
Source: C:\Users\user\Desktop\StretchInstall.exe	Code function: 0_2_01009175	0_2_01009175
Source: C:\Users\user\Desktop\StretchInstall.exe	Code function: 0_2_01008DBD	0_2_01008DBD
Source: C:\Users\user\Desktop\StretchInstall.exe	Code function: 0_2_010095E5	0_2_010095E5
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: 2_2_00D4509A	2_2_00D4509A
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: 2_2_00D611BB	2_2_00D611BB
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: 2_2_00D64334	2_2_00D64334
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: 2_2_00D5C5BF	2_2_00D5C5BF
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: 2_2_00D62656	2_2_00D62656
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: 2_2_00D6070F	2_2_00D6070F
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: 2_2_00D6189C	2_2_00D6189C
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: 2_2_00D51A79	2_2_00D51A79
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: 2_2_00D60C65	2_2_00D60C65
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: 2_2_00D50DF0	2_2_00D50DF0
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00FE40F6	11_2_00FE40F6
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00FA421B	11_2_00FA421B
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_0100A9CA	11_2_0100A9CA
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00FE4A45	11_2_00FE4A45
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00FE2E85	11_2_00FE2E85
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00F972BF	11_2_00F972BF
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_0106353C	11_2_0106353C
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_01071C17	11_2_01071C17

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: String function: 00D2A9C9 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: String function: 00D531F0 appears 43 times
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: String function: 00D2AD06 appears 73 times
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: String function: 00D4F37D appears 104 times
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: String function: 00D6291B appears 32 times
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: String function: 00D4F3F0 appears 148 times
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: String function: 00D2EDD0 appears 34 times
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: String function: 00F72A87 appears 35 times
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: String function: 01062E02 appears 501 times
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: String function: 01062F10 appears 38 times
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: String function: 00F7E75E appears 42 times
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: String function: 00F66A20 appears 44 times
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: String function: 01062E6B appears 164 times

Source: StretchInstall.exe	Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 2821436 bytes, 2 files, at 0x2c +A "StretchWare.msi" +A "setup.exe", ID 2436, number 1, 100 datablocks, 0x1503 compression
Source: StchCtrl.exe.4.dr	Static PE information: Resource name: DLL type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: Stretch.exe.4.dr	Static PE information: Resource name: DLL type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: StretchInstall.exe

Binary or memory string: OriginalFilenameWEXTRACT.EXE j% vs StretchInstall.exe

Source: StretchInstall.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: sus24.spyw.evad.winEXE@8/29@0/0

Source: C:\Users\user\Desktop\StretchInstall.exe

Code function: 0_2_0100456A lstrcpyA,GetCurrentDirectoryA,SetCurrentDirectoryA,SetCurrentDirectoryA,GetLastError,FormatMessageA,GetVolumeInformationA,GetLastError,FormatMessageA,SetCurrentDirectoryA,SetCurrentDirectoryA,lstrcpynA,

0_2_0100456A

Source: C:\Users\user\Desktop\StretchInstall.exe

Code function: 0_2_010019C3 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,

0_2_010019C3

Source: C:\Users\user\Desktop\StretchInstall.exe

Code function: 0_2_01006A45 GetDiskFreeSpaceA,SetCurrentDirectoryA,MulDiv,

0_2_01006A45

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe

Code function: 2_2_00D43221 __EH_prolog3_catch_GS,GetCurrentProcessId,CreateToolhelp32Snapshot,__CxxThrowException@8,_memset,Process32FirstW,Process32NextW,Process32FirstW,Process32NextW,OpenProcess,GetExitCodeProcess,GetExitCodeProcess,Sleep,GetExitCodeProcess,CloseHandle,CreateFileW,CreateFileW,GetLastError,Sleep,CreateFileW,GetLastError,CloseHandle,CloseHandle,

2_2_00D43221

Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe

Code function: 11_2_00F85619 CoInitialize,CoCreateInstance,

11_2_00F85619

Source: C:\Users\user\Desktop\StretchInstall.exe

Code function: 0_2_01004819 FindResourceA,LoadResource,DialogBoxIndirectParamA,FreeResource,

0_2_01004819

Source: C:\Windows\System32\msiexec.exe

File created: C:\Program Files (x86)\Shelter Publications

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CMLD5D4.tmp

Jump to behavior

Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe

Mutant created: \Sessions\1\BaseNamedObjects\StretchWareCtrlClassSingleApplicationMutex

Source: C:\Users\user\Desktop\StretchInstall.exe

File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: StretchInstall.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\StretchInstall.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"

Source: StchCtrl.exe

String found in binary or memory: -INSTALL

Source: unknown	Process created: C:\Users\user\Desktop\StretchInstall.exe "C:\Users\user\Desktop\StretchInstall.exe"
Source: C:\Users\user\Desktop\StretchInstall.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\user\AppData\Local\Temp\IXP000.TMP\StretchWare.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: unknown	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"
Source: unknown	Process created: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe "C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe"
Source: C:\Users\user\Desktop\StretchInstall.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\user\AppData\Local\Temp\IXP000.TMP\StretchWare.msi"	Jump to behavior

Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: feclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Section loaded: advpack.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: acgenral.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: msacm32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: winmmbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msihnd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Section loaded: stretchhook.dll	Jump to behavior
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Section loaded: stretchres.dll	Jump to behavior
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Section loaded: wldp.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: Stretch.lnk.4.dr

LNK file: ..\..\..\..\Installer\{1D2F2573-A76A-47DA-BB96-6860D17CC45B}\_24275761ADC5B212D44AB6.exe

Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next >
Source: C:\Windows\SysWOW64\msiexec.exe	Automated click: Next >

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: StretchInstall.exe

Static file information: File size 2887680 > 1048576

Source: StretchInstall.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x2b6e00

Source: StretchInstall.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wextract.pdb source: StretchInstall.exe
Source:	Binary string: setup.pdb source: setup.exe, setup.exe, 00000002.00000000.2092317947.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, setup.exe, 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, setup.exe.0.dr

Source: C:\Users\user\Desktop\StretchInstall.exe

Code function: 0_2_01006205 GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,

0_2_01006205

Source: setup.exe.0.dr

Static PE information: real checksum: 0x65cd5 should be: 0x75d16

Source: StretchHook.dll.4.dr

Static PE information: section name: .shared

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: 2_2_00D53235 push ecx; ret	2_2_00D53248
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: 2_2_00D4F469 push ecx; ret	2_2_00D4F47C
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00FEC1D2 push 3BFFFFFFh; iretd	11_2_00FEC1D7
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_01062F55 push ecx; ret	11_2_01062F68
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_01062EDA push ecx; ret	11_2_01062EED
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_6BCF2285 push ecx; ret	11_2_6BCF2298
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_73F725B5 push ecx; ret	11_2_73F725C8

Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Shelter Publications\StretchWare\StretchRes.dll	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Shelter Publications\StretchWare\Stretch.exe	Jump to dropped file
Source: C:\Users\user\Desktop\StretchInstall.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Program Files (x86)\Shelter Publications\StretchWare\StretchHook.dll	Jump to dropped file

Source: C:\Users\user\Desktop\StretchInstall.exe

Code function: 0_2_010026E2 LocalFree,lstrcpyA,lstrcpyA,lstrcmpiA,lstrcmpiA,lstrlenA,lstrlenA,lstrlenA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,wsprintfA,lstrcmpiA,lstrlenA,lstrlenA,lstrlenA,LocalAlloc,wsprintfA,LocalAlloc,GetFileAttributesA,

0_2_010026E2

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe

File created: C:\Users\user\AppData\Local\Temp\VSDAAAD.tmp\install.log

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StretchWare			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StretchWare\Stretch.lnk			Jump to behavior

Source: C:\Users\user\Desktop\StretchInstall.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce wextract_cleanup0	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run StretchWare StchCtrl	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run StretchWare StchCtrl	Jump to behavior

Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00FD6205 GetParent,GetParent,IsIconic,GetParent,	11_2_00FD6205
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00FD0420 IsIconic,PostMessageA,	11_2_00FD0420
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00FCE541 IsWindow,GetFocus,IsChild,SendMessageA,IsChild,SendMessageA,IsIconic,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,GetAsyncKeyState,IsWindowVisible,	11_2_00FCE541
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00F9AD43 SetRectEmpty,RedrawWindow,ReleaseCapture,SetCapture,ReleaseCapture,SetCapture,SendMessageA,UpdateWindow,SendMessageA,IsWindow,IsIconic,IsZoomed,IsWindow,UpdateWindow,	11_2_00F9AD43
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00FCEFD0 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,IsIconic,GetSystemMetrics,OffsetRect,GetSystemMetrics,IsIconic,GetSystemMetrics,GetSystemMetrics,	11_2_00FCEFD0
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00FCEFD0 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,IsIconic,GetSystemMetrics,OffsetRect,GetSystemMetrics,IsIconic,GetSystemMetrics,GetSystemMetrics,	11_2_00FCEFD0
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00FCEFD0 GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,IsIconic,GetSystemMetrics,OffsetRect,GetSystemMetrics,IsIconic,GetSystemMetrics,GetSystemMetrics,	11_2_00FCEFD0
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00FCF2D0 IsWindowVisible,ScreenToClient,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetSystemMetrics,PtInRect,GetSystemMetrics,PtInRect,GetSystemMetrics,PtInRect,	11_2_00FCF2D0
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00FCF85B IsWindow,IsWindowVisible,GetWindowRect,PtInRect,GetAsyncKeyState,ScreenToClient,IsWindow,IsWindow,IsWindow,GetWindowRect,PtInRect,SendMessageA,PtInRect,SendMessageA,ScreenToClient,PtInRect,GetParent,SendMessageA,GetFocus,WindowFromPoint,SendMessageA,GetSystemMenu,IsMenu,EnableMenuItem,EnableMenuItem,EnableMenuItem,IsZoomed,IsIconic,EnableMenuItem,TrackPopupMenu,SendMessageA,	11_2_00FCF85B
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00F6F9C7 IsWindowVisible,IsIconic,	11_2_00F6F9C7
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00F8FDC9 SetForegroundWindow,IsIconic,	11_2_00F8FDC9
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00F8FE6D IsIconic,	11_2_00F8FE6D
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00FAFE0D GetClientRect,IsRectEmpty,IsIconic,BeginDeferWindowPos,GetClientRect,IsRectEmpty,IsRectEmpty,EqualRect,GetWindowRect,GetParent,EndDeferWindowPos,	11_2_00FAFE0D

Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe

Code function: 11_2_00F865FF __EH_prolog3_GS,GetDeviceCaps,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,DeleteObject,_memset,GetTextCharsetInfo,lstrcpyA,lstrcpyA,EnumFontFamiliesA,EnumFontFamiliesA,lstrcpyA,EnumFontFamiliesA,lstrcpyA,CreateFontIndirectA,CreateFontIndirectA,CreateFontIndirectA,CreateFontIndirectA,CreateFontIndirectA,CreateFontIndirectA,GetSystemMetrics,lstrcpyA,CreateFontIndirectA,GetStockObject,GetStockObject,GetObjectA,GetObjectA,lstrcpyA,CreateFontIndirectA,CreateFontIndirectA,GetStockObject,GetObjectA,CreateFontIndirectA,CreateFontIndirectA,__EH_prolog3_GS,GetVersionExA,GetSystemMetrics,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_00F865FF

Source: C:\Users\user\Desktop\StretchInstall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\StretchInstall.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe

2_2_00D43221

Source: C:\Windows\System32\msiexec.exe

Dropped PE file which has not been started: C:\Program Files (x86)\Shelter Publications\StretchWare\Stretch.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe

Evaded block: after key decision

graph_2-28535

Source: C:\Users\user\Desktop\StretchInstall.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-3700

Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe

API coverage: 3.6 %

Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\StretchInstall.exe	Code function: 0_2_01002A96 FindFirstFileA,lstrcmpA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,	0_2_01002A96
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: 2_2_00D2DE9F __EH_prolog3_GS,FindFirstFileW,FindNextFileW,FindClose,FindClose,	2_2_00D2DE9F
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00F83089 GetModuleHandleA,GetProcAddress,FindFirstFileA,	11_2_00F83089
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00F83477 _strcpy_s,lstrlenA,SetLastError,FindFirstFileA,GetLastError,__fullpath,__splitpath_s,__makepath_s,	11_2_00F83477
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_00F7D99C __EH_prolog3_GS,GetFullPathNameA,__cftof,PathIsUNCA,GetVolumeInformationA,CharUpperA,FindFirstFileA,FindClose,lstrlenA,_strcpy_s,	11_2_00F7D99C

Source: C:\Users\user\Desktop\StretchInstall.exe

Code function: 0_2_010052D4 lstrcpyA,lstrcpyA,GetSystemInfo,lstrcpyA,CreateDirectoryA,RemoveDirectoryA,

0_2_010052D4

Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Installer\{1D2F2573-A76A-47DA-BB96-6860D17CC45B}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Installer	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: C:\Users\user\Desktop\StretchInstall.exe	API call chain: ExitProcess graph end node	graph_0-3511
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	API call chain: ExitProcess graph end node	graph_2-28175
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	API call chain: ExitProcess graph end node	graph_11-85008

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe

Code function: 2_2_00D55243 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

2_2_00D55243

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe

2_2_00D43221

Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe

Code function: 11_2_0106333A VirtualProtect ?,-00000001,00000104,?

11_2_0106333A

Source: C:\Users\user\Desktop\StretchInstall.exe

Code function: 0_2_01006205 GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,

0_2_01006205

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe

Code function: 2_2_00D66CAC __lseeki64_nolock,__lseeki64_nolock,GetProcessHeap,HeapAlloc,__setmode_nolock,__write_nolock,__setmode_nolock,GetProcessHeap,HeapFree,__lseeki64_nolock,SetEndOfFile,GetLastError,__lseeki64_nolock,

2_2_00D66CAC

Source: C:\Users\user\Desktop\StretchInstall.exe	Code function: 0_2_010064DE SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_010064DE
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: 2_2_00D55243 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_00D55243
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: 2_2_00D4EF49 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_00D4EF49
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_01060BBE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_01060BBE
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_01068E21 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_01068E21
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_6BCF3EF6 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_6BCF3EF6
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_6BCF3719 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_6BCF3719
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_73F74226 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_73F74226
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: 11_2_73F73A49 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_73F73A49

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe

Code function: 2_2_00D2B0F4 _memset,ShellExecuteExW,GetLastError,WaitForSingleObject,CloseHandle,

2_2_00D2B0F4

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe

Process created: C:\Windows\SysWOW64\msiexec.exe "C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\user\AppData\Local\Temp\IXP000.TMP\StretchWare.msi"

Jump to behavior

Source: C:\Users\user\Desktop\StretchInstall.exe

Code function: 0_2_01001760 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,LocalFree,CloseHandle,

0_2_01001760

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,GetLocaleInfoA,GetLocaleInfoA,_strlen,GetLocaleInfoA,_strlen,_TestDefaultLanguage,	2_2_00D5C081
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: GetLocaleInfoA,_LocaleUpdate::_LocaleUpdate,___ascii_strnicmp,__tolower_l,__tolower_l,	2_2_00D60070
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,_strlen,	2_2_00D5C021
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: GetLocaleInfoA,	2_2_00D601AF
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,_TestDefaultLanguage,	2_2_00D5C257
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__invoke_watson,GetLocaleInfoW,GetLocaleInfoW,__calloc_crt,GetLocaleInfoW,_free,GetLocaleInfoW,	2_2_00D563CD
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,__invoke_watson,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	2_2_00D5C3C9
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	2_2_00D5C388
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	2_2_00D5C31C
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,InterlockedDecrement,InterlockedDecrement,InterlockedDecrement,_free,_free,	2_2_00D5B67C
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,InterlockedDecrement,InterlockedDecrement,_free,_free,	2_2_00D5B974
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtGetStringTypeA,___crtLCMapStringA,___crtLCMapStringA,_memmove,_memmove,_memmove,InterlockedDecrement,_free,_free,_free,_free,_free,_free,_free,_free,_free,InterlockedDecrement,	2_2_00D4FADD
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	2_2_00D5AA0C
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,_malloc,GetLocaleInfoW,WideCharToMultiByte,__freea,	2_2_00D5DC25
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	2_2_00D5DD04
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_00D5BE6C
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	Code function: __getptd,_LcidFromHexString,GetLocaleInfoA,	2_2_00D5BF75
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: _strcpy_s,GetLocaleInfoA,__snwprintf_s,LoadLibraryA,	11_2_00F7F6EB
Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	Code function: __EH_prolog3_GS,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,GetNumberFormatA,GetLocaleInfoA,lstrlenA,	11_2_00FB5CD0

Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\StretchInstall.exe

Code function: 0_2_0100646B GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_0100646B

Source: C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe

Code function: 11_2_01069115 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_strcpy_s,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,WideCharToMultiByte,

11_2_01069115

Source: C:\Users\user\Desktop\StretchInstall.exe

Code function: 0_2_0100488C GetVersionExA,MessageBeep,MessageBoxA,

0_2_0100488C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Replication Through Removable Media	3 Native API	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	231 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	11 Peripheral Device Discovery	Remote Desktop Protocol	231 Input Capture	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Access Token Manipulation	2 Obfuscated Files or Information	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Clipboard Data	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Process Injection	1 DLL Side-Loading	NTDS	26 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Registry Run Keys / Startup Folder	1 File Deletion	LSA Secrets	3 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Masquerading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Rundll32	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
StretchInstall.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe	0%	ReversingLabs
C:\Program Files (x86)\Shelter Publications\StretchWare\Stretch.exe	0%	ReversingLabs
C:\Program Files (x86)\Shelter Publications\StretchWare\StretchHook.dll	3%	ReversingLabs
C:\Program Files (x86)\Shelter Publications\StretchWare\StretchRes.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
http://activate.esellerate.net	0%	Avira URL Cloud	safe
http://activate.esellerate.net).	0%	Avira URL Cloud	safe
http://www.stretchware.com/	0%	Avira URL Cloud	safe
http://www.esellerate.net/papolicyhttp://activate.esellerate.netSelect	0%	Avira URL Cloud	safe
http://www.esellerate.net/papolicy	0%	Avira URL Cloud	safe
http://www.esellerate.net/privacy.aspCONNECTION	0%	Avira URL Cloud	safe
http://go.microsoft.c	0%	Avira URL Cloud	safe
http://www.shelterpub.com/	0%	Avira URL Cloud	safe
http://www.esellerate.net/privacy.asp	0%	Avira URL Cloud	safe
http://www.stretchware.com/stretching_resources.html(http://www.stretchware.com/products.html	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.stretchware.com/	StchCtrl.exe, 0000000B.00000002.3342928233.000000006BCFA000.00000002.00000001.01000000.0000000A.sdmp, StretchRes.dll.4.dr	false	Avira URL Cloud: safe	unknown
http://www.esellerate.net/privacy.asp	StchCtrl.exe, 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmp, Stretch.exe.4.dr, StchCtrl.exe.4.dr	false	Avira URL Cloud: safe	unknown
http://www.esellerate.net/privacy.aspCONNECTION	StchCtrl.exe, 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmp, Stretch.exe.4.dr, StchCtrl.exe.4.dr	false	Avira URL Cloud: safe	unknown
http://activate.esellerate.net	StchCtrl.exe, 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmp, Stretch.exe.4.dr, StchCtrl.exe.4.dr	false	Avira URL Cloud: safe	unknown
http://go.microsoft.c	setup.exe, 00000002.00000002.3342719410.0000000002356000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://activate.esellerate.net).	StchCtrl.exe.4.dr	false	Avira URL Cloud: safe	unknown
http://www.esellerate.net/papolicyhttp://activate.esellerate.netSelect	StchCtrl.exe, 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmp, Stretch.exe.4.dr, StchCtrl.exe.4.dr	false	Avira URL Cloud: safe	unknown
http://www.shelterpub.com/	StchCtrl.exe, 0000000B.00000002.3342928233.000000006BCFA000.00000002.00000001.01000000.0000000A.sdmp, StretchRes.dll.4.dr	false	Avira URL Cloud: safe	unknown
http://www.stretchware.com/stretching_resources.html(http://www.stretchware.com/products.html	StretchRes.dll.4.dr	false	Avira URL Cloud: safe	unknown
http://www.esellerate.net/papolicy	StchCtrl.exe, 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmp, Stretch.exe.4.dr, StchCtrl.exe.4.dr	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1467084
Start date and time:	2024-07-03 17:31:48 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	StretchInstall.exe
Detection:	SUS
Classification:	sus24.spyw.evad.winEXE@8/29@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 96% Number of executed functions: 142 Number of non-executed functions: 294
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, tile-service.weather.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: StretchInstall.exe

Simulations

Behavior and APIs

Time	Type	Description
17:32:50	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run StretchWare StchCtrl C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	10894
Entropy (8bit):	5.688535433953687
Encrypted:	false
SSDEEP:	96:/Qo39yI9r99o9V9v9zT93983L0KqtW9WgbzHeQzmeU/tqTCsThqe9vU/tqTC6jxM:/3tyOxY7Fltgtze3xkOIzckOkzamLp+
MD5:	1626F09FF90BA3951D815412FA08FD41
SHA1:	38FD5096D78B35DA38FFBFF2C8EA35DC85E579C0
SHA-256:	7AF1E75A1618912AD5C7B2C2D7224F008CB8D1B43EB32036CC8189B7A798F89F
SHA-512:	3BB9C0BF75A3B81A15987575DD55A5EC480B104F1F57A7C204BBFD3F6711360C6634CAFAE43B0FA9147A5C4CB352191C52BBFD43F3B9FC0F20F7FBCB1C7ACB06
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.\.X.@.....@.....@.....@.....@.....@......&.{1D2F2573-A76A-47DA-BB96-6860D17CC45B}..StretchWare..StretchWare.msi.@.....@.....@.....@........&.{F20E5EB4-1FAE-4866-A8F0-484FF0C9EC46}.....@.....@.....@.....@.......@.....@.....@.......@......StretchWare......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{C994A9B4-4693-5B42-1160-03FD539ADF8C}&.{1D2F2573-A76A-47DA-BB96-6860D17CC45B}.@......&.{63F7FADE-22B2-8417-7BC8-B0C954578C84}&.{1D2F2573-A76A-47DA-BB96-6860D17CC45B}.@......&.{E7566C56-DACE-8B37-EA0E-DDB190DE03D9}&.{1D2F2573-A76A-47DA-BB96-6860D17CC45B}.@......&.{1D2F2573-A76A-47DA-BB96-6860D17CC45B}&.{1D2F2573-A76A-47DA-BB96-6860D17CC45B}.@......&.{BABD6A42-56B3-C969-14E0-5E47BCA58465}&.{1D2F2573-A76A-47DA-BB96-6860D17CC45B}.@......&.{892A55E1-D3BC-CBE3-A5FF-3B113D6FBB1B}&.{1D2F2573-A76A-47DA-BB96-6860D17CC45B}.@......&.{6981CAC8-3564-0BD2-BE80-CE65D7A539BD}&.{1D2F2573-A76A-47

C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2295296
Entropy (8bit):	6.461904278761
Encrypted:	false
SSDEEP:	49152:LasSoJRpdg+aorhnTglGh83+I+SzmOdoHAy8VrmYh0mTESwccJx1j8YNwqR:EoJRpdgArhnThhk+I+SzmOdoHAykB7Tq
MD5:	A76894A90372756D69A9F51704EF43F5
SHA1:	FB6153D9AFBB9C4068631CDFA883D2BABB956C4F
SHA-256:	51DBD9DDC4A4FE7FD1812F5474684C55FDD448568472C4226E908F9197FC6CD7
SHA-512:	21B935E747AA956861AACED82A568EE6F6A8C864EEA8EEAEB636FE45927BF4136CB876F9B90CBD5882B65A560C4DC52850046699C6737E75D56ED96D306E887A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........G.._G.._G.._..S_D.._(.U_h.._(.a_..._N.H_K.._(.W_E.._N.X_d.._G.._Z.._(.`_.._(.Q_F.._(.V_F.._RichG.._........................PE..L...P..P.................`..........G........p....@...........................#.......#...@..................................q..h........m....................!........................................@............p...............................text....^.......`.................. ..`.rdata...6...p...8...d..............@..@.data...@........\..................@....rsrc....m.......n..................@..@.reloc..j.....!......f .............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Shelter Publications\StretchWare\Stretch.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2380800
Entropy (8bit):	6.472919522974936
Encrypted:	false
SSDEEP:	49152:vL1vJuzusEWjh5XFYi/46de9+HbRO/KSgvta3QPSANa0kXrtlTOJx1j8YN8G:1JuznEMFDrde9+HbRO/KSgvtGbA80kX0
MD5:	50FB5019BAF9E418ED82F08B515F7BCD
SHA1:	DF44CAF83D2A972470950A2E0BBD1588BDD72DC8
SHA-256:	3321E9D85BCEC22FF895D9A01A29DCAD5DDBF143A2AE525BA5B151ABD87C3719
SHA-512:	031AF32656F219472B2011895600A488D626C29D802544DB8A9B87511BE4A18554A6FCB919300002BC3B0854FF8414C0AD352A0A3325A4D910C2EA112B84F5CE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........o.R..CR..CR..C..CP..C[..C^..C=.C...C=.C...C[..Cv..C=.CQ..CR..CG..C=.C...C=.CS..CR..CS..C=.CS..CRichR..C................PE..L......P.................P..........T........`....@...........................$.......%...@.....................................\|.......,r...................@".L...................................h...@............`..$............................text....O.......P.................. ..`.rdata...\|...`...~...T..............@..@.data............d..................@....rsrc...,r.......t...6..............@..@.reloc......@".......!.............@..B........................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Shelter Publications\StretchWare\StretchHook.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	5.791916877493206
Encrypted:	false
SSDEEP:	384:29/1HRo2/RdlheclCUo1wRn0vMdZoFbWhU8N/lvH+1nu6EDHkCNu1/NCcvy+rNar:2nRzCv1e0+iNWhDDfmnTEDjcvy0avjo
MD5:	0735585D8C460E8C7F1797EBB06B837B
SHA1:	409DA2D7504D9603DD8F3260BD95C77E19317BA1
SHA-256:	C6E8A615111A880D7D100DB340A84C8C8DBE3E34D5C7AD5E58071CA15FD137A0
SHA-512:	95759D9BBCD07BC19665FDFB2348C2C39B65550D0BE394F631147D8E052B6FF0D75B4A983716CEE02C06BBFDD437B4CD03E1DAA84C865B416796BF699FC8DE59
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......\.Sq.\|=".\|=".\|="w..".\|="w.."/\|="...".\|=".\|<"[\|="w..".\|="w..".\|="w..".\|="w..".\|="Rich.\|="........PE..L......P...........!.....J...B...............`...................................... i....@.................................<z..<.......x.......................(...................................(x..@............`...............................text...2H.......J.................. ..`.rdata...!...`..."...N..............@..@.data................p..............@....shared.8............\|..............@....rsrc...x............~..............@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Shelter Publications\StretchWare\StretchRes.dll

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1590272
Entropy (8bit):	5.180953186200703
Encrypted:	false
SSDEEP:	24576:a+tb1k07WWcKpDftXIrbsv1tB6RT1dfYddcca:Dtb1kwWulftXIHsvt6RT1dfYddcca
MD5:	3D24CB6438DC5393F19BBFA17AAA4F22
SHA1:	7B44D9CEDA2A8DE770FECC8B185408E3D6F4A654
SHA-256:	56900FC785F2AFBF3166CBA269D7D7C4DCECCFFD6B161A4F7EC05CCDA9C3C421
SHA-512:	350EA91C0F16EC2DFD70F22C10A249BE351242A4FE3187C946BC046760CAC3D2DAC2266C2CE1D25FD6104205A9E2485AC4806F055FD73884EB4EBCFBE46C0558
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........:.G@[b.@[b.@[b./-..H[b./-..w[b.I#..C[b.@[c.}[b./-..J[b./-..A[b./-..A[b./-..A[b.Rich@[b.........PE..L......P...........!.....F..........r........`.......................................@....@......................... ...M....z..(...........................`.......................................w..@............`...............................text....E.......F.................. ..`.rdata..m....`... ...J..............@..@.data................j..............@....rsrc...............v..............@..@.reloc.......`.......,..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\Shelter Publications\StretchWare\StretchWare.ico

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 16 colors, 32x32
Category:	dropped
Size (bytes):	2550
Entropy (8bit):	4.0424826344288345
Encrypted:	false
SSDEEP:	48:2wMHOta08t7E/gbN1pv6u8StVHzKGVV2jw3:RMHOtJyg4DCSrz3VE+
MD5:	8656713F2A6B60114A263052F9495402
SHA1:	26A0899A07B23794DC205B6DFA52168D20EF3035
SHA-256:	BCF09453E0E3CE2A39A4E901087191E48744ED9AC05EEA6803676BD9E5C202E6
SHA-512:	3543E9F5D1BEB8D9ED3735E05E36309E623AB73CD628CBF45E15D1005C928D96B53C72920DBE6AE6D2E772E193B8577EF6CB3EEF61B532E6D701558F9854F26A
Malicious:	false
Reputation:	low
Preview:	..............(...&... ..........N...(....... ..................................................................................................ww.............................ypp............7...................0.........q............p.............p..........?..............................................................(... ...@..............................................................................................""".))).UUU.MMM.BBB.999..\|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\StretchWare.msi

Download File

Process:	C:\Users\user\Desktop\StretchInstall.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {F20E5EB4-1FAE-4866-A8F0-484FF0C9EC46}, Title: StretchWare, Author: Quality Process, Number of Words: 2, Last Saved Time/Date: Wed Jan 2 21:00:23 2013, Last Printed: Wed Jan 2 21:00:23 2013
Category:	dropped
Size (bytes):	2834944
Entropy (8bit):	7.900119741375992
Encrypted:	false
SSDEEP:	49152:HcABtONA2wfOL0M5mpSGM8gSpdB5HqMMjw7NSSa1iqzAyQMdc:hOTwfOLIwX8g+dnqwZSSaogQ0c
MD5:	C0CCB7C257F4E3B0262A40D3D22E8BD3
SHA1:	6C89D90276E17B406FC4FBF85A5EF9D183A5EB5B
SHA-256:	D1B9E44DDCDF5569B8137D2919585D6FF6FA4147DA13F2EC49DB4E31BE8035FB
SHA-512:	D39E417B2AC944405D011CD8309552A9E43F78958BA7EF61AB16F00C05EA06E35708B72390F9D08DC02D9F2E149B7C389A744046E02547B9061165B619A23822
Malicious:	false
Reputation:	low
Preview:	......................>...................,...............8...........................{...\|...}...~...................................................................................................................................................................................................................................................................................................................................................................................................................................Z................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...[...f...:...;...<...=...>...?...@...A...B...C...D...Y...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X.......\...]..._...`...^...a...b...e...h...c...d...i...g.......j...r...o...k...l...m...n...q...p...s...w...{...t...u...v...\|...x...y...z...

C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe

Download File

Process:	C:\Users\user\Desktop\StretchInstall.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	428032
Entropy (8bit):	6.243157878229617
Encrypted:	false
SSDEEP:	6144:CqIpd/w8ylWKxavR+dJ1oMBClrbMAo+nhmuFfvY0SHZvuD3SojDuUlXkeO:C7IRWDvFa+nhmuF3Y0scSeDuUlX9
MD5:	E98B8B16179129CC1B75C3D0A7B67CD4
SHA1:	582AEA512EAE1D66DE970138B09B1ADC436481C1
SHA-256:	71D63A47476D65CE1724808C7AADB62595465E031854E9AAA4A788F5492BF2B8
SHA-512:	10358EB6A53C9B47AB1E5B49E561B2BCF3A4DFC072A323B764D5FD7D46BC2D64375A6A1CB150A01516E697ED3E8CBAB6A0A32AC3F41599980A3BECFC1F0508D1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........x.................................A..........................................................Rich....................PE..L......K..........".................A.............@..................................\....@...... ......................x............P...5..............................................................@...............(............................text...H........................... ..`.data....@..........................@....rsrc....5...P...6..................@..@.reloc..@G.......H...@..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\VSDAAAD.tmp\install.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe
File Type:	data
Category:	dropped
Size (bytes):	4242
Entropy (8bit):	3.6186884067376806
Encrypted:	false
SSDEEP:	48:kl82sPb1YR+OLjGl8AjfFeqo+ULTaA1kSrB8rDCQ+yl8Akcq+++f+++wMxeqU+cf:s8t4e8AMrBbBsCw8AbF3PHhlB
MD5:	9863274684E75C035E043FC4B0F5F917
SHA1:	E7884230594BB420EECF7DCB9337142F93792DBD
SHA-256:	5988D18122F84E1A29FCD963D5136F3BA600E5E371B1071F7C2A3ED689F9025B
SHA-512:	5B42091847603DBCAF11EB4F016E80568D2B42D53EE85B64D306B836F459A8149BE90AD5AD628B1229AE92C3F0FD90E422D06373C4A38D10DE3D75B363AF435B
Malicious:	false
Reputation:	low
Preview:	T.h.e. .f.o.l.l.o.w.i.n.g. .p.r.o.p.e.r.t.i.e.s. .h.a.v.e. .b.e.e.n. .s.e.t.:.....P.r.o.p.e.r.t.y.:. .[.A.d.m.i.n.U.s.e.r.]. .=. .t.r.u.e. .{.b.o.o.l.e.a.n.}.....P.r.o.p.e.r.t.y.:. .[.I.n.s.t.a.l.l.M.o.d.e.]. .=. .H.o.m.e.S.i.t.e. .{.s.t.r.i.n.g.}.....P.r.o.p.e.r.t.y.:. .[.P.r.o.c.e.s.s.o.r.A.r.c.h.i.t.e.c.t.u.r.e.]. .=. .A.M.D.6.4. .{.s.t.r.i.n.g.}.....P.r.o.p.e.r.t.y.:. .[.V.e.r.s.i.o.n.N.T.]. .=. .6...2...0. .{.v.e.r.s.i.o.n.}.....R.u.n.n.i.n.g. .c.h.e.c.k.s. .f.o.r. .p.a.c.k.a.g.e. .'.W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r. .3...1.'.,. .p.h.a.s.e. .B.u.i.l.d.L.i.s.t.....T.h.e. .f.o.l.l.o.w.i.n.g. .p.r.o.p.e.r.t.i.e.s. .h.a.v.e. .b.e.e.n. .s.e.t. .f.o.r. .p.a.c.k.a.g.e. .'.W.i.n.d.o.w.s. .I.n.s.t.a.l.l.e.r. .3...1.'.:.....R.u.n.n.i.n.g. .c.h.e.c.k.s. .f.o.r. .c.o.m.m.a.n.d. .'.W.i.n.d.o.w.s.I.n.s.t.a.l.l.e.r.3._.1.\.W.i.n.d.o.w.s.I.n.s.t.a.l.l.e.r.-.K.B.8.9.3.8.0.3.-.v.2.-.x.8.6...e.x.e.'.....R.e.s.u.l.t. .o.f. .r.u.n.n.i.n.g. .o.p.e.r.a.t.o.r. .'.V.e.r.s.i.o.n.G.r.e.a.t.e.r.T.h.a.n.O.r.

C:\Users\user\AppData\Roaming\Microsoft\Installer\{1D2F2573-A76A-47DA-BB96-6860D17CC45B}\_24275761ADC5B212D44AB6.exe

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows icon resource - 2 icons, 16x16, 16 colors, 4 bits/pixel, 32x32, 8 bits/pixel
Category:	dropped
Size (bytes):	2550
Entropy (8bit):	4.045124870638817
Encrypted:	false
SSDEEP:	48:GwM7Ota08t7E/gbN1pv6u8StVHzKGVV2jw3:hM7OtJyg4DCSrz3VE+
MD5:	EF7DF15155B2C6E56F94FA17835AE00D
SHA1:	11788F7E640A20EC7C22DDC1BADD9829D959097C
SHA-256:	69E8709BE6D1693CCAA63A1A4A967CD6C189F97DED447AC20A4D364738D74861
SHA-512:	235651D393D3771AE22E880DCED3BDB7026323710447B7346A1388C87FF6D015B88585531F9C56B6B81D896087B00745AAD3E36F6FF83A5D86C1F387BA6A01A3
Malicious:	false
Reputation:	low
Preview:	..............(...&... ..........N...(....... ..................................................................................................ww.............................ypp............7...................0.........q............p.............p..........?..............................................................(... ...@..............................................................................................""".))).UUU.MMM.BBB.999..\|..PP........................3...f..........3...33..3f..3...3...3...f...f3..ff..f...f...f........3...f...................3...f..............f.........3...3.3.3.f.3...3...3...33..333.33f.33..33..33..3f..3f3.3ff.3f..3f..3f..3...3.3.3.f.3...3...3...3...3.3.3.f.3..3...3...3.3.3.f.3...3...3...f...f.3.f.f.f...f...f...f3..f33.f3f.f3..f3..f3..ff..ff3.fff.ff..ff..f...f.3.f.f.f...f...f...f...f.3.f..f...f...f...f.3.f...f................3...............33...f..3.......f...f3..3f..f...f...3....3...f...................3.f.f..................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StretchWare\Stretch.lnk

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Icon number=0, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	3087
Entropy (8bit):	2.934094798075439
Encrypted:	false
SSDEEP:	24:8A2h1lX4gOGExEUYzHo4KnNYzHbxcdE5kNYzHbx2dSsIdu1wdNYzHbx:8R1lq+DzzKuz2dEWuzUdSsIdu1wduz
MD5:	B9C1DE8D6B049089B898BAABDD9A1314
SHA1:	6934A9ADB551B3DE4CF61310640CDEA76259FBE0
SHA-256:	96A6D4FD065560373BDD228FB4D5960C0D106C468E4EFA5F806E18C80E4E036A
SHA-512:	A365EDD81B013951E0FAB9DA040F961A812DB901F2BAA055DFEC36633A79FA503C85C0EEDE2C2EC77021A084C03729C56F62B0993BDA4690550A0563767D5427
Malicious:	false
Preview:	L..................F.P...........................................................P.O. .:i.....+00.../C:\...................x.1.....EW.2..Users.d......OwH.X.\|....................:.....6.d.U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....Z.1......X.\|..user..B......EW<2.X.\|....^......................>s.e.n.g.i.n.e.e.r.....V.1.....EW<2..AppData.@......EW<2.X.\|...........................^.A.p.p.D.a.t.a.....V.1......X.\|..Roaming.@......EW<2.X.\|..../.....................m.p.R.o.a.m.i.n.g.....\.1......X.\|..MICROS~1..D......EW<2.X.\|....0.....................rTH.M.i.c.r.o.s.o.f.t.....\.1......X.\|..INSTAL~1..D.......X.\|.X.\|..........................rTH.I.n.s.t.a.l.l.e.r.......1......X.\|..{1D2F2~1..~.......X.\|.X.\|..........................i.$.{.1.D.2.F.2.5.7.3.-.A.7.6.A.-.4.7.D.A.-.B.B.9.6.-.6.8.6.0.D.1.7.C.C.4.5.B.}.......2......X.\|!._24275~1.EXE..h.......X.\|.X.\|....D.....................i.$._.2.4.2.7.5.7.6.1.A.D.C.5.B.2.1.2.D.4.4.A.B.6...e.x.e.......X.....\.....\.....\.....\.I

C:\Windows\Installer\3ad363.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {F20E5EB4-1FAE-4866-A8F0-484FF0C9EC46}, Title: StretchWare, Author: Quality Process, Number of Words: 2, Last Saved Time/Date: Wed Jan 2 21:00:23 2013, Last Printed: Wed Jan 2 21:00:23 2013
Category:	dropped
Size (bytes):	2834944
Entropy (8bit):	7.900119741375992
Encrypted:	false
SSDEEP:	49152:HcABtONA2wfOL0M5mpSGM8gSpdB5HqMMjw7NSSa1iqzAyQMdc:hOTwfOLIwX8g+dnqwZSSaogQ0c
MD5:	C0CCB7C257F4E3B0262A40D3D22E8BD3
SHA1:	6C89D90276E17B406FC4FBF85A5EF9D183A5EB5B
SHA-256:	D1B9E44DDCDF5569B8137D2919585D6FF6FA4147DA13F2EC49DB4E31BE8035FB
SHA-512:	D39E417B2AC944405D011CD8309552A9E43F78958BA7EF61AB16F00C05EA06E35708B72390F9D08DC02D9F2E149B7C389A744046E02547B9061165B619A23822
Malicious:	false
Preview:	......................>...................,...............8...........................{...\|...}...~...................................................................................................................................................................................................................................................................................................................................................................................................................................Z................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...[...f...:...;...<...=...>...?...@...A...B...C...D...Y...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X.......\...]..._...`...^...a...b...e...h...c...d...i...g.......j...r...o...k...l...m...n...q...p...s...w...{...t...u...v...\|...x...y...z...

C:\Windows\Installer\3ad365.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, MSI Installer, Create Time/Date: Mon Jun 21 08:00:00 1999, Name of Creating Application: Windows Installer, Security: 1, Code page: 1252, Template: Intel;1033, Number of Pages: 200, Revision Number: {F20E5EB4-1FAE-4866-A8F0-484FF0C9EC46}, Title: StretchWare, Author: Quality Process, Number of Words: 2, Last Saved Time/Date: Wed Jan 2 21:00:23 2013, Last Printed: Wed Jan 2 21:00:23 2013
Category:	dropped
Size (bytes):	2834944
Entropy (8bit):	7.900119741375992
Encrypted:	false
SSDEEP:	49152:HcABtONA2wfOL0M5mpSGM8gSpdB5HqMMjw7NSSa1iqzAyQMdc:hOTwfOLIwX8g+dnqwZSSaogQ0c
MD5:	C0CCB7C257F4E3B0262A40D3D22E8BD3
SHA1:	6C89D90276E17B406FC4FBF85A5EF9D183A5EB5B
SHA-256:	D1B9E44DDCDF5569B8137D2919585D6FF6FA4147DA13F2EC49DB4E31BE8035FB
SHA-512:	D39E417B2AC944405D011CD8309552A9E43F78958BA7EF61AB16F00C05EA06E35708B72390F9D08DC02D9F2E149B7C389A744046E02547B9061165B619A23822
Malicious:	false
Preview:	......................>...................,...............8...........................{...\|...}...~...................................................................................................................................................................................................................................................................................................................................................................................................................................Z................................................................................................................... ...!..."...#...$...%...&...'...(...)...*...+...,...-......./...0...1...2...3...4...5...6...7...[...f...:...;...<...=...>...?...@...A...B...C...D...Y...F...G...H...I...J...K...L...M...N...O...P...Q...R...S...T...U...V...W...X.......\...]..._...`...^...a...b...e...h...c...d...i...g.......j...r...o...k...l...m...n...q...p...s...w...{...t...u...v...\|...x...y...z...

C:\Windows\Installer\MSID586.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	7080
Entropy (8bit):	5.704924142091014
Encrypted:	false
SSDEEP:	96:6QoHLCMkPF/hUAyZuQTnqDquV9M7OtJyg4DCSrz3VEEO/LgHejqJZL+EdrEPvwqY:63rVyJhvoeDquV9/KDCAheeB1WvwL
MD5:	A5C3C7FDD6EB95C3F092061E4BC48ED9
SHA1:	03CD339FFCF445BD2657DF87512C67E563669D36
SHA-256:	AEA1C93F83613D120F9F89019A44394D389068E5A36B12AE0679E733C314BA51
SHA-512:	DF0283630802064AB2945AF4A2DACC0649C1039E2DA4BA5553C18A1DC3C38F58FE354EB49BDD3E5A528F5F763194B175CA71F25928AEFBD6975C5DF98F1F80A1
Malicious:	false
Preview:	...@IXOS.@.....@.\.X.@.....@.....@.....@.....@.....@......&.{1D2F2573-A76A-47DA-BB96-6860D17CC45B}..StretchWare..StretchWare.msi.@.....@.....@.....@........&.{F20E5EB4-1FAE-4866-A8F0-484FF0C9EC46}.....@.....@.....@.....@.......@.....@.....@.......@......StretchWare......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{C994A9B4-4693-5B42-1160-03FD539ADF8C}G.C:\Program Files (x86)\Shelter Publications\StretchWare\StretchHook.dll.@.......@.....@.....@......&.{63F7FADE-22B2-8417-7BC8-B0C954578C84}G.C:\Program Files (x86)\Shelter Publications\StretchWare\StretchWare.ico.@.......@.....@.....@......&.{E7566C56-DACE-8B37-EA0E-DDB190DE03D9}f.01:\Software\Shelter Publications\StretchWare\{E7566C56-DACE-8B37-EA0E-DDB190DE03D9}\ProgramMenuFolder.@.......@.....@.....@......&.{1D2F2573-A76A-47DA-BB96-6860D17CC45B}8.C:\Program Files (x86)\Shelter Publications\StretchWa

C:\Windows\Installer\SourceHash{1D2F2573-A76A-47DA-BB96-6860D17CC45B}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.16423746488061
Encrypted:	false
SSDEEP:	12:JSbX72Fj0liAGiLIlHVRpih/7777777777777777777777777vDHFi0xl0i8Q:JFQI5yYF
MD5:	71B84B26FCE5F331AE26405016D5FE7C
SHA1:	A33555D21B87766537D793820DEC22965AC11C5A
SHA-256:	8FD18A94AD0FBD34AF119E5633C367930345896315B605B7BC23F4A40467BEDE
SHA-512:	9501885EECF6CBBE0B9C6B4B71CE954B40D897036DFD3334D3445618687F71947A122D3F1412D6F2EC2848C93C15F89E23921746F590B49AA2F4AF912D6E00B7
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.6011932875234902
Encrypted:	false
SSDEEP:	48:78PhUuRc06WXJgnT5NNjcSkdEcU/Cy9Jc+rjSkdE5U/Cy9vT0bjz:ihU1jnTNcviCIOiCn
MD5:	7EDD94909C86C7B8EA84F0B6CBC7DA63
SHA1:	2C25D60D3505338C822C186776DAB43C7F2408AC
SHA-256:	C6329CFF99B0B391C2FAAF9625A609EE18903F97EEA4024CA61F2ACA6FE8A60A
SHA-512:	E90A98FED1881A2A8FEC5284466C974E012CBEAA2956992094E79BF4601A1873AEF17B578E59047C7A3F249E388BF37A9F8E27AFEA07B42149CB65BF814B1ED4
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	360001
Entropy (8bit):	5.3629895564192775
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauU:zTtbmkExhMJCIpEJ
MD5:	F02EBEEF3D283221E0FFC3CFF0402D4D
SHA1:	1F18EE9CA732D97F46E3C9EC422A8626B33BC078
SHA-256:	04BCDD7D3DA47D2D58E0639EEE732F5F05A6CDB33CBBB7C5E1019D3C4CC17344
SHA-512:	EA420BAAB69EB9B8DE35144E9BD9EEDB60C090C1648EE98109D3D4A59410B38DD9C82EE7DB753CA29A6D27094D17CE17F98B5D474E9D64687B5330B523812B18
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\Temp\~DF2ABCACBD02624351.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2788844367346557
Encrypted:	false
SSDEEP:	48:9TcuNNveFXJHT5LNjcSkdEcU/Cy9Jc+rjSkdE5U/Cy9vT0bjz:FclvTDcviCIOiCn
MD5:	EC882B8404962AA1A3E1739DA987A3EE
SHA1:	116AF12D753E542D082EDFE4D904DC1A37080360
SHA-256:	EBA4DB0BB25FF2FD41D9377E24F9DAD67452654031A6A6651BDA692C4AD3E300
SHA-512:	C0E7BF6F136DF40528F3BD1590C90E2AC3CBB5F102B2A05D9875A6B6C6425376EBD59C734B47C2972616CC305A5F5AEA1E5D8A0A84A4A4E603CB693EEB66627E
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF46909EA4B1ED9E92.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2788844367346557
Encrypted:	false
SSDEEP:	48:9TcuNNveFXJHT5LNjcSkdEcU/Cy9Jc+rjSkdE5U/Cy9vT0bjz:FclvTDcviCIOiCn
MD5:	EC882B8404962AA1A3E1739DA987A3EE
SHA1:	116AF12D753E542D082EDFE4D904DC1A37080360
SHA-256:	EBA4DB0BB25FF2FD41D9377E24F9DAD67452654031A6A6651BDA692C4AD3E300
SHA-512:	C0E7BF6F136DF40528F3BD1590C90E2AC3CBB5F102B2A05D9875A6B6C6425376EBD59C734B47C2972616CC305A5F5AEA1E5D8A0A84A4A4E603CB693EEB66627E
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4E7E7153EF1D3B16.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF4F66FA6C75604436.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF5847C78C566C8B1F.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF8219D3502EFE3722.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9797F267E883C7AB.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.07173838843652341
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOiqsgpJAEaVky6lhX:2F0i8n0itFzDHFi0x
MD5:	4DC70082B340346C6A9579C8718C9D4D
SHA1:	97831FD6D8FBB341919F6DCEE84CF68B222468C9
SHA-256:	F3E15CFEFD279CDAFF7868F8E0134C5B493757E6CAE9EB9A32C71E4341FEE97C
SHA-512:	15042CC9611C71B9024F3925D03CA13ED940474F4318E5DFC5A523AD834D1DA861CD5A34FAFCD827474747061EE6D2E8AD637C5A823D03C30E312C21A86943DC
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFC25266A3F7F8776D.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.6011932875234902
Encrypted:	false
SSDEEP:	48:78PhUuRc06WXJgnT5NNjcSkdEcU/Cy9Jc+rjSkdE5U/Cy9vT0bjz:ihU1jnTNcviCIOiCn
MD5:	7EDD94909C86C7B8EA84F0B6CBC7DA63
SHA1:	2C25D60D3505338C822C186776DAB43C7F2408AC
SHA-256:	C6329CFF99B0B391C2FAAF9625A609EE18903F97EEA4024CA61F2ACA6FE8A60A
SHA-512:	E90A98FED1881A2A8FEC5284466C974E012CBEAA2956992094E79BF4601A1873AEF17B578E59047C7A3F249E388BF37A9F8E27AFEA07B42149CB65BF814B1ED4
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEE6E11B632B3D2B1.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.6011932875234902
Encrypted:	false
SSDEEP:	48:78PhUuRc06WXJgnT5NNjcSkdEcU/Cy9Jc+rjSkdE5U/Cy9vT0bjz:ihU1jnTNcviCIOiCn
MD5:	7EDD94909C86C7B8EA84F0B6CBC7DA63
SHA1:	2C25D60D3505338C822C186776DAB43C7F2408AC
SHA-256:	C6329CFF99B0B391C2FAAF9625A609EE18903F97EEA4024CA61F2ACA6FE8A60A
SHA-512:	E90A98FED1881A2A8FEC5284466C974E012CBEAA2956992094E79BF4601A1873AEF17B578E59047C7A3F249E388BF37A9F8E27AFEA07B42149CB65BF814B1ED4
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEEDFCB541973E719.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF8D7448D0D1E1ACE.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.1587929062369609
Encrypted:	false
SSDEEP:	48:Dzgb0T+SkdE5U/Cy9oSkdEcU/Cy9Jc+r3rN:DOOiCtviCO
MD5:	FCBC7DF33F54C706EE7498B74D91E8D1
SHA1:	89D622E0BB7BB822F36AC87DABEE9368190DBDDB
SHA-256:	C8F2275B6300241B6C4AE7AC186B3BD82C6787EC004CC07D1B142D27430CEA46
SHA-512:	80FBE39E26F230F1BE0A8968E56F5E98342A2F6D73B044AC1591D914D83B10FAD6DFAA9983690860970F233EC531969ABA58613998851E102E31B4DD56860020
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFFE64E2CB70E22634.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.2788844367346557
Encrypted:	false
SSDEEP:	48:9TcuNNveFXJHT5LNjcSkdEcU/Cy9Jc+rjSkdE5U/Cy9vT0bjz:FclvTDcviCIOiCn
MD5:	EC882B8404962AA1A3E1739DA987A3EE
SHA1:	116AF12D753E542D082EDFE4D904DC1A37080360
SHA-256:	EBA4DB0BB25FF2FD41D9377E24F9DAD67452654031A6A6651BDA692C4AD3E300
SHA-512:	C0E7BF6F136DF40528F3BD1590C90E2AC3CBB5F102B2A05D9875A6B6C6425376EBD59C734B47C2972616CC305A5F5AEA1E5D8A0A84A4A4E603CB693EEB66627E
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.994389649334824
TrID:	Win32 Executable (generic) a (10002005/4) 97.02% Win32 MS Cabinet Self-Extractor (WExtract stub) (303627/2) 2.95% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	StretchInstall.exe
File size:	2'887'680 bytes
MD5:	3f82a2195043cd2877b674cb321e2cf7
SHA1:	c2925fed17cba166db7164abdc0eb1f41de9717d
SHA256:	8f77b3b68bdfa80e0688a09c5e08ed765b6783192f4792524b8a1eec7ed7b608
SHA512:	d59a78e4906a8353797091a32c12bb572b24c22e480cdea52c862a97d631d8de17e2929542bafcb67844e1c1132827b816bde2b2f8c2f1434e462f4ecafbabc8
SSDEEP:	49152:uLPKwfOe06yZwRgztRMaX4pbl7HgMN6IlvE09aH0fmqbuoahuAzXp5X6Pdq6bLdE:MiwfOeerztKaXYbtsX09aHC145uqwL2L
TLSH:	05D5330196E4847AE8D80F30A4ED2D672FB4BE605572E32B91CD2AE9F4504E4BF76317
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..............C...C...Cu..C...C...C0..Cu..C...Cu..C...Cu..C...CRich...C................PE..L....Q.H.....................r+.....\d.....

File Icon


Icon Hash:	878fd7f3b9353593

Static PE Info

General

Entrypoint:	0x100645c
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x1000000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x480251CD [Sun Apr 13 18:32:45 2008 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	0ebb3c09b06b1666d307952e824c8697

Entrypoint Preview

Instruction
call 00007F7CA8B2791Fh
jmp 00007F7CA8B2788Fh
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
sub esp, 10h
mov eax, dword ptr [0100B2D0h]
test eax, eax
je 00007F7CA8B27919h
cmp eax, 0000BB40h
jne 00007F7CA8B2795Fh
push esi
lea eax, dword ptr [ebp-08h]
push eax
call dword ptr [01001170h]
mov esi, dword ptr [ebp-04h]
xor esi, dword ptr [ebp-08h]
call dword ptr [0100116Ch]
xor esi, eax
call dword ptr [01001168h]
xor esi, eax
call dword ptr [01001164h]
xor esi, eax
lea eax, dword ptr [ebp-10h]
push eax
call dword ptr [01001160h]
mov eax, dword ptr [ebp-0Ch]
xor eax, dword ptr [ebp-10h]
xor eax, esi
and eax, 0000FFFFh
pop esi
jne 00007F7CA8B27917h
mov eax, 0000BB40h
mov dword ptr [0100B2D0h], eax
not eax
mov dword ptr [0100B2CCh], eax
leave
ret
int3
int3
int3
int3
int3
cmp ecx, dword ptr [0100B2D0h]
jne 00007F7CA8B2791Bh
test ecx, FFFF0000h
jne 00007F7CA8B27913h
ret
jmp 00007F7CA8B2791Ah
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
sub esp, 00000330h
push edi
mov dword ptr [ebp-00000228h], eax
mov dword ptr [ebp-0000022Ch], ecx
mov dword ptr [ebp-00000230h], edx
mov dword ptr [ebp-00000234h], ebx
mov dword ptr [ebp-00000238h], esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9d80	0x8c	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd000	0x2b6d4c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1230	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x230	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x99c8	0x9a00	fd7744c26c2bf4d279968be94b283b11	False	0.5805093344155844	data	6.577725502979647	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb000	0x1be4	0x400	99858e86526942a66950c7139f78a725	False	0.330078125	data	4.247999525438142	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xd000	0x2b7000	0x2b6e00	bc114b0edae49996daae0b6dbad0bbc1	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
AVI	0xd7a0	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States	0.2713099474665311
RT_ICON	0x105bc	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States	0.3709677419354839
RT_ICON	0x108a4	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States	0.6081081081081081
RT_DIALOG	0x109cc	0x2cc	data	English	United States	0.4553072625698324
RT_DIALOG	0x10c98	0x18a	data	English	United States	0.6040609137055838
RT_DIALOG	0x10e24	0x140	data	English	United States	0.565625
RT_DIALOG	0x10f64	0x196	data	English	United States	0.5960591133004927
RT_DIALOG	0x110fc	0x10e	data	English	United States	0.6111111111111112
RT_DIALOG	0x1120c	0xfa	data	English	United States	0.652
RT_STRING	0x11308	0x8c	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	English	United States	0.6214285714285714
RT_STRING	0x11394	0x520	data	English	United States	0.4032012195121951
RT_STRING	0x118b4	0x5cc	data	English	United States	0.36455525606469
RT_STRING	0x11e80	0x4b0	data	English	United States	0.385
RT_STRING	0x12330	0x44a	data	English	United States	0.3970856102003643
RT_STRING	0x1277c	0x3ce	data	English	United States	0.36858316221765913
RT_RCDATA	0x12b4c	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x12b54	0x2b0d3c	Microsoft Cabinet archive data, many, 2821436 bytes, 2 files, at 0x2c +A "StretchWare.msi" +A "setup.exe", ID 2436, number 1, 100 datablocks, 0x1503 compression	English	United States	0.9957904815673828
RT_RCDATA	0x2c3890	0x4	data	English	United States	3.0
RT_RCDATA	0x2c3894	0x24	data	English	United States	0.9444444444444444
RT_RCDATA	0x2c38b8	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2c38c0	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2c38c8	0x4	data	English	United States	3.0
RT_RCDATA	0x2c38cc	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2c38d4	0x4	data	English	United States	3.0
RT_RCDATA	0x2c38d8	0xc	data	English	United States	1.6666666666666667
RT_RCDATA	0x2c38e4	0x4	data	English	United States	3.0
RT_RCDATA	0x2c38e8	0xc	data	English	United States	1.6666666666666667
RT_RCDATA	0x2c38f4	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_RCDATA	0x2c38fc	0x7	ASCII text, with no line terminators	English	United States	2.142857142857143
RT_GROUP_ICON	0x2c3904	0x22	data	English	United States	1.0
RT_VERSION	0x2c3928	0x424	data	English	United States	0.42924528301886794

Imports

DLL	Import
ADVAPI32.dll	FreeSid, AllocateAndInitializeSid, EqualSid, GetTokenInformation, OpenProcessToken, AdjustTokenPrivileges, LookupPrivilegeValueA, RegCloseKey, RegDeleteValueA, RegOpenKeyExA, RegSetValueExA, RegQueryValueExA, RegCreateKeyExA, RegQueryInfoKeyA
KERNEL32.dll	LocalFree, LocalAlloc, GetLastError, GetCurrentProcess, lstrlenA, GetModuleFileNameA, GetSystemDirectoryA, _lclose, _llseek, _lopen, WritePrivateProfileStringA, GetWindowsDirectoryA, CreateDirectoryA, GetFileAttributesA, ExpandEnvironmentStringsA, lstrcpyA, GlobalFree, GlobalUnlock, GlobalLock, GlobalAlloc, IsDBCSLeadByte, GetShortPathNameA, GetPrivateProfileStringA, GetPrivateProfileIntA, lstrcmpiA, RemoveDirectoryA, FindClose, FindNextFileA, DeleteFileA, SetFileAttributesA, lstrcmpA, FindFirstFileA, FreeResource, GetProcAddress, LoadResource, SizeofResource, FindResourceA, lstrcatA, CloseHandle, WriteFile, SetFilePointer, SetFileTime, LocalFileTimeToFileTime, DosDateTimeToFileTime, SetCurrentDirectoryA, GetTempFileNameA, ExitProcess, CreateFileA, LoadLibraryExA, lstrcpynA, GetVolumeInformationA, FormatMessageA, GetCurrentDirectoryA, GetVersionExA, GetExitCodeProcess, WaitForSingleObject, CreateProcessA, GetTempPathA, GetSystemInfo, CreateMutexA, SetEvent, CreateEventA, CreateThread, ResetEvent, TerminateThread, GetDriveTypeA, GetModuleHandleA, GetStartupInfoA, GetCommandLineA, QueryPerformanceCounter, GetTickCount, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, ReadFile, LoadLibraryA, GetDiskFreeSpaceA, MulDiv, EnumResourceLanguagesA, FreeLibrary, LockResource
GDI32.dll	GetDeviceCaps
USER32.dll	ExitWindowsEx, wsprintfA, CharNextA, CharUpperA, CharPrevA, SetWindowLongA, GetWindowLongA, CallWindowProcA, DispatchMessageA, MsgWaitForMultipleObjects, PeekMessageA, SendMessageA, SetWindowPos, ReleaseDC, GetDC, GetWindowRect, SendDlgItemMessageA, GetDlgItem, SetForegroundWindow, SetWindowTextA, MessageBoxA, DialogBoxIndirectParamA, ShowWindow, EnableWindow, GetDlgItemTextA, EndDialog, GetDesktopWindow, MessageBeep, SetDlgItemTextA, LoadStringA, GetSystemMetrics
COMCTL32.dll
VERSION.dll	GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	11:32:35
Start date:	03/07/2024
Path:	C:\Users\user\Desktop\StretchInstall.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\StretchInstall.exe"
Imagebase:	0x1000000
File size:	2'887'680 bytes
MD5 hash:	3F82A2195043CD2877B674CB321E2CF7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	11:32:36
Start date:	03/07/2024
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe
Imagebase:	0xd20000
File size:	428'032 bytes
MD5 hash:	E98B8B16179129CC1B75C3D0A7B67CD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	11:32:36
Start date:	03/07/2024
Path:	C:\Windows\SysWOW64\msiexec.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\msiexec.exe" -I "C:\Users\user\AppData\Local\Temp\IXP000.TMP\StretchWare.msi"
Imagebase:	0x7b0000
File size:	59'904 bytes
MD5 hash:	9D09DC1EDA745A5F87553048E57620CF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	11:32:36
Start date:	03/07/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff781aa0000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	11:32:45
Start date:	03/07/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\"
Imagebase:	0x7ff6c2e20000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:32:59
Start date:	03/07/2024
Path:	C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe"
Imagebase:	0xf60000
File size:	2'295'296 bytes
MD5 hash:	A76894A90372756D69A9F51704EF43F5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	24.8%
Dynamic/Decrypted Code Coverage:	59.8%
Signature Coverage:	19.5%
Total number of Nodes:	1070
Total number of Limit Nodes:	51

Executed Functions

Function 010026E2 Relevance: 51.0, APIs: 17, Strings: 12, Instructions: 268
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,0100133C,?,00000104,?,00000001,7622F530,00000000), ref: 0100277B
lstrcpyA.KERNEL32(?,?,?,?,0100133C,?,00000104,?,00000001,7622F530,00000000), ref: 01002793
lstrcmpiA.KERNEL32(00000000,.INF), ref: 010027B7
lstrlenA.KERNEL32(DefaultInstall,?,01001330,?), ref: 01002810
lstrlenA.KERNEL32(?,?,0100132C), ref: 0100283C
LocalAlloc.KERNEL32(00000040,00000200), ref: 0100284D
GetPrivateProfileIntA.KERNEL32(?,Reboot,00000000,?), ref: 0100287C
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,01001271,?,00000008,?), ref: 010028B1
GetShortPathNameA.KERNEL32(?,?,00000104), ref: 0100291A
wsprintfA.USER32 ref: 0100294B
lstrcmpiA.KERNEL32(00000000,.BAT), ref: 0100296B
lstrlenA.KERNEL32(Command.com /c %s), ref: 0100297D
lstrlenA.KERNEL32(?), ref: 0100298C
LocalAlloc.KERNEL32(00000040,?), ref: 0100299B
wsprintfA.USER32 ref: 010029B4
LocalAlloc.KERNEL32(00000040,00000400,?,0000002E,?,0000002E), ref: 010029CA
GetFileAttributesA.KERNELBASE(?), ref: 010029F8

Strings

Command.com /c %s, xrefs: 01002977, 0100297C, 010029B2
setupx.dll, xrefs: 01002910
setupapi.dll, xrefs: 01002922
Version, xrefs: 010028AC
.INF, xrefs: 010027B1
DefaultInstall, xrefs: 01002809, 01002863, 0100287B, 010028C8, 01002939
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 01002940
AdvancedINF, xrefs: 010028A7
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 01002775
Reboot, xrefs: 01002876
.BAT, xrefs: 01002965
", xrefs: 01002726

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: lstrlen$AllocLocal$PrivateProfilelstrcmpilstrcpywsprintf$AttributesFileNamePathShortString
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 1934397216-3060569371
Opcode ID: 6c011d49d29e131f740ed8dabe1c808832c5922d73e00483e9065f74cfc82ed7
Instruction ID: a376eb2aa62e0528c46e6ae682dde744fbc8027db4852c82fdc9f52ca6896b49
Opcode Fuzzy Hash: 6c011d49d29e131f740ed8dabe1c808832c5922d73e00483e9065f74cfc82ed7
Instruction Fuzzy Hash: BCA191B5900259ABFF32DB648C48EDA7BBDAB94300F0404D5F6C9A7180DBB19AD48F64

Function 0100456A Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 188
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,762283C0,00000000), ref: 010045AA
SetCurrentDirectoryA.KERNELBASE(00000000), ref: 010045B7

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 0100459D

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: CurrentDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 1611563598-388467436
Opcode ID: 6a901a27d976f6ecd6b1b3fb4ef83800b97c89f981ca28cfd4edf11155ac7cbc
Instruction ID: 32a5e2e07f0e045be28bc8ef6b6c2a76a4ecc1151fd6d71cf5cc981d67540b80
Opcode Fuzzy Hash: 6a901a27d976f6ecd6b1b3fb4ef83800b97c89f981ca28cfd4edf11155ac7cbc
Instruction Fuzzy Hash: 48519EB2900258AFFB23DB64DC85FFA77ACEB09300F0044A5B799D61C5D6759E808F65

Function 010052D4 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 96
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000,?,00000104,762283C0,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 01005320
GetSystemInfo.KERNEL32(?), ref: 01005336
lstrcpyA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,762283C0,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 01005386
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 0100539B

Part of subcall function 0100342E: wsprintfA.USER32 ref: 01003465
Part of subcall function 0100342E: lstrcpyA.KERNEL32(762283C0,?), ref: 01003476
Part of subcall function 0100342E: RemoveDirectoryA.KERNELBASE(762283C0,762283C0,00000104,?), ref: 0100348D
Part of subcall function 0100342E: GetFileAttributesA.KERNELBASE(762283C0), ref: 01003494
Part of subcall function 0100342E: GetTempFileNameA.KERNEL32(?,IXP,00000000,762283C0), ref: 010034DD
Part of subcall function 0100342E: DeleteFileA.KERNEL32(762283C0), ref: 010034F2
Part of subcall function 0100342E: CreateDirectoryA.KERNEL32(762283C0,00000000), ref: 010034FB

RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 010053DE

Strings

i386, xrefs: 01005365
mips, xrefs: 0100535E
ppc, xrefs: 01005350
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 010052EA, 0100531A, 0100531F, 0100536B, 01005377, 01005380, 01005385, 0100538C, 0100539A, 010053AF, 010053D7
alpha, xrefs: 01005357

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Directory$Filelstrcpy$CreateRemove$AttributesDeleteInfoNameSystemTempwsprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 2618030033-1143122538
Opcode ID: 5207e9f744ef7db5255fb7e2e18f52085c41d1909f07fa191eb1e1e1ead31f8c
Instruction ID: bbe6c97369ec8f106fead77e6623ce3be693c8dab588adb95fac2358924cc935
Opcode Fuzzy Hash: 5207e9f744ef7db5255fb7e2e18f52085c41d1909f07fa191eb1e1e1ead31f8c
Instruction Fuzzy Hash: 7E31C571904615AAF7239F299C44DEE3BE8BB45355F048069B6C5D60C4DFB9C944CF60

Function 01006205 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 115
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000105), ref: 0100626F
LoadLibraryA.KERNEL32(?,?,00000105,advapi32.dll), ref: 0100628E
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 010062A5
DecryptFileA.ADVAPI32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 010062B1
FreeLibrary.KERNEL32(00000000), ref: 010062B4

Part of subcall function 010043EC: LocalAlloc.KERNEL32(00000040,00000001,UPROMPT,00000000,00000000,00000000,00000000,?,?,?,01006231), ref: 0100440B

SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 010062DB

Strings

DecryptFileA, xrefs: 0100629F
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 01006298, 010062B0, 010062DA
advapi32.dll, xrefs: 01006275

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-2712585282
Opcode ID: 799601459926c632d555a8d86d08fbf0d875e0935837b017e982ad4550c23b2f
Instruction ID: 9140d9ddfa85fbf1d4f936cfa7ace5a96bcd53ce79dc58d3eacbe78f2b8b6b31
Opcode Fuzzy Hash: 799601459926c632d555a8d86d08fbf0d875e0935837b017e982ad4550c23b2f
Instruction Fuzzy Hash: FB310831900A12AAFB73A775DE409BB37EEEB96351F0441A9E9C1C10C4EF7B8590CB61

Function 01004819 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,?,00000005), ref: 0100482A
LoadResource.KERNEL32(00000000,00000000,?,0100563F,000007D6,00000000,0100189D,00000547,0000083E,?,?,00000000), ref: 01004838
DialogBoxIndirectParamA.USER32(00000000,00000000,?,0000083E,00000547), ref: 01004857
FreeResource.KERNEL32(00000000,?,0100563F,000007D6,00000000,0100189D,00000547,0000083E,?,?,00000000), ref: 01004860

Strings

StretchWare, xrefs: 0100481F

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID: StretchWare
API String ID: 1214682469-859621192
Opcode ID: b0a883f33820150622e98825acaf097b5103d0973a58d13b59254d27bc385b11
Instruction ID: 4d497d838b3866ab934e730ea3745aad8ad4903298c19d052a2ed601619586ec
Opcode Fuzzy Hash: b0a883f33820150622e98825acaf097b5103d0973a58d13b59254d27bc385b11
Instruction Fuzzy Hash: 3601A2321001AABFEB225FA5AC88CEF7A9DDB85364F010425FB90E3081C6759D10CBE4

Function 01006A45 Relevance: 3.0, APIs: 2, Instructions: 34COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNELBASE(00000000,00000000,00000000,00000000,00000000), ref: 01006A70
MulDiv.KERNEL32(00000000,00000000,00000400), ref: 01006A8B

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: 825da8cf926745c3866bbeb836e8d81481314d09f4b5b7f7c70813e4e2df1b9f
Instruction ID: b1f9c66608a2b67e4be2bbf4eebceb79f2602f57f0fa110e7db973902b5e4614
Opcode Fuzzy Hash: 825da8cf926745c3866bbeb836e8d81481314d09f4b5b7f7c70813e4e2df1b9f
Instruction Fuzzy Hash: E0F0E776D00118BFEF05DF95C844BEEBBBCEF15326F118496AA11A6080DB75A749CFA0

Function 01001AA7 Relevance: 47.4, APIs: 19, Strings: 8, Instructions: 178
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,00000001), ref: 01001B12
wsprintfA.USER32 ref: 01001B3E
RegQueryValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000000,00000000,?), ref: 01001B58
RegCloseKey.ADVAPI32(?), ref: 01001B7E
GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 01001BA3
LoadLibraryA.KERNELBASE(00000000,00000000,00000104,advpack.dll), ref: 01001BBE
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 01001BD4
FreeLibrary.KERNELBASE(?), ref: 01001BEE
GetSystemDirectoryA.KERNEL32(00000000,00000104), ref: 01001C00
GetModuleFileNameA.KERNEL32(00000000,00000104), ref: 01001C28
lstrlenA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 01001C3E
lstrlenA.KERNEL32(00000000), ref: 01001C49
LocalAlloc.KERNEL32(00000040,00000050), ref: 01001C52
RegCloseKey.ADVAPI32(?), ref: 01001C76
wsprintfA.USER32 ref: 01001CAB
lstrlenA.KERNEL32(00000000), ref: 01001CB5
RegSetValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000001,00000000,00000001), ref: 01001CC9
RegCloseKey.KERNELBASE(?), ref: 01001CD5
LocalFree.KERNEL32(00000000), ref: 01001CDC

Strings

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 01001C8F
%s /D:%s, xrefs: 01001C9C, 01001CA9
wextract_cleanup%d, xrefs: 01001B38
wextract_cleanup0, xrefs: 01001B28, 01001B3D, 01001B51, 01001B84, 01001CBE
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 01001C38, 01001C3D, 01001CA1
advpack.dll, xrefs: 01001BA5
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 01001B02
DelNodeRunDLL32, xrefs: 01001BCE

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Closelstrlen$DirectoryFreeLibraryLocalSystemValuewsprintf$AddressAllocCreateFileLoadModuleNameProcQuery
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 3084642846-607953301
Opcode ID: e8e5f3b3c36c9a9120034c916e34edcf0355e3275c331066bd0ee2a15f0c6816
Instruction ID: cb456183738a0c10edcd6481a0703a1d73204317f046f42922711a87de10383b
Opcode Fuzzy Hash: e8e5f3b3c36c9a9120034c916e34edcf0355e3275c331066bd0ee2a15f0c6816
Instruction Fuzzy Hash: 3351737594021CABEB329B65DD88FEA7BBDEB54700F0000D5F689E6185DBB5CA80CF61

Function 01005ABC Relevance: 40.5, APIs: 11, Strings: 12, Instructions: 274
stringlibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpyA.KERNEL32(?,0100CAA2,00000000,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 01005C87
lstrcmpiA.KERNEL32(?,<None>), ref: 01005C24

Part of subcall function 01002E55: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002E6B
Part of subcall function 01002E55: SizeofResource.KERNEL32(00000000,00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E6F
Part of subcall function 01002E55: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002E8B
Part of subcall function 01002E55: LoadResource.KERNEL32(00000000,00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E8F
Part of subcall function 01002E55: LockResource.KERNEL32(00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E96

lstrcmpiA.KERNEL32(?,<None>), ref: 01005CCA
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 01005D76
FreeLibrary.KERNEL32(00000000), ref: 01005E3E
LocalFree.KERNEL32(?,?,00000044,?,00000104,?,?), ref: 01005E66
LocalFree.KERNEL32(?,00000000,000004C7,00000000,00000000,00000010,00000000,?,00000104,?,?), ref: 01005EB0
FreeLibrary.KERNEL32(00000000,00000000,000004C9,DoInfInstall,00000000,00000010,00000000), ref: 01005EEC
LocalFree.KERNEL32(?,00000000,000004C8,advpack.dll,00000000,00000010,00000000,advpack.dll,?,00000104,?,?), ref: 01005EF8
FreeLibrary.KERNEL32(00000000), ref: 01005F09
LocalFree.KERNEL32(?,?,00000044,?,00000104,?,?), ref: 01005F15

Strings

ADMQCMD, xrefs: 01005BE3
StretchWare, xrefs: 01005DBD
D, xrefs: 01005B54
USRQCMD, xrefs: 01005BF3
<None>, xrefs: 01005C18, 01005CBE
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 01005ACC, 01005DC7
RUNPROGRAM, xrefs: 01005C4C
advpack.dll, xrefs: 01005D5C, 01005EC5
POSTRUNPROGRAM, xrefs: 01005CA4
DoInfInstall, xrefs: 01005D70, 01005EDB
REBOOT, xrefs: 01005AF9
SHOWWINDOW, xrefs: 01005B6D

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Free$Resource$Local$Library$Findlstrcmpi$AddressLoadLockProcSizeoflstrcpy
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$StretchWare$USRQCMD$advpack.dll
API String ID: 770626793-1719712871
Opcode ID: cc61a717c1ac84a9bdfc436f46c8520804baf07a4835fa07c55533f653c16650
Instruction ID: c2c6c5684892b5d7fa573e4d2de66b3b8837dd926b255ab3696fc0a2f468da05
Opcode Fuzzy Hash: cc61a717c1ac84a9bdfc436f46c8520804baf07a4835fa07c55533f653c16650
Instruction Fuzzy Hash: 30B1BF7090025C9EFF779B258D85BEA7BB8AB09304F0041EAE6C9A61C0DBB54EC5CF55

Function 01005F21 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 239
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01002E55: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002E6B
Part of subcall function 01002E55: SizeofResource.KERNEL32(00000000,00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E6F
Part of subcall function 01002E55: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002E8B
Part of subcall function 01002E55: LoadResource.KERNEL32(00000000,00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E8F
Part of subcall function 01002E55: LockResource.KERNEL32(00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E96

LocalAlloc.KERNEL32(00000040,00000001,RUNPROGRAM,00000000,00000000,00000000,00000000), ref: 01005F4E
lstrcmpA.KERNEL32(00000000,<None>,RUNPROGRAM,00000000,00000000), ref: 01005FB2
LocalFree.KERNEL32(00000000), ref: 01005FC6
LocalFree.KERNEL32(00000000,00000000,000004B1,00000000,00000000,00000010,00000000,RUNPROGRAM,00000000,00000000), ref: 01005F9A

Part of subcall function 01003EBE: MessageBoxA.USER32(?,?,StretchWare,00000000), ref: 01003F5B

Part of subcall function 01003AA1: GetLastError.KERNEL32(76244B00,01004684), ref: 01003AAA
Part of subcall function 01003AA1: GetLastError.KERNEL32 ref: 01003AB0

GetTempPathA.KERNEL32(00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 01006035
lstrcpyA.KERNEL32(?,A:\), ref: 0100607B
GetDriveTypeA.KERNEL32(0000005A), ref: 01006083
GetFileAttributesA.KERNEL32(0000005A), ref: 0100609C
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,00000000), ref: 010061AD

Strings

msdownld.tmp, xrefs: 0100613A
<None>, xrefs: 01005FAC
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 0100602A, 0100602F, 01006042, 0100604C, 01006058, 01006184, 0100618A
RUNPROGRAM, xrefs: 01005F38, 01005F3D, 01005F7F
A:\, xrefs: 0100606F
Z, xrefs: 01006194

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Resource$Local$ErrorFindFreeLast$AllocAttributesDirectoryDriveFileLoadLockMessagePathSizeofTempTypeWindowslstrcmplstrcpy
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 535033332-1370313076
Opcode ID: 72180e447f72e634df863711cb3eef120908db6c341b2da6da5b2c7871772f1b
Instruction ID: 567b5bc756c7a10916d387d21bd88499efbec6f747d449020ba67bed0e17c02a
Opcode Fuzzy Hash: 72180e447f72e634df863711cb3eef120908db6c341b2da6da5b2c7871772f1b
Instruction Fuzzy Hash: 2D71E87064431979FB73E7758C48FEB36AE9F15354F000495FAC5D60C2EABAC9908B60

Function 0100589B Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127
threadwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TerminateThread.KERNELBASE(00000000), ref: 010058DA
KiUserCallbackDispatcher.NTDLL(?,?), ref: 010058E6
ResetEvent.KERNEL32 ref: 01005907
SetEvent.KERNEL32(000004B2,01001271,00000000,00000020,00000004), ref: 01005937
GetDesktopWindow.USER32 ref: 0100596E
GetDlgItem.USER32(?,0000083B), ref: 0100599E
SendMessageA.USER32(00000000,?,?,00000000), ref: 010059A7
GetDlgItem.USER32(?,0000083B), ref: 010059B9
SendMessageA.USER32(00000000,?,?,00000000), ref: 010059BC
SetWindowTextA.USER32(?,StretchWare), ref: 010059CA
CreateThread.KERNELBASE(00000000,00000000,Function_00005190,00000000,00000000,0100BA48), ref: 010059DE
EndDialog.USER32(?,00000000), ref: 010059FF
EndDialog.USER32(?,00000000), ref: 01005A24

Strings

StretchWare, xrefs: 010059C4

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CallbackCreateDesktopDispatcherResetTerminateTextUser
String ID: StretchWare
API String ID: 3638050378-859621192
Opcode ID: d3500fe9f7f5db743cd9965e837850aa1de798782591f39a44d4ee80d603ffb1
Instruction ID: 15f982f993cd47813f1b622385cc2ed99f85bd15372d9b845fe613da468a2202
Opcode Fuzzy Hash: d3500fe9f7f5db743cd9965e837850aa1de798782591f39a44d4ee80d603ffb1
Instruction Fuzzy Hash: 4C41B135500325BBEB335B689C49EAF3EA8EB4BB61F004111F6C5A50D9C7BA8951CF90

Function 010053FA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 180
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01002E55: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002E6B
Part of subcall function 01002E55: SizeofResource.KERNEL32(00000000,00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E6F
Part of subcall function 01002E55: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002E8B
Part of subcall function 01002E55: LoadResource.KERNEL32(00000000,00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E8F
Part of subcall function 01002E55: LockResource.KERNEL32(00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E96

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,TITLE,StretchWare,0000007F,?,00000000), ref: 01005485
SetEvent.KERNEL32(00000000,?,00000000), ref: 01005491

Part of subcall function 01002E55: FreeResource.KERNEL32(00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002EBA

CreateMutexA.KERNEL32(00000000,00000001,?,INSTANCECHECK,?,00000104,EXTRACTOPT,0100C494,00000004,?,00000000), ref: 010054FB
GetLastError.KERNEL32(?,00000000), ref: 0100550A
FindResourceA.KERNEL32(?,VERCHECK,0000000A), ref: 010055AB
LoadResource.KERNEL32(?,00000000,?,00000000), ref: 010055BC
#17.COMCTL32(?,00000000), ref: 010055D0
CloseHandle.KERNEL32(00000000,00000524,StretchWare,00000000,00000020,00000004,?,00000000), ref: 0100554E

Part of subcall function 01003EBE: MessageBoxA.USER32(?,?,StretchWare,00000000), ref: 01003F5B

Strings

TITLE, xrefs: 01005458
StretchWare, xrefs: 0100544D, 01005454, 01005524, 01005537
INSTANCECHECK, xrefs: 010054C5
EXTRACTOPT, xrefs: 0100549E
VERCHECK, xrefs: 010055A0

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Resource$Find$CreateEventLoad$CloseErrorFreeHandleLastLockMessageMutexSizeof
String ID: EXTRACTOPT$INSTANCECHECK$StretchWare$TITLE$VERCHECK
API String ID: 612345255-2013581014
Opcode ID: dfb335a3e4c0202e28b2d8cb9f104e55799dce7ea0ddd3f3ac42d2f903d32e3e
Instruction ID: cbd0a4ee99872fe0b9b450feb2e661f6d2b71e757350258eec7348613e7537f9
Opcode Fuzzy Hash: dfb335a3e4c0202e28b2d8cb9f104e55799dce7ea0ddd3f3ac42d2f903d32e3e
Instruction Fuzzy Hash: A05128706403496AF7339B28ED85FEA3A9DEB19745F440195F6C5D61C5CBBA8E80CF20

Function 0100342E Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 71
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 01003465
lstrcpyA.KERNEL32(762283C0,?), ref: 01003476

Part of subcall function 010066CF: lstrlenA.KERNEL32(00000104,0000002F,?,01003991,0100C89A,00000104,01001271), ref: 010066D9

RemoveDirectoryA.KERNELBASE(762283C0,762283C0,00000104,?), ref: 0100348D
GetFileAttributesA.KERNELBASE(762283C0), ref: 01003494
CreateDirectoryA.KERNELBASE(762283C0,00000000), ref: 010034B2
GetTempFileNameA.KERNEL32(?,IXP,00000000,762283C0), ref: 010034DD
DeleteFileA.KERNEL32(762283C0), ref: 010034F2
CreateDirectoryA.KERNEL32(762283C0,00000000), ref: 010034FB

Strings

IXP, xrefs: 010034D2
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 01003445
IXP%03d.TMP, xrefs: 0100345F

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemplstrcpylstrlenwsprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$IXP$IXP%03d.TMP
API String ID: 2425626272-2562829823
Opcode ID: 909a37eeb0d10a258c43e028ade7052fe929c50dff5c231103c15f598a75b725
Instruction ID: 79b835e8247eab284df87d354388e64f77954c4bc5d13dbb6f938c802c931663
Opcode Fuzzy Hash: 909a37eeb0d10a258c43e028ade7052fe929c50dff5c231103c15f598a75b725
Instruction Fuzzy Hash: 22218035A00218AFE7239F649C45FDE7BB8FF19350F008195F6C5E6184CBB99A848FA1

Function 010044BD Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 64
stringmemoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(01005392,762283C0,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,?,01005392,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 010044C8
LocalAlloc.KERNEL32(00000040,-00000014,?,01005392,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 010044D6
lstrcpyA.KERNEL32(00000000,01005392,?,01005392,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 0100450B
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,00000000,-00000014,TMP4351$.TMP,?,01005392,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 0100452D
LocalFree.KERNEL32(00000000,?,01005392,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 01004536
CloseHandle.KERNEL32(00000000,?,01005392,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 01004542
GetFileAttributesA.KERNELBASE(01005392,?,01005392,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 0100454B

Part of subcall function 01003EBE: MessageBoxA.USER32(?,?,StretchWare,00000000), ref: 01003F5B

Part of subcall function 01003AA1: GetLastError.KERNEL32(76244B00,01004684), ref: 01003AAA
Part of subcall function 01003AA1: GetLastError.KERNEL32 ref: 01003AB0

Strings

TMP4351$.TMP, xrefs: 01004511
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 010044C3

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: ErrorFileLastLocal$AllocAttributesCloseCreateFreeHandleMessagelstrcpylstrlen
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$TMP4351$.TMP
API String ID: 3688570051-1330067808
Opcode ID: 57520002fee6ae4235c75deb696dfb0f82a0d2a6da16ad456c8abe4454f22560
Instruction ID: d346d4950023621807eef61a061fb4322b337a095deacce8b095f1f8bab94072
Opcode Fuzzy Hash: 57520002fee6ae4235c75deb696dfb0f82a0d2a6da16ad456c8abe4454f22560
Instruction Fuzzy Hash: 4611CE722002047FF3235B69AC88EAB3E5DEB857A9F014120FBC5E10C5DBBA8C458B64

Function 01005190 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 010032FF: FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 0100331B
Part of subcall function 010032FF: LoadResource.KERNEL32(00000000,00000000), ref: 01003324
Part of subcall function 010032FF: LockResource.KERNEL32(00000000), ref: 0100332B

GetDlgItem.USER32(000103F0,00000842), ref: 010051B5
ShowWindow.USER32(00000000), ref: 010051BE
GetDlgItem.USER32(00000841,00000005), ref: 010051CD
ShowWindow.USER32(00000000), ref: 010051D0
FreeResource.KERNEL32(00000000,-00000514,00000000,00000000,00000010,00000000,?,00000000,00000000,00000001,01005A8A,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,0100630E), ref: 0100527C
SendMessageA.USER32(00000FA1,00000000,00000000,-00000514), ref: 010052C3

Strings

*MEMCAB, xrefs: 01005236

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Resource$ItemShowWindow$FindFreeLoadLockMessageSend
String ID: *MEMCAB
API String ID: 3694369891-3211172518
Opcode ID: db05329e52dd5ee1d8b23c1b6cf70e12f657115257108f69590474f878c27e53
Instruction ID: 2bc75931ab46805ef586b25582dda227c40a14ab93dc7bc1b63351d76fe4d624
Opcode Fuzzy Hash: db05329e52dd5ee1d8b23c1b6cf70e12f657115257108f69590474f878c27e53
Instruction Fuzzy Hash: B931B9757823157BFA3363669C4AFDB7E9CEF46B61F400054F6C4A90C5D6FA84808BA1

Function 01004CAE Relevance: 10.6, APIs: 7, Instructions: 96
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000104,?,00000001,7622F530,00000000), ref: 01004CFB
WaitForSingleObject.KERNEL32(?,000000FF), ref: 01004D0D
GetExitCodeProcess.KERNEL32(?,?), ref: 01004D20
CloseHandle.KERNEL32(?,?), ref: 01004D67
CloseHandle.KERNEL32(?), ref: 01004D6F
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 01004D9C
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 01004DA9

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: 05cf2146d3cb3a1a994f05930313d047acf105d867eac4180c0c86445154b7ef
Instruction ID: 5a155537b353c9cd57f3a89634c1b274d3be44dcdf0063c1db90bf3a96692e15
Opcode Fuzzy Hash: 05cf2146d3cb3a1a994f05930313d047acf105d867eac4180c0c86445154b7ef
Instruction Fuzzy Hash: 22319275541228BEFB33AB64DC48FEA7BBCEB05310F104196F698D2194CA759D81CF64

Function 010043EC Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 79
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 01002E55: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002E6B
Part of subcall function 01002E55: SizeofResource.KERNEL32(00000000,00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E6F
Part of subcall function 01002E55: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002E8B
Part of subcall function 01002E55: LoadResource.KERNEL32(00000000,00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E8F
Part of subcall function 01002E55: LockResource.KERNEL32(00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E96

LocalAlloc.KERNEL32(00000040,00000001,UPROMPT,00000000,00000000,00000000,00000000,?,?,?,01006231), ref: 0100440B
LocalFree.KERNEL32(00000000,00000000,000004B1,00000000,00000000,00000010,00000000,UPROMPT,00000000,?,?,?,?,01006231), ref: 01004452

Part of subcall function 01003EBE: MessageBoxA.USER32(?,?,StretchWare,00000000), ref: 01003F5B

Part of subcall function 01003AA1: GetLastError.KERNEL32(76244B00,01004684), ref: 01003AAA
Part of subcall function 01003AA1: GetLastError.KERNEL32 ref: 01003AB0

Strings

<None>, xrefs: 01004464
UPROMPT, xrefs: 010043F9, 010043FE, 01004437

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Resource$ErrorFindLastLocal$AllocFreeLoadLockMessageSizeof
String ID: <None>$UPROMPT
API String ID: 226386726-2980973527
Opcode ID: 5621df78db6fb9bc4c81758bdbf51104c654e0ae191e744358777e9de4287252
Instruction ID: 146d34d373b0198092be5e02ab1a2f1c89f0357a0b6c02c78eefd4d2e1b3e036
Opcode Fuzzy Hash: 5621df78db6fb9bc4c81758bdbf51104c654e0ae191e744358777e9de4287252
Instruction Fuzzy Hash: EF1184B1640790BAF3336B626C89E6B7AACD7C6B55F014018FAC1E50C5EBB989018774

Function 0100645C Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 0100646B: GetSystemTimeAsFileTime.KERNEL32(?), ref: 01006488
Part of subcall function 0100646B: GetCurrentProcessId.KERNEL32 ref: 01006494
Part of subcall function 0100646B: GetCurrentThreadId.KERNEL32 ref: 0100649C
Part of subcall function 0100646B: GetTickCount.KERNEL32 ref: 010064A4
Part of subcall function 0100646B: QueryPerformanceCounter.KERNEL32(?), ref: 010064B0

GetCommandLineA.KERNEL32 ref: 010063E9
GetStartupInfoA.KERNEL32(?), ref: 01006428
GetModuleHandleA.KERNEL32(00000000,00000000,00000000,0000000A), ref: 01006443
ExitProcess.KERNEL32 ref: 01006450

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: CurrentProcessTime$CommandCountCounterExitFileHandleInfoLineModulePerformanceQueryStartupSystemThreadTick
String ID:
API String ID: 4244892483-0
Opcode ID: 8eca9f7f715971f7e939c949c439528cd9193f0ffc909e1846a034fe0de0fca6
Instruction ID: 28ebec749969a0dba5d051bd69dfa24efec2f660701a2f3e5969e2e7d4d3e92f
Opcode Fuzzy Hash: 8eca9f7f715971f7e939c949c439528cd9193f0ffc909e1846a034fe0de0fca6
Instruction Fuzzy Hash: 7A01B1718043949AFB731FAC8449BF97FEB9F16208F650495E9C1D61C2CAB685E383A1

Function 0100502E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 01002EFD: lstrlenA.KERNEL32(00000104,?,?,?,0100511C,?,00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?), ref: 01002F0D
Part of subcall function 01002EFD: lstrlenA.KERNEL32(?,?,?,?,0100511C,?,00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?), ref: 01002F14

SetFileAttributesA.KERNELBASE(?,00000000,?,?,?,?,?,00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?), ref: 010050D8
SetDlgItemTextA.USER32(000103F0,00000837,?), ref: 010050FD

Part of subcall function 010032A1: lstrcpyA.KERNEL32(0100C17C,?,?,?,?,01005180,?), ref: 010032C8
Part of subcall function 010032A1: lstrcpyA.KERNEL32(0100C280,?,?,?,?,01005180,?), ref: 010032D2
Part of subcall function 010032A1: lstrcpyA.KERNEL32(0100C384,?,?,?,?,01005180,?), ref: 010032DC

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 0100508D, 0100510C

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: lstrcpy$lstrlen$AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 1052324692-388467436
Opcode ID: f19e61d64bcb31124e15a0de3fd3c72425a8ff17acc2b1c39f114b4d5d9fea0a
Instruction ID: 90c2899bc6a778b52ee834594eec5cb3686ca2a893eb7b206c14bf922d2a115a
Opcode Fuzzy Hash: f19e61d64bcb31124e15a0de3fd3c72425a8ff17acc2b1c39f114b4d5d9fea0a
Instruction Fuzzy Hash: E831823650060AAAFB73DB78CD05AEB77E8AB18750F044555BAD5D60C0EE74DA84CFA0

Function 010041D8 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 60stringCOMMON

Download Yara Rule

APIs

lstrcmpA.KERNEL32(00000180,*MEMCAB,00000000,00000001,?,01004303,*MEMCAB,00008000,00000180,00000000), ref: 01004221

Strings

<+, xrefs: 01004249
*MEMCAB, xrefs: 01004219

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: lstrcmp
String ID: *MEMCAB$<+
API String ID: 1534048567-3398067535
Opcode ID: 8d1886825cf7cf1b7fca3806ded3f6736f8ae30cbe39c047e8d4af6a682cd926
Instruction ID: 92061fbbc721102d292826fa71bb98d8294175fcbeac33c2f5b1cd223c837d31
Opcode Fuzzy Hash: 8d1886825cf7cf1b7fca3806ded3f6736f8ae30cbe39c047e8d4af6a682cd926
Instruction Fuzzy Hash: C11175716412049FF7639F18C984AB57B94FB00358F4643E9F6D9CA1E6CBB1C8458B54

Function 010031EE Relevance: 4.5, APIs: 3, Instructions: 38timeCOMMON

Download Yara Rule

APIs

DosDateTimeToFileTime.KERNEL32(?,00000104,00000104), ref: 01003217
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 01003229
SetFileTime.KERNELBASE(?,?,?,?), ref: 0100323F

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: a85077572743f2c403f9a8a18ce59d41622f36ce07e64cd569effb84dd5ba5dd
Instruction ID: 40f91eae84c0d30797b84d3855ee905c98267c5d71123f35ca3de860f136514f
Opcode Fuzzy Hash: a85077572743f2c403f9a8a18ce59d41622f36ce07e64cd569effb84dd5ba5dd
Instruction Fuzzy Hash: C8F03C7260011AAFAB22DFA4CD45CFB7BACFA44340F000569B9A6D6095EB31D518CBA0

Function 01001EDF Relevance: 4.5, APIs: 3, Instructions: 33registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000002,01004D5B,00000000,00020019,01004D5B,00000000,01004D5B,?,01001FBD,System\CurrentControlSet\Control\Session Manager,PendingFileRenameOperations,?,01001FE6,?,?,01002241), ref: 01001EFD
RegQueryValueExA.KERNELBASE(01004D5B,?,00000000,00000000,00000000,?,?,01001FBD,System\CurrentControlSet\Control\Session Manager,PendingFileRenameOperations,?,01001FE6,?,?,01002241,00000003), ref: 01001F14
RegCloseKey.KERNELBASE(01004D5B,?,01001FBD,System\CurrentControlSet\Control\Session Manager,PendingFileRenameOperations,?,01001FE6,?,?,01002241,00000003,00000000,01002D1B,?,01004D5B,?), ref: 01001F24

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 40f801ecea3a8f97b9f9c960bc3d2ecb8093f2fd098167d5a3c61593dd613369
Instruction ID: 2ca24a09e34f2df9065e4514fbcabbf1d6ca945d8222d5e896961b6e325d8fb3
Opcode Fuzzy Hash: 40f801ecea3a8f97b9f9c960bc3d2ecb8093f2fd098167d5a3c61593dd613369
Instruction Fuzzy Hash: 4DF0B775601128FBEB219F92DD08DDBBE6CEF457A0F108055FD4996110D771DA10DBA0

Function 0100412E Relevance: 3.1, APIs: 2, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNELBASE(00000180,80000000,00000000,00000000,00008000,00000080,00000000,00000000,00000000,00000000,?,?,0100427B,00000180,00008000,?), ref: 010041A8
CreateFileA.KERNEL32(00000180,80000000,00000000,00000000,00000003,00000080,00000000,00000180,?,?,0100427B,00000180,00008000,?,?,01004303), ref: 010041CA

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: b69cf7712ea0dd325566fc773e9ea564160eeb22ca95d34820805d5e9552cd5a
Instruction ID: ad9754ded69d89190427acfe716f1ac8fe926d72f3e8cb2752d49aa3ea161600
Opcode Fuzzy Hash: b69cf7712ea0dd325566fc773e9ea564160eeb22ca95d34820805d5e9552cd5a
Instruction Fuzzy Hash: 661173B265410CBAFB124E69CC44FEA7BA8EB613A8F148225FB64D61D0C379CD41DB54

Function 01003072 Relevance: 3.0, APIs: 2, Instructions: 47fileCOMMON

Download Yara Rule

APIs

Part of subcall function 01002C91: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 01002CB7
Part of subcall function 01002C91: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 01002CC9
Part of subcall function 01002C91: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 01002CEC

WriteFile.KERNELBASE(?,?,?,00000000), ref: 010030AA

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: 3e01d822541ebd2f5a5feccbb733383a8b69a22151e5f48031294b1a04767e1f
Instruction ID: 5e22b0a0ad35bde250d44ec082465892956c20a04e3cac16195ac4398cecf9f5
Opcode Fuzzy Hash: 3e01d822541ebd2f5a5feccbb733383a8b69a22151e5f48031294b1a04767e1f
Instruction Fuzzy Hash: C00180352012499FE7378F5EDC49B693BAAF780725F044225F6A58A1F4CBB69855CB00

Function 010066CF Relevance: 3.0, APIs: 2, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000104,0000002F,?,01003991,0100C89A,00000104,01001271), ref: 010066D9
CharPrevA.USER32(00000104,0100C89A,0100C89A,?,01003991,0100C89A,00000104,01001271), ref: 010066F8

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: CharPrevlstrlen
String ID:
API String ID: 2709904686-0
Opcode ID: e495bcc581d825eadedbe2fa0249395852abc95ba879f853f598c9e8d998fbc5
Instruction ID: 01c4db8a04a40ec1d325de77efd8d7371b3f1bfb3a4b2ec35a0bf0181df07810
Opcode Fuzzy Hash: e495bcc581d825eadedbe2fa0249395852abc95ba879f853f598c9e8d998fbc5
Instruction Fuzzy Hash: 6EF04F35004185EEF7235B18CC88FAA7FAAAB86210F254089F5D98B191D776A861C775

Function 01004FAF Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 0100672A: GetFileAttributesA.KERNELBASE(010027CD,?,010027CD,?), ref: 01006732

SetFileAttributesA.KERNEL32(?,00000080,?,?,?,?,01005130,?,?,00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?), ref: 01005017

Part of subcall function 01004819: FindResourceA.KERNEL32(00000000,?,00000005), ref: 0100482A
Part of subcall function 01004819: LoadResource.KERNEL32(00000000,00000000,?,0100563F,000007D6,00000000,0100189D,00000547,0000083E,?,?,00000000), ref: 01004838
Part of subcall function 01004819: DialogBoxIndirectParamA.USER32(00000000,00000000,?,0000083E,00000547), ref: 01004857
Part of subcall function 01004819: FreeResource.KERNEL32(00000000,?,0100563F,000007D6,00000000,0100189D,00000547,0000083E,?,?,00000000), ref: 01004860

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Resource$AttributesFile$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 2018477427-0
Opcode ID: 9fcb4db864238772c7e0f37f4d42fba18ce8b857c712aa4923ee3850bd34ccd9
Instruction ID: 29f51442478ac074da39ef7c59ef3f45121b76390a107e31bb9452852c9f7bc5
Opcode Fuzzy Hash: 9fcb4db864238772c7e0f37f4d42fba18ce8b857c712aa4923ee3850bd34ccd9
Instruction Fuzzy Hash: CDF0C2311513096AF7779B28AC84B6A3AD8EB01764F004166F7C05A0C5DAB64940DF99

Function 010047B3 Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 010047D2

Part of subcall function 01003EBE: MessageBoxA.USER32(?,?,StretchWare,00000000), ref: 01003F5B

Part of subcall function 01003AA1: GetLastError.KERNEL32(76244B00,01004684), ref: 01003AAA
Part of subcall function 01003AA1: GetLastError.KERNEL32 ref: 01003AB0

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: ErrorLast$DirectoryMessageWindows
String ID:
API String ID: 824312211-0
Opcode ID: 35282c28667d4249282c988ff0902db8e714afbbed6593e0c008549f216fc637
Instruction ID: fd3234c94b0ccb30078aef88c93f716d7f268c6b22518fee9330ebb3e3fc8867
Opcode Fuzzy Hash: 35282c28667d4249282c988ff0902db8e714afbbed6593e0c008549f216fc637
Instruction Fuzzy Hash: E1F08270A403057AF722EB709C46FEA33ACA750700F004460B6C1EB0C1DAB49D848B14

Function 01003108 Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,0100433C,00000000,?,?,?,?,?,00000000), ref: 01003145

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: ddf299c9d854a60029591bd0d9130fc256d7a927763a6f5153bdca3c177d8727
Instruction ID: ddcf91d87cb97e1f61d19a99827c2554d1a57a890e9a07dc5fc143585956e2ac
Opcode Fuzzy Hash: ddf299c9d854a60029591bd0d9130fc256d7a927763a6f5153bdca3c177d8727
Instruction Fuzzy Hash: 78F03632501B11EEA3A38F1995405EA7BE5FA84350B110669D5EEC6250DB30E4018B50

Function 0100672A Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(010027CD,?,010027CD,?), ref: 01006732

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fc34f9762965e922ec69309eca6e6d82ef122b58ec165bd24e8a40cd18f7f548
Instruction ID: fe60699710c37628f3a1ec2a8e4606557de7a92a1d7bfb60a33c4a11166a432d
Opcode Fuzzy Hash: fc34f9762965e922ec69309eca6e6d82ef122b58ec165bd24e8a40cd18f7f548
Instruction Fuzzy Hash: EBC0803301440C6767125575DC098763E46F741374F504720F1BBC41D0DF7BD4A1D150

Function 0100637A Relevance: 1.3, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 010053FA: CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,TITLE,StretchWare,0000007F,?,00000000), ref: 01005485
Part of subcall function 010053FA: SetEvent.KERNEL32(00000000,?,00000000), ref: 01005491

CloseHandle.KERNEL32(00000000,00000000,?,?,?,0100644F,00000000), ref: 010063CC

Part of subcall function 01003346: SetFileAttributesA.KERNEL32(004FC2A0,00000080,?,00000000), ref: 01003387
Part of subcall function 01003346: DeleteFileA.KERNEL32(004FC2A0,?,00000000), ref: 0100338F
Part of subcall function 01003346: LocalFree.KERNEL32(004FC2A0,?,00000000), ref: 0100339A
Part of subcall function 01003346: LocalFree.KERNEL32(004FC2A0,?,00000000), ref: 0100339D
Part of subcall function 01003346: lstrcpyA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 010033CE
Part of subcall function 01003346: SetCurrentDirectoryA.KERNEL32(01001344), ref: 010033EE

Part of subcall function 01002251: ExitWindowsEx.USER32(00000002,00000000), ref: 01002296

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: EventFileFreeLocal$AttributesCloseCreateCurrentDeleteDirectoryExitHandleWindowslstrcpy
String ID:
API String ID: 3566781794-0
Opcode ID: 360fb856e433d93ef5c6abbea1fa4c6ea4acfdbb5a2bf550e81dc508a18bc19c
Instruction ID: a0c14d9bb266869afe735ce61a49557cb3a3a2021fce37bd23befcfbf90a69dd
Opcode Fuzzy Hash: 360fb856e433d93ef5c6abbea1fa4c6ea4acfdbb5a2bf550e81dc508a18bc19c
Instruction Fuzzy Hash: A4F0893160061557FB33AFA5E904BDB3BD9EB11361F04D450F9C4A6184CB7BD9748B94

Function 01003275 Relevance: 1.3, APIs: 1, Instructions: 8memoryCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 0100327F

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: 7b71b831925a2d90643e7752b1a2709e506846632fe93e76af179d897e7101ca
Instruction ID: 4bb07ebccd0d412d478b25c00f2aeddb319c24c1cf8280db505fbd4cc18ddfdc
Opcode Fuzzy Hash: 7b71b831925a2d90643e7752b1a2709e506846632fe93e76af179d897e7101ca
Instruction Fuzzy Hash: E0B0123214424CB7CB111BD2E809FD53F1DD7C5772F004001F64C05141CAB3D4508791

Function 0100328C Relevance: 1.3, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GlobalFree.KERNELBASE(?), ref: 01003294

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: 551bb148dbce71ccb86f60d786338309b3c648a378d05cbb00bb3c74f7e7c821
Instruction ID: faa09d8b584007b82b20e1d52ea593548f9e5b6d19939489179b90da4771cbc5
Opcode Fuzzy Hash: 551bb148dbce71ccb86f60d786338309b3c648a378d05cbb00bb3c74f7e7c821
Instruction Fuzzy Hash: EAB0123100414CF7CF111B42E8088857F2DD6C0360B004010F48C420118F73D81186A0

Non-executed Functions

Function 01001760 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 010016B4: LoadLibraryA.KERNEL32(advapi32.dll,StretchWare,00000000,?,?,?,010017A0,?,00000000,?,?,0100561B,?,?,00000000), ref: 010016E6
Part of subcall function 010016B4: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 010016FA
Part of subcall function 010016B4: AllocateAndInitializeSid.ADVAPI32(010017A0,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 01001726
Part of subcall function 010016B4: FreeSid.ADVAPI32(?), ref: 0100173A
Part of subcall function 010016B4: FreeLibrary.KERNEL32(?,?,?,?,010017A0,?,00000000,?,?,0100561B,?,?,00000000), ref: 01001743

GetCurrentProcess.KERNEL32(00000008,0100561B,?,00000000,?,?,0100561B,?,?,00000000), ref: 010017AE
OpenProcessToken.ADVAPI32(00000000,?,?,0100561B,?,?,00000000), ref: 010017B5
GetTokenInformation.ADVAPI32(0100561B,00000002,00000000,00000000,?,00000001,?,?,0100561B,?,?,00000000), ref: 010017D5
GetLastError.KERNEL32(?,?,0100561B,?,?,00000000), ref: 010017DF
LocalAlloc.KERNEL32(00000000,?,StretchWare,?,?,0100561B,?,?,00000000), ref: 010017F3
GetTokenInformation.ADVAPI32(0100561B,00000002,00000000,?,?,?,?,0100561B,?,?,00000000), ref: 0100180C
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,0100561B,?), ref: 01001829
EqualSid.ADVAPI32(00000004,?,?,?,0100561B,?,?,00000000), ref: 0100183F
FreeSid.ADVAPI32(?,?,?,0100561B,?,?,00000000), ref: 01001861
LocalFree.KERNEL32(00000000,?,?,0100561B,?,?,00000000), ref: 01001868
CloseHandle.KERNEL32(0100561B,?,?,0100561B,?,?,00000000), ref: 01001872

Strings

StretchWare, xrefs: 010017EE

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID: StretchWare
API String ID: 2168512254-859621192
Opcode ID: f21df1777e37cdd6f0ec34d387a85b1e37b56b33b539e6758f9be16fc240ee8c
Instruction ID: 4672b0472d1bbbfd446eee883f18bb1d65bf3648c25b20912db4fd6b3c782e19
Opcode Fuzzy Hash: f21df1777e37cdd6f0ec34d387a85b1e37b56b33b539e6758f9be16fc240ee8c
Instruction Fuzzy Hash: E0317E71A0024AAFEB22DFA5DC44AEEBBB9EB04344F544465F6C1E2181D775DB04CB60

Function 01002A96 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97filestringCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?,?,00000104,0100134C,?,00000104,00000000,StretchWare,00000001), ref: 01002AF2
lstrcmpA.KERNEL32(?,01001348,?,00000104,00000000,00000000), ref: 01002B31
lstrcmpA.KERNEL32(?,01001344), ref: 01002B43

Part of subcall function 010066CF: lstrlenA.KERNEL32(00000104,0000002F,?,01003991,0100C89A,00000104,01001271), ref: 010066D9

SetFileAttributesA.KERNEL32(?,00000080,?,00000104,?,?,00000104,00000000,00000000), ref: 01002B97
DeleteFileA.KERNEL32(?), ref: 01002BA4
FindNextFileA.KERNEL32(?,00000010), ref: 01002BB7
FindClose.KERNEL32(?), ref: 01002BCB
RemoveDirectoryA.KERNEL32(00000000), ref: 01002BD2

Strings

StretchWare, xrefs: 01002ABE

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemovelstrlen
String ID: StretchWare
API String ID: 1122447120-859621192
Opcode ID: 70efa147312cdaad355b06b2a627144247dfa0eae94832973159d089a2d3e043
Instruction ID: 3621ff63f4683dfc0afae3feec3247e592be42cb1084b4f5304d675301ecb420
Opcode Fuzzy Hash: 70efa147312cdaad355b06b2a627144247dfa0eae94832973159d089a2d3e043
Instruction Fuzzy Hash: 80310D76905159ABEB62DBA4DC88EDE77BDAF64300F1041D1B6C9E2084DBB4DAC4CF60

Function 010019C3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?,00000000,?,?,0100644F), ref: 010019D2
OpenProcessToken.ADVAPI32(00000000,?,0100644F), ref: 010019D9
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 010019FB
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,00000000,00000000), ref: 01001A1A

Strings

SeShutdownPrivilege, xrefs: 010019F5

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID: SeShutdownPrivilege
API String ID: 2349140579-3733053543
Opcode ID: c17b7cf3f8bdb7068d93d2025f9cbb3199983dd50f7b35b7e72ddddd59bfcf11
Instruction ID: 6422d8529b1dadd26b9958a069e7ff89d807a817af3ba06e0855e17f5c681b04
Opcode Fuzzy Hash: c17b7cf3f8bdb7068d93d2025f9cbb3199983dd50f7b35b7e72ddddd59bfcf11
Instruction Fuzzy Hash: D9018071642225BAF7329BA24C0DFEB7EACEF46794F000010BA8AE40C5D6B5D640C6F5

Function 0100488C Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 213windowCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,00000001,StretchWare), ref: 010048C3
MessageBeep.USER32(00000000), ref: 01004AE5
MessageBoxA.USER32(00000000,?,StretchWare,?), ref: 01004B67

Strings

StretchWare, xrefs: 0100489C, 01004B5F, 01004B97
3, xrefs: 01004937

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$StretchWare
API String ID: 2519184315-4132131136
Opcode ID: bbac37c54156140ae347d57a3b35535c524f278f106985dda0b5bbdecba9b7f6
Instruction ID: f0403928f5bfd85afffa019898604f23ae46fd7ae9a1f1be602ae879ebbcfb00
Opcode Fuzzy Hash: bbac37c54156140ae347d57a3b35535c524f278f106985dda0b5bbdecba9b7f6
Instruction Fuzzy Hash: D881AB70A016159EFB739F18C944BEABBF5FF89304F0440E9D6C9D6294E7B19A90CB09

Function 0100646B Relevance: 7.5, APIs: 5, Instructions: 36timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 01006488
GetCurrentProcessId.KERNEL32 ref: 01006494
GetCurrentThreadId.KERNEL32 ref: 0100649C
GetTickCount.KERNEL32 ref: 010064A4
QueryPerformanceCounter.KERNEL32(?), ref: 010064B0

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 1c9a6aecb8a7c21b59f0650fcfd769be0ce501fac9dd4907ed4c08a4f18fdedf
Instruction ID: 54730ea4cddf6389e8530bc477ef8a499c223e9ef8984b798b14dd8bf7ea62bb
Opcode Fuzzy Hash: 1c9a6aecb8a7c21b59f0650fcfd769be0ce501fac9dd4907ed4c08a4f18fdedf
Instruction Fuzzy Hash: 76F0EC76D002189BDB22ABB4D44859FBBF5FF08350F420561E481E7145DB3AE9008B80

Function 010064DE Relevance: 6.1, APIs: 4, Instructions: 61COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,00000001), ref: 010065CC
UnhandledExceptionFilter.KERNEL32(?), ref: 010065D6
GetCurrentProcess.KERNEL32(00000502), ref: 010065E1
TerminateProcess.KERNEL32(00000000), ref: 010065E8

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: f1286b280cafa843d75f99a14fc8f82f3d62a7f6c1ba433f05c714c2799dff35
Instruction ID: b59ea808f46e4147d566023df9ea61253988435faf81cc8e47133db2c15ee704
Opcode Fuzzy Hash: f1286b280cafa843d75f99a14fc8f82f3d62a7f6c1ba433f05c714c2799dff35
Instruction Fuzzy Hash: C531AEB9811228DBCB62DF69D9886CDBBB4FF08300F1041EAE90DA7250E7759B80CF44

Function 01002251 Relevance: 1.5, APIs: 1, Instructions: 28shutdownCOMMON

Download Yara Rule

APIs

ExitWindowsEx.USER32(00000002,00000000), ref: 01002296

Part of subcall function 010019C3: GetCurrentProcess.KERNEL32(00000028,?,00000000,?,?,0100644F), ref: 010019D2
Part of subcall function 010019C3: OpenProcessToken.ADVAPI32(00000000,?,0100644F), ref: 010019D9

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID:
API String ID: 2795981589-0
Opcode ID: 420c96242fa3157512202e22d0b8ebdcd833ac1dce7af4aa444d86af65753e98
Instruction ID: e33f48b50889edb50da26cd91ad888bdbb36bf76c4c41118ded2b148f08d8a8c
Opcode Fuzzy Hash: 420c96242fa3157512202e22d0b8ebdcd833ac1dce7af4aa444d86af65753e98
Instruction Fuzzy Hash: 6FE09A70A8434932FAB3A2D59C0EF692A845B62B25F208085FBC8684C2CAF49181815B

Function 01009175 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 951f3fe9c36bf399cea3b5daee7726a970067545f8f814873e799029eb7aa681
Instruction ID: a7c859f818a1c5d7f83a952ccff987e1bf8c78757954649e346333d07fc465ac
Opcode Fuzzy Hash: 951f3fe9c36bf399cea3b5daee7726a970067545f8f814873e799029eb7aa681
Instruction Fuzzy Hash: 98C179319082959FDB1BCF68C4946EDBBF0BF05318F1985E9D8D96B283C7749A85CB80

Function 01008DBD Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ab33120750a6cf8d1db9ab5d913f5b74d9f381fdd4bd0252d22a429b75f835f
Instruction ID: 2a4e20d8dd08869bc59d0f7a9c7b9ccb62a101cbb563704953a2602d9f9330db
Opcode Fuzzy Hash: 7ab33120750a6cf8d1db9ab5d913f5b74d9f381fdd4bd0252d22a429b75f835f
Instruction Fuzzy Hash: 10C16431A09695DFDB17CF68C4942EDBBB0BF05314F1981AED9CA5B683C7709A85C780

Function 0100871A Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44e1ba9ebfd45170cdbc9c9433d3231e241977a48afbef868eb8f0aea8853ba0
Instruction ID: 5fc93633ee571ff39a8677e382d59af8c1c0cea3ee91adbd583a6aeae41621e5
Opcode Fuzzy Hash: 44e1ba9ebfd45170cdbc9c9433d3231e241977a48afbef868eb8f0aea8853ba0
Instruction Fuzzy Hash: 3BB18031D082959FEB1ACF58C0942EDFBB1BF45314F19C2EED5966B282C7749A85CB80

Function 01008A3E Relevance: .3, Instructions: 257COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c71b5dec91b09520fdc65a5692a70fade92800ff2ceada316785ebfa9eb4593
Instruction ID: f8ae5dd48e3debf24b6725d3ddbfc9255f3a3dfa18b0ea0a8bf8b6824d7edd24
Opcode Fuzzy Hash: 1c71b5dec91b09520fdc65a5692a70fade92800ff2ceada316785ebfa9eb4593
Instruction Fuzzy Hash: BEB188759086999FDB07CF18C4906EEBBB1FF45310F18C6AFD8965B282C7709685CB90

Function 010095E5 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cc9e27de92532d430281cbbbf616aa24eb1d9968cc58c166f414955b503d17a5
Instruction ID: d6403490cd5a063b4169a535978f95eea43d4b920502812e922906ff9b75bb89
Opcode Fuzzy Hash: cc9e27de92532d430281cbbbf616aa24eb1d9968cc58c166f414955b503d17a5
Instruction Fuzzy Hash: AC91F631A04696DEEB179F59C8887FDB7B0FB04708F5081AAD58DA62C2D7749A81CF90

Function 01009A1F Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adc727b130d8a70c901193652c7c29f7f7098ede988ec518b009589487b1a216
Instruction ID: 70227f3721590e3e4a8072faacb14836a54763ddc1fb9a3c1eeaf4a681808555
Opcode Fuzzy Hash: adc727b130d8a70c901193652c7c29f7f7098ede988ec518b009589487b1a216
Instruction Fuzzy Hash: 7061F431A0055E8BEF1ACF6CC4905BE77E2EBC9354F548469D9E6D7382DA309992CB80

Function 0100359C Relevance: 33.6, APIs: 14, Strings: 5, Instructions: 361stringCOMMON

Download Yara Rule

APIs

CharNextA.USER32(00000000,00000001,StretchWare,00000000), ref: 01003601
GetModuleFileNameA.KERNEL32(0100C99E,00000104,00000001,StretchWare,00000000), ref: 010036CF
CharUpperA.USER32(?), ref: 01003716
CharUpperA.USER32(-0000004F), ref: 010037A5
lstrcmpiA.KERNEL32(RegServer,?), ref: 01003825
CharUpperA.USER32(?), ref: 01003856
CharUpperA.USER32(-0000004E), ref: 010038BA
lstrlenA.KERNEL32(0000002F), ref: 01003921
CharUpperA.USER32(?,0000002F,?), ref: 01003952
lstrcpyA.KERNEL32(0100C89A,0000002F), ref: 0100397B
lstrlenA.KERNEL32(0000002F), ref: 010039E2
lstrcpyA.KERNEL32(0100CAA2,0000002F,0000002F,?,0000002F,0000005D,0000002F,0000005B), ref: 01003A57
CloseHandle.KERNEL32(00000000), ref: 01003A6E
ExitProcess.KERNEL32 ref: 01003A76

Strings

StretchWare, xrefs: 010035AD
-, xrefs: 010036FB
RegServer, xrefs: 01003820
", xrefs: 010039CB
:, xrefs: 010039BC

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Char$Upper$lstrcpylstrlen$CloseExitFileHandleModuleNameNextProcesslstrcmpi
String ID: "$-$:$RegServer$StretchWare
API String ID: 497476604-3685444502
Opcode ID: 794e446cbad3e2b7cdf7e932ea0521a881f1aef766460360d9a64afcbe4b84b2
Instruction ID: bb19260d6a52b5aa4d74d53b6b2143bc91a7fcd92ee9301d96aa0320e1ef3d88
Opcode Fuzzy Hash: 794e446cbad3e2b7cdf7e932ea0521a881f1aef766460360d9a64afcbe4b84b2
Instruction Fuzzy Hash: D7D1D271D086959EFB778B2C8D083BA7EE4BB16310F0881D9D5C99E1C5CBB886C58F52

Function 01003EBE Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 150stringmemorywindowCOMMON

Download Yara Rule

APIs

Part of subcall function 01002ECE: LoadStringA.USER32(?,00000001,00000200,LoadString() Error. Could not load string resource.), ref: 01002EEB

MessageBoxA.USER32(?,?,StretchWare,00000000), ref: 01003F5B
lstrlenA.KERNEL32(00000000,?,?,00000200,00000001,StretchWare,00000000), ref: 01003F7E
lstrlenA.KERNEL32(0000007F), ref: 01003F83
lstrlenA.KERNEL32(00000000), ref: 01003F8E
LocalAlloc.KERNEL32(00000040,00000064), ref: 01003F97
wsprintfA.USER32 ref: 01003FB2
lstrlenA.KERNEL32(0000007F,?,?,00000200,00000001,StretchWare,00000000), ref: 01003FC8
lstrlenA.KERNEL32(00000000), ref: 01003FD3
LocalAlloc.KERNEL32(00000040,00000064), ref: 01003FDC
wsprintfA.USER32 ref: 01003FF5
lstrlenA.KERNEL32(00000000,?,?,00000200,00000001,StretchWare,00000000), ref: 01004007
LocalAlloc.KERNEL32(00000040,00000001), ref: 01004011
lstrcpyA.KERNEL32(00000000,00000000), ref: 01004029
MessageBeep.USER32(?), ref: 01004032
MessageBoxA.USER32(?,00000000,StretchWare,00000000), ref: 01004075
LocalFree.KERNEL32(00000000), ref: 0100407E

Part of subcall function 010068B3: GetVersionExA.KERNEL32(?), ref: 010068FC
Part of subcall function 010068B3: GetSystemMetrics.USER32(0000004A), ref: 01006933
Part of subcall function 010068B3: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 01006959
Part of subcall function 010068B3: RegQueryValueExA.ADVAPI32(?,01001271,00000000,?,?,0000000C,?), ref: 01006983
Part of subcall function 010068B3: RegCloseKey.ADVAPI32(?), ref: 01006991

Strings

LoadString() Error. Could not load string resource., xrefs: 01003EDE
StretchWare, xrefs: 01003ED9, 01003F4C, 01004069

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: lstrlen$Local$AllocMessage$wsprintf$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersionlstrcpy
String ID: LoadString() Error. Could not load string resource.$StretchWare
API String ID: 374963636-1588481853
Opcode ID: 6e6d68f176d476745e32004f49a78736f7c082e95af37230175d7f171fa7616c
Instruction ID: eea99181f0804644aa289dd1498f83149dc0c4724dca30bca3b9ea1b6c7227c8
Opcode Fuzzy Hash: 6e6d68f176d476745e32004f49a78736f7c082e95af37230175d7f171fa7616c
Instruction Fuzzy Hash: 27518F71900619ABFB23EB64DD49BAB7BB9FF04340F0400A1FAC5E6180DB75DA508F60

Function 01005670 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 185windowCOMMON

Download Yara Rule

APIs

LoadStringA.USER32(000003E8,0100B640,00000200), ref: 010056CB
GetDesktopWindow.USER32 ref: 0100582A
SetWindowTextA.USER32(?,StretchWare), ref: 01005840
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 01005859
GetDlgItem.USER32(?,00000836), ref: 01005872
EnableWindow.USER32(00000000), ref: 01005879
EndDialog.USER32(?,00000000), ref: 01005886

Strings

StretchWare, xrefs: 0100583A
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 01005755, 0100575A, 01005771, 0100577F, 01005792, 010057AA, 010057B9, 010057C7, 010057CD, 010057FC

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$StretchWare
API String ID: 2418873061-2242397231
Opcode ID: 67c2eb31cf3ab21f20db5c8c852de19d0f9fcb7337bab56cf1edb54243df0e23
Instruction ID: bceac7bff489e274393193b6e50ad7b08821bdc7de2992364884c992066ff592
Opcode Fuzzy Hash: 67c2eb31cf3ab21f20db5c8c852de19d0f9fcb7337bab56cf1edb54243df0e23
Instruction Fuzzy Hash: D151B470240685BAF6731B269C4CFAB3DACEBC6B55F004124BAC5A90C5DBB5CA51CBB4

Function 01004E73 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 110libraryloaderstringCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,0100B640,0100B338,?), ref: 01004E83
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 01004EA4
GetProcAddress.KERNEL32(00000000,000000C3), ref: 01004EB7
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 01004ECA
GetTempPathA.KERNEL32(00000104,0100BA80), ref: 01004EEA
lstrlenA.KERNEL32(0100BA80), ref: 01004EF1
CharPrevA.USER32(0100BA80,00000000), ref: 01004F01
CharPrevA.USER32(0100BA80,00000000), ref: 01004F0D
lstrcpyA.KERNEL32(?,0100BA80), ref: 01004F5E
FreeLibrary.KERNEL32(?), ref: 01004F6D
FreeLibrary.KERNEL32(00000000), ref: 01004F7D

Strings

SHBrowseForFolder, xrefs: 01004E9E
SHELL32.DLL, xrefs: 01004E7E
SHGetPathFromIDList, xrefs: 01004EC4

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemplstrcpylstrlen
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 2439948570-1731843650
Opcode ID: 2e9765e9f73174fdabd9105ff3870c025ec8e8cc93456301d0d3cae1497260b0
Instruction ID: fe0e6358b7e97da39a092ede048a89c2912f00ab584277418b1ac7d42fbd63d6
Opcode Fuzzy Hash: 2e9765e9f73174fdabd9105ff3870c025ec8e8cc93456301d0d3cae1497260b0
Instruction Fuzzy Hash: 9B318CB1905258BFEB139FA5CC88DFEBFB8EB49340F144069F684E6280C7758941CBA4

Function 010022AC Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 105registrystringCOMMON

Download Yara Rule

APIs

CharUpperA.USER32(00009CF3,?,00000085,00000000), ref: 010022E0
CharNextA.USER32(?), ref: 010022EF
CharNextA.USER32(00000000), ref: 010022F2
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,00000104,00000000), ref: 0100234D
RegQueryValueExA.ADVAPI32(?,01001271,00000000,?,-00000004,?), ref: 01002377
ExpandEnvironmentStringsA.KERNEL32(-00000004,?,00000104), ref: 01002393
RegCloseKey.ADVAPI32(?), ref: 010023C8
lstrcpyA.KERNEL32(?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 0100231F

Part of subcall function 010066CF: lstrlenA.KERNEL32(00000104,0000002F,?,01003991,0100C89A,00000104,01001271), ref: 010066D9

GetWindowsDirectoryA.KERNEL32(-00000004,0000054D), ref: 010023D4
GetSystemDirectoryA.KERNEL32(-00000004,0000054D), ref: 010023E0

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 01002308

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindowslstrcpylstrlen
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2880253981-2428544900
Opcode ID: 7336e8143879b37cb86321436bf8a53eaa814517ff0876aac997468360ad53a5
Instruction ID: 1ad0f1247c1ed9861ce20e69da4a43a8ce288dfb09bb26ecbceeb403ef27fb39
Opcode Fuzzy Hash: 7336e8143879b37cb86321436bf8a53eaa814517ff0876aac997468360ad53a5
Instruction Fuzzy Hash: D7314A75904218AFEF239B64DC49FEE7BBDAF15310F008095F6C5E2081DBB99A948F61

Function 01001CF4 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 82registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000000), ref: 01001D2D
RegQueryValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000000,?,?,7622F530), ref: 01001D62
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 01001D92
wsprintfA.USER32 ref: 01001DC6
lstrlenA.KERNEL32(?), ref: 01001DD6
RegSetValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000001,?,00000001), ref: 01001DEF

Part of subcall function 010066CF: lstrlenA.KERNEL32(00000104,0000002F,?,01003991,0100C89A,00000104,01001271), ref: 010066D9

RegCloseKey.ADVAPI32(?), ref: 01001DFC

Strings

rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 01001DC0
wextract_cleanup0, xrefs: 01001D07, 01001D4C, 01001D51, 01001DE8
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 01001DAE
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 01001D23

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Valuelstrlen$CloseDirectoryOpenQuerySystemwsprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 2431697979-1264114338
Opcode ID: 7ccf2c186cec699dfa9e19b335666aea46083c7a505e779869d620471afed035
Instruction ID: ab331a59c0f7b6da72724869899c66218a158f7d6afaae21f27dd4f7a2236e07
Opcode Fuzzy Hash: 7ccf2c186cec699dfa9e19b335666aea46083c7a505e779869d620471afed035
Instruction Fuzzy Hash: 81210175A00258ABEB33DB55DC49EDE7BBDEB44740F0000A9F689E6045DAB5EB84CB60

Function 01003AC7 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 83stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 01003AFB
FindResourceA.KERNEL32(00000000,?,0000000A), ref: 01003B07
LoadResource.KERNEL32(00000000,00000000,00000000,?,?,?,?,?,PACKINSTSPACE,0100C498), ref: 01003B1C
LockResource.KERNEL32(00000000,?,?,?,?,?,PACKINSTSPACE,0100C498), ref: 01003B23
lstrlenA.KERNEL32(00000008,?,?,?,?,?,PACKINSTSPACE,0100C498), ref: 01003B3E
FreeResource.KERNEL32(00000000,?,?,?,?,?,PACKINSTSPACE,0100C498), ref: 01003B58
wsprintfA.USER32 ref: 01003B6D
FindResourceA.KERNEL32(00000000,?,0000000A), ref: 01003B7A
FreeResource.KERNEL32(00000000,?,?,?,?,?,PACKINSTSPACE,0100C498), ref: 01003B99

Strings

UPDFILE%lu, xrefs: 01003AEB, 01003B67

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Resource$FindFreewsprintf$LoadLocklstrlen
String ID: UPDFILE%lu
API String ID: 3821519360-2329316264
Opcode ID: 576a9d2a41689e10918246a17bc41e24b95d99357cd218a458b2db2c03cc483b
Instruction ID: c1f926839f5bccd6bd9dba539fb315616eac7d52b92b8f90cc2973ba09a331c2
Opcode Fuzzy Hash: 576a9d2a41689e10918246a17bc41e24b95d99357cd218a458b2db2c03cc483b
Instruction Fuzzy Hash: 39313E76A00609EFEB22DFA5D848EEEBBB9FB48705F004019F685E7140D77A9501CFA1

Function 01002410 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 124memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 0100256C

Part of subcall function 010022AC: CharUpperA.USER32(00009CF3,?,00000085,00000000), ref: 010022E0
Part of subcall function 010022AC: CharNextA.USER32(?), ref: 010022EF
Part of subcall function 010022AC: CharNextA.USER32(00000000), ref: 010022F2
Part of subcall function 010022AC: lstrcpyA.KERNEL32(?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 0100231F
Part of subcall function 010022AC: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,00000104,00000000), ref: 0100234D
Part of subcall function 010022AC: RegQueryValueExA.ADVAPI32(?,01001271,00000000,?,-00000004,?), ref: 01002377
Part of subcall function 010022AC: ExpandEnvironmentStringsA.KERNEL32(-00000004,?,00000104), ref: 01002393
Part of subcall function 010022AC: RegCloseKey.ADVAPI32(?), ref: 010023C8

GetFileVersionInfoSizeA.VERSION(00000001,?,00000001,?,?,0000054D,-00000004,?,?,00000104,?,?,?,?,?,?), ref: 01002470
GlobalAlloc.KERNEL32(00000042,00000000,0000003C,?,0000003C,?,?,00000001,?,00000001,?,?,0000054D,-00000004,?,?), ref: 01002483
GlobalLock.KERNEL32(00000000), ref: 01002495
GetFileVersionInfoA.VERSION(0000003C,?,?,00000000), ref: 010024AF
VerQueryValueA.VERSION(00000000,010012E8,0000003C,0000003C,0000003C,?,?,00000000), ref: 010024C6
GlobalUnlock.KERNEL32(00000000,0000003C,?,?,00000000), ref: 0100252D
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 0100257C

Strings

<, xrefs: 01002544

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Global$Char$FileInfoNextQueryUnlockValueVersion$AllocCloseEnvironmentExpandFreeLockOpenSizeStringsUpperlstrcpy
String ID: <
API String ID: 1180996843-4251816714
Opcode ID: 013660462c3fc53f77971edf0f57f43c85dba861e1b5c909512125e2574a6732
Instruction ID: 8ebd2fc49a21a31b7941948190e1fd36e6f894433b52bb8c886acf6eb3acf91b
Opcode Fuzzy Hash: 013660462c3fc53f77971edf0f57f43c85dba861e1b5c909512125e2574a6732
Instruction Fuzzy Hash: 7941737190020AEFEF12DF98C898AEDBBF9FF04305F104069EA85A2191D776DA45CF24

Function 01002589 Relevance: 15.1, APIs: 10, Instructions: 99stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(?,00000104,?,00000400), ref: 010025D0
IsDBCSLeadByte.KERNEL32(00000000,00000000), ref: 010025EA
CharNextA.USER32(00000400), ref: 01002608
CharUpperA.USER32(00000000), ref: 01002614
lstrlenA.KERNEL32(?,?), ref: 01002631
CharPrevA.USER32(?,?), ref: 01002642
CharUpperA.USER32(00000000), ref: 0100265A
lstrlenA.KERNEL32(?,?,00000000,00000400,?,?), ref: 01002682
CharNextA.USER32(?), ref: 0100268E
CharNextA.USER32(00000400), ref: 01002697

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Char$Next$Upperlstrlen$ByteFileLeadModuleNamePrev
String ID:
API String ID: 3967807161-0
Opcode ID: a820073371754dc5eeb8d23f47868028148f50acb9d5e774029aed37092d399e
Instruction ID: eaaee00f3e00e4901544a9c651e5066a5a093bae46e09448390e21310fb16754
Opcode Fuzzy Hash: a820073371754dc5eeb8d23f47868028148f50acb9d5e774029aed37092d399e
Instruction Fuzzy Hash: F9317A75804285AEEB739F68CC48BEABFEDAF1A300F140595E5C4D3281DB798981CF61

Function 01003D57 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 65windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,00000000), ref: 01003D8E
GetDesktopWindow.USER32 ref: 01003D9E
SetDlgItemTextA.USER32(?,00000834,?), ref: 01003DBB
SetWindowTextA.USER32(?,StretchWare), ref: 01003DC7
SetForegroundWindow.USER32(?), ref: 01003DCE
GetDlgItem.USER32(?,00000834), ref: 01003DDB
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 01003E08

Strings

StretchWare, xrefs: 01003DC1

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: ItemWindow$Text$DesktopDialogForegroundMessageSend
String ID: StretchWare
API String ID: 3995847246-859621192
Opcode ID: 514f40a5a9973e196b7822fc54060a0ee6dd35ba8ddd69d8be9c4b3aeee3cfc4
Instruction ID: 2a05d3dcf79b5e367ffb0c494342458d3375fcf2b230eec5ab74aad8adfe7076
Opcode Fuzzy Hash: 514f40a5a9973e196b7822fc54060a0ee6dd35ba8ddd69d8be9c4b3aeee3cfc4
Instruction Fuzzy Hash: 3F118F35104245AFFB336FA4EC0CFBA3AA8F745B11F00061AF9D5990C5CBB99591DB90

Function 010016B4 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 63librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,StretchWare,00000000,?,?,?,010017A0,?,00000000,?,?,0100561B,?,?,00000000), ref: 010016E6
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 010016FA
AllocateAndInitializeSid.ADVAPI32(010017A0,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 01001726
FreeSid.ADVAPI32(?), ref: 0100173A
FreeLibrary.KERNEL32(?,?,?,?,010017A0,?,00000000,?,?,0100561B,?,?,00000000), ref: 01001743

Strings

CheckTokenMembership, xrefs: 010016F4
StretchWare, xrefs: 010016C4
advapi32.dll, xrefs: 010016C8

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$StretchWare$advapi32.dll
API String ID: 4204503880-2885330206
Opcode ID: 80048a897bbb716bc6edda70627e0e87ab6d0b634674ff9098072ab894aeef90
Instruction ID: 7f32255cd53d54b6266d59a01a2c9f788efc2b6a55c7d064e1075484334130e5
Opcode Fuzzy Hash: 80048a897bbb716bc6edda70627e0e87ab6d0b634674ff9098072ab894aeef90
Instruction Fuzzy Hash: 63116072A00289AFDB12DFE9D888ADEBFB9FB14340F444059F285E3181C7759A00CB65

Function 01003346 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 65filestringCOMMON

Download Yara Rule

APIs

SetFileAttributesA.KERNEL32(004FC2A0,00000080,?,00000000), ref: 01003387
DeleteFileA.KERNEL32(004FC2A0,?,00000000), ref: 0100338F
LocalFree.KERNEL32(004FC2A0,?,00000000), ref: 0100339A
LocalFree.KERNEL32(004FC2A0,?,00000000), ref: 0100339D
lstrcpyA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 010033CE
SetCurrentDirectoryA.KERNEL32(01001344), ref: 010033EE

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 010033C2

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectorylstrcpy
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 2574644873-388467436
Opcode ID: 6ea3feb0ca6028cf83602c9698947175550dd0a338225f6cb2ccfdd8c559cc3d
Instruction ID: 3d978de08161bdf378add94dce6545b53e49bcfa393c6a6d5fd735a2b26ab47d
Opcode Fuzzy Hash: 6ea3feb0ca6028cf83602c9698947175550dd0a338225f6cb2ccfdd8c559cc3d
Instruction Fuzzy Hash: 0D21D535900215DFFB73EB68E949B9937F8BB04715F0541A5E2C09B284CFBA99C8CB50

Function 01002E55 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002E6B
SizeofResource.KERNEL32(00000000,00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E6F
FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002E8B
LoadResource.KERNEL32(00000000,00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E8F
LockResource.KERNEL32(00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E96
FreeResource.KERNEL32(00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002EBA

Strings

StretchWare, xrefs: 01002E5B

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeof
String ID: StretchWare
API String ID: 468261009-859621192
Opcode ID: 7090d6fbcbd5b277e53ff8aa31aa3d5f4a0baf2b3be01dcc482b1e99473e37a0
Instruction ID: c58e523c2e5cc4a020a6dc9083853665ab900ca59998c1429a4b95f367ba78fb
Opcode Fuzzy Hash: 7090d6fbcbd5b277e53ff8aa31aa3d5f4a0baf2b3be01dcc482b1e99473e37a0
Instruction Fuzzy Hash: 8F01F231300188BBEB239BA5EC88C7F7BAAEBC5761F144019FA85C3280C6768C01DB61

Function 01003E28 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

EndDialog.USER32(?,?), ref: 01003E65
GetDesktopWindow.USER32 ref: 01003E6F
SetWindowTextA.USER32(?,StretchWare), ref: 01003E85
SetDlgItemTextA.USER32(?,00000838), ref: 01003E97
SetForegroundWindow.USER32(?), ref: 01003E9E
EndDialog.USER32(?,00000002), ref: 01003EAB

Strings

StretchWare, xrefs: 01003E7F

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: StretchWare
API String ID: 852535152-859621192
Opcode ID: c58225de05bf9ddd7557f29e4dd6395625a24e078d1bf0613a1e21eb476cea98
Instruction ID: bbd0fe0418d4f9b27c80c161e9fa2716d7c3f6b950bf98ca077586a846113f40
Opcode Fuzzy Hash: c58225de05bf9ddd7557f29e4dd6395625a24e078d1bf0613a1e21eb476cea98
Instruction Fuzzy Hash: FF01BC31500195AFEB635BA8D808DAE7AA8FB09751F008610FAC2DA1C5CB79CE51CB90

Function 01002EFD Relevance: 12.0, APIs: 8, Instructions: 43stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000104,?,?,?,0100511C,?,00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?), ref: 01002F0D
lstrlenA.KERNEL32(?,?,?,?,0100511C,?,00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?), ref: 01002F14
lstrcpyA.KERNEL32(?,00000104,?,?,?,0100511C,?,00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?), ref: 01002F2A
lstrlenA.KERNEL32(?,?,?,?,0100511C,?,00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?), ref: 01002F31
lstrlenA.KERNEL32(?,?,?,?,0100511C,?,00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?), ref: 01002F3B
lstrlenA.KERNEL32(?,?,?,?,0100511C,?,00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?), ref: 01002F45
lstrlenA.KERNEL32(?,?,?,?,0100511C,?,00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?), ref: 01002F4C
lstrcatA.KERNEL32(?,?,?,?,?,0100511C,?,00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?), ref: 01002F57

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: lstrlen$lstrcatlstrcpy
String ID:
API String ID: 2414487701-0
Opcode ID: bec1684d548f7f7a66b2a209a78056a6def03e0851b026678931160fd0f5e77e
Instruction ID: 3391c5307bafe4b116acb0d74c5fe46b65c44dc66db5e5de76f5420f3b77b05f
Opcode Fuzzy Hash: bec1684d548f7f7a66b2a209a78056a6def03e0851b026678931160fd0f5e77e
Instruction Fuzzy Hash: BB01A73150829ABEE7139F65DC0CE7F3FE99F85294F044079F58482051CB75D4159BA1

Function 01002D83 Relevance: 10.6, APIs: 7, Instructions: 85COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 01002D9B
GetWindowRect.USER32(?,?), ref: 01002DB0
GetDC.USER32(?), ref: 01002DC4
GetDeviceCaps.GDI32(00000000,00000008), ref: 01002DD0
GetDeviceCaps.GDI32(?,0000000A), ref: 01002DDE
ReleaseDC.USER32(?,?), ref: 01002DED
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005), ref: 01002E43

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: e87303e51a87c1f3fcc5427d586fd06ff29c73153c48b8601ce90fe903ab1556
Instruction ID: 967cba225b93383e2e60847015f29d3632c184523d341bb7e68964bb8c44351d
Opcode Fuzzy Hash: e87303e51a87c1f3fcc5427d586fd06ff29c73153c48b8601ce90fe903ab1556
Instruction Fuzzy Hash: 6C215932A0010AAFDF12CFBDCD889EEBBBAEB88300F008125F945E7254D675ED058B50

Function 01004BC8 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 01002E55: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002E6B
Part of subcall function 01002E55: SizeofResource.KERNEL32(00000000,00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E6F
Part of subcall function 01002E55: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002E8B
Part of subcall function 01002E55: LoadResource.KERNEL32(00000000,00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E8F
Part of subcall function 01002E55: LockResource.KERNEL32(00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E96

LocalAlloc.KERNEL32(00000040,00000001,LICENSE,00000000,00000000,00000000,00000000,?,01006243), ref: 01004BE4
LocalFree.KERNEL32(00000000,000004B1,00000000,00000000,00000010,00000000,LICENSE,00000000,00000000,?,01006243), ref: 01004C31

Part of subcall function 01003EBE: MessageBoxA.USER32(?,?,StretchWare,00000000), ref: 01003F5B

Part of subcall function 01003AA1: GetLastError.KERNEL32(76244B00,01004684), ref: 01003AAA
Part of subcall function 01003AA1: GetLastError.KERNEL32 ref: 01003AB0

LocalFree.KERNEL32(?,01006243), ref: 01004C96

Strings

<None>, xrefs: 01004C43
LICENSE, xrefs: 01004BD1, 01004BD6, 01004C11

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Resource$Local$ErrorFindFreeLast$AllocLoadLockMessageSizeof
String ID: <None>$LICENSE
API String ID: 3899723493-383193767
Opcode ID: c73d55a50ddab375b18fca3a874db0a6e8ae128fa329b97c8ffd94b4549e4620
Instruction ID: 9697d7adc24e1ebcf24a66d17cc2c8ea39a979045a2e6bc1bc079e37bfc5c796
Opcode Fuzzy Hash: c73d55a50ddab375b18fca3a874db0a6e8ae128fa329b97c8ffd94b4549e4620
Instruction Fuzzy Hash: 1811B471240695BEF3735B22AD48D6B3AADE7C2B10F004159F6C5D50D8DBBA4801CB34

Function 010068B3 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71registryCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 010068FC
GetSystemMetrics.USER32(0000004A), ref: 01006933
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 01006959
RegQueryValueExA.ADVAPI32(?,01001271,00000000,?,?,0000000C,?), ref: 01006983
RegCloseKey.ADVAPI32(?), ref: 01006991

Part of subcall function 0100678F: CharNextA.USER32(010069AC,00000000,?,010069AC,?,00000000), ref: 010067CC

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 0100694F

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: cfd22d1cb8363d992addf5a965baf5ad3a7f3b3c896125044328321e3dcf038f
Instruction ID: 5c6acbc3d5fc57845e32ec3dff29f7de8e8621ecf2eb8ce39a92ab546f5c8395
Opcode Fuzzy Hash: cfd22d1cb8363d992addf5a965baf5ad3a7f3b3c896125044328321e3dcf038f
Instruction Fuzzy Hash: 34215E75A00328EFFF72CB54D948BDA77BDBB05315F0040EAE588A5085DB768A94CF12

Function 01001E53 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,00000000), ref: 01001E77

Part of subcall function 010066CF: lstrlenA.KERNEL32(00000104,0000002F,?,01003991,0100C89A,00000104,01001271), ref: 010066D9

WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 01001E9D
_lopen.KERNEL32(?,00000040), ref: 01001EAC
_llseek.KERNEL32(00000000,00000000,00000002), ref: 01001EBD
_lclose.KERNEL32(00000000), ref: 01001EC6

Strings

wininit.ini, xrefs: 01001E81

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopenlstrlen
String ID: wininit.ini
API String ID: 979776028-4206010578
Opcode ID: 37f4b3d508ecab28613d6a97bb6e1095e4a2a3c7db2d8278c91ef0a9ab821e8d
Instruction ID: 18cd7f1609499ba71430b944770d53967596a73aa7aa202a5c8f43e0c2a69e76
Opcode Fuzzy Hash: 37f4b3d508ecab28613d6a97bb6e1095e4a2a3c7db2d8278c91ef0a9ab821e8d
Instruction Fuzzy Hash: 9701D476A00154ABE721EB65DC4CEDF3BBC9F85310F040065F6C4E31C0DAB8DA858B60

Function 01004DE5 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 01002E55: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002E6B
Part of subcall function 01002E55: SizeofResource.KERNEL32(00000000,00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E6F
Part of subcall function 01002E55: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002E8B
Part of subcall function 01002E55: LoadResource.KERNEL32(00000000,00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E8F
Part of subcall function 01002E55: LockResource.KERNEL32(00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E96

LocalAlloc.KERNEL32(00000040,00000001,FINISHMSG,00000000,00000000,00000000,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,01006365), ref: 01004E05
LocalFree.KERNEL32(?,?,?,01006365), ref: 01004E63

Part of subcall function 01003EBE: MessageBoxA.USER32(?,?,StretchWare,00000000), ref: 01003F5B

Strings

FINISHMSG, xrefs: 01004DF2, 01004DF7, 01004E26
<None>, xrefs: 01004E3C
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 01004DEB

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Resource$FindLocal$AllocFreeLoadLockMessageSizeof
String ID: <None>$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$FINISHMSG
API String ID: 1166655539-87598203
Opcode ID: 945af8c2f13a4e2e23c29a060e4326b8cf96b2cec21a05c610d2a029f1db482c
Instruction ID: b86749c0676bc5709347cbb2394c06ae2176a12615ce74ff3a29be4193e97ba7
Opcode Fuzzy Hash: 945af8c2f13a4e2e23c29a060e4326b8cf96b2cec21a05c610d2a029f1db482c
Instruction Fuzzy Hash: 4E01BC712402C4BAF7236A539D49FAFBE7DDBC2F44F000059B780E50C1D6B58D009278

Function 01003BF2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 62filestringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 01003C2C

Part of subcall function 010066CF: lstrlenA.KERNEL32(00000104,0000002F,?,01003991,0100C89A,00000104,01001271), ref: 010066D9

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000104,?), ref: 01003C5A
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 01003C86
CloseHandle.KERNEL32(00000000), ref: 01003CAC

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 01003C0E

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: File$CloseCreateHandleWritelstrcpylstrlen
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 3630773104-388467436
Opcode ID: 71a52d343370c3aad0e8bea5e8c7a1ee89124c22f7d04e4a93e1b4e400077d81
Instruction ID: ed493f8371116e651799eec5aa4685a96e44dd350d2c3c94e76b10785d47f5b1
Opcode Fuzzy Hash: 71a52d343370c3aad0e8bea5e8c7a1ee89124c22f7d04e4a93e1b4e400077d81
Instruction Fuzzy Hash: 7D216F75900118ABD722CF56DC88EDA7BB8EB49320F004595F6C9D7180C7B99AC4CFA0

Function 01003CCC Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37librarystringCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,7622F530), ref: 01003CEF

Part of subcall function 010066CF: lstrlenA.KERNEL32(00000104,0000002F,?,01003991,0100C89A,00000104,01001271), ref: 010066D9

GetFileAttributesA.KERNEL32(?,?,00000104,?), ref: 01003D0E
LoadLibraryExA.KERNEL32(?,00000000,00000008), ref: 01003D28
LoadLibraryA.KERNEL32(?), ref: 01003D31

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 01003CE3

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: LibraryLoad$AttributesFilelstrcpylstrlen
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 2749481120-388467436
Opcode ID: efb49a3551e82d2aca852d6b8404bb15e5416ed9f694a26cd63d4ca69129f5e9
Instruction ID: f105a43693de67f3e081fcb7c5b90bd09891202ca5bc0fd204553d5dc91105a1
Opcode Fuzzy Hash: efb49a3551e82d2aca852d6b8404bb15e5416ed9f694a26cd63d4ca69129f5e9
Instruction Fuzzy Hash: B6F0A435904118ABEB22EBA4D808FDD377CAB14310F404481F6C5E71C0DFB8EA848B50

Function 010032FF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

Part of subcall function 01002E55: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002E6B
Part of subcall function 01002E55: SizeofResource.KERNEL32(00000000,00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E6F
Part of subcall function 01002E55: FindResourceA.KERNEL32(00000000,00000000,0000000A), ref: 01002E8B
Part of subcall function 01002E55: LoadResource.KERNEL32(00000000,00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E8F
Part of subcall function 01002E55: LockResource.KERNEL32(00000000,?,0100546E,TITLE,StretchWare,0000007F,?,00000000), ref: 01002E96

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 0100331B
LoadResource.KERNEL32(00000000,00000000), ref: 01003324
LockResource.KERNEL32(00000000), ref: 0100332B

Strings

CABINET, xrefs: 01003306, 0100330B, 01003313
<+, xrefs: 01003316

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Resource$Find$LoadLock$Sizeof
String ID: <+$CABINET
API String ID: 1933721802-794146689
Opcode ID: 1692d02a55cbc160416827321246fe4b7eec14d249b88bc8613a2a7260353126
Instruction ID: cc1630d2f2e1415729ed085009dd32ef9f31af51343d2801e4429469f1343b9d
Opcode Fuzzy Hash: 1692d02a55cbc160416827321246fe4b7eec14d249b88bc8613a2a7260353126
Instruction Fuzzy Hash: 89E08675B417506BF33267B16C1DF873E5C9B05711F040015F386DA1C4C6F98400C751

Function 01001A5B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,01003418,?,?,01003418), ref: 01001A7F
RegDeleteValueA.ADVAPI32(01003418,wextract_cleanup0,?,?,01003418), ref: 01001A91
RegCloseKey.ADVAPI32(01003418,?,?,01003418), ref: 01001A9A

Strings

wextract_cleanup0, xrefs: 01001A61, 01001A89
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 01001A75

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 849931509-702805525
Opcode ID: cd9d913e4fd79f3a06ae71b19d601bebc7f3385b073269ceb231d1a8de7b8e18
Instruction ID: 08e6132b78a4405aeda3fa779f53dc0e2de51a409a2e6c94243458a35d58a82b
Opcode Fuzzy Hash: cd9d913e4fd79f3a06ae71b19d601bebc7f3385b073269ceb231d1a8de7b8e18
Instruction Fuzzy Hash: F8E01A34A40248BBF733DB92DD0AF5A7AA9AB04784F500058B281A0095D7B5D901D714

Function 0100189D Relevance: 7.5, APIs: 5, Instructions: 48windowCOMMON

Download Yara Rule

APIs

EndDialog.USER32(?,0000083E), ref: 010018DB
GetDesktopWindow.USER32 ref: 010018E3
LoadStringA.USER32(?,?,00000200,?), ref: 0100190C
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 0100191F
MessageBeep.USER32(000000FF), ref: 01001927

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 1fe746244ab481732cb78edc130a925beaacb107ba713200566c6f0ccbcc287c
Instruction ID: 55a0027b7669814cd1c96741612cb7e7f9a1a0a3dd5ed6c48cccf5beb83447b2
Opcode Fuzzy Hash: 1fe746244ab481732cb78edc130a925beaacb107ba713200566c6f0ccbcc287c
Instruction Fuzzy Hash: 8101217150025AEFEB23EF64D908AEE3BA8FB08311F044150F6A5D21C5CB79DB60CBA5

Function 01006666 Relevance: 7.5, APIs: 5, Instructions: 46stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0100262A,?,00000000,76230440,?,?,0100262A), ref: 01006677
CharPrevA.USER32(0100262A,00000000,?,?,0100262A), ref: 01006687
CharPrevA.USER32(0100262A,00000000,?,?,0100262A), ref: 01006693
CharPrevA.USER32(0100262A,00000000,?,?,0100262A), ref: 010066A6
CharNextA.USER32(00000000,?,?,0100262A), ref: 010066AE

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Char$Prev$Nextlstrlen
String ID:
API String ID: 295585802-0
Opcode ID: 915a4317a53b45c8286c77a7661bcefff6abe53e7f04113f2cfc660fb61b7cd7
Instruction ID: e6858c63049694c3117230d93b982ded723c412c4e62408bc78f3259928df5ea
Opcode Fuzzy Hash: 915a4317a53b45c8286c77a7661bcefff6abe53e7f04113f2cfc660fb61b7cd7
Instruction Fuzzy Hash: E8F0D1B2900284BFF7228B69CC88F5F7FEDDB893A4F140095E58193182C77A99108B75

Function 0100409F Relevance: 6.3, APIs: 5, Instructions: 55memorystringCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,?,?,01005168,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?), ref: 010040B1
lstrlenA.KERNEL32(01005168,?,00000000,?,?,01005168,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?), ref: 010040D5
LocalAlloc.KERNEL32(00000040,00000001,?,00000000,?,?,01005168,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?), ref: 010040DF
LocalFree.KERNEL32(00000000,000004B5,00000000,00000000,00000010,00000000,?,00000000,?,?,01005168,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?), ref: 010040FD

Part of subcall function 01003EBE: MessageBoxA.USER32(?,?,StretchWare,00000000), ref: 01003F5B

lstrcpyA.KERNEL32(00000000,01005168,?,00000000,?,?,01005168,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?), ref: 0100410B

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Local$Alloc$FreeMessagelstrcpylstrlen
String ID:
API String ID: 3247521446-0
Opcode ID: c08762a5925630561dce2ba68a971d21afc39e1fb6e013559b2dd62ac13e195b
Instruction ID: 484c8a38b1ca8798ae1f4b11a91829ed48787486965810eb3b8ebf67eea7932b
Opcode Fuzzy Hash: c08762a5925630561dce2ba68a971d21afc39e1fb6e013559b2dd62ac13e195b
Instruction Fuzzy Hash: 860188B52402087FF3239F65AC85FABBA5DE754794F008025F7C5D60C4D7B69C504764

Function 01002C91 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000FF), ref: 01002CB7
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 01002CC9
DispatchMessageA.USER32(?), ref: 01002CDE
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 01002CEC

Memory Dump Source

Source File: 00000000.00000002.3342902294.0000000001001000.00000020.00000001.01000000.00000003.sdmp, Offset: 01000000, based on PE: true

Associated: 00000000.00000002.3342877939.0000000001000000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342928995.000000000100B000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.3342957253.000000000100D000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1000000_StretchInstall.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: ecb5dbb63d15ec62f86b3f7d67ae0d9b5a0ddad4c8e295c16c05b27f8062ba49
Instruction ID: 39c073168b69b8e79244012e034678836bc036e0dc16367505055d994280760c
Opcode Fuzzy Hash: ecb5dbb63d15ec62f86b3f7d67ae0d9b5a0ddad4c8e295c16c05b27f8062ba49
Instruction Fuzzy Hash: 2301447290011DBAAF318BDA9D48DEF7AFCEAC5754F14016AFA51E2084D535D905C770

Analysis Process: setup.exePID: 5788, Parent PID: 884COMMON

Execution Graph

Execution Coverage:	8.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.2%
Total number of Nodes:	1964
Total number of Limit Nodes:	10

Executed Functions

Function 00D4509A Relevance: 91.7, APIs: 33, Strings: 18, Instructions: 2447windowmemoryshutdownCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00D450A4
HeapSetInformation.KERNEL32(00000000,00000001,00000000,00000000,00000904), ref: 00D450BC

Part of subcall function 00D3F627: __EH_prolog3.LIBCMT ref: 00D3F62E

CoInitialize.OLE32(00000000), ref: 00D45212

Part of subcall function 00D41A4B: __EH_prolog3_GS.LIBCMT ref: 00D41A52

Part of subcall function 00D44509: __EH_prolog3_GS.LIBCMT ref: 00D44513

CloseHandle.KERNEL32(000002D0), ref: 00D4525A

Part of subcall function 00D4C83E: __EH_prolog3_GS.LIBCMT ref: 00D4C845

CoUninitialize.OLE32 ref: 00D45263
FreeLibrary.KERNEL32(?), ref: 00D4529D
MessageBoxW.USER32(00000000,?,?,00000044), ref: 00D454AD
ExitWindowsEx.USER32(00000002,00000000), ref: 00D454BB
CloseHandle.KERNEL32(000002D0), ref: 00D454D0
CoUninitialize.OLE32 ref: 00D454D9
FreeLibrary.KERNEL32(?), ref: 00D45520
MessageBoxW.USER32(00000000,?,?,00000044), ref: 00D4561A

Part of subcall function 00D492CA: SetWindowTextW.USER32(?,?), ref: 00D492FE
Part of subcall function 00D492CA: SetDlgItemTextW.USER32(?,0000040F,?), ref: 00D49318
Part of subcall function 00D492CA: SetForegroundWindow.USER32(?), ref: 00D49321
Part of subcall function 00D492CA: ShowWindow.USER32(?,00000005,?,?,?,?), ref: 00D4932C
Part of subcall function 00D492CA: LoadCursorW.USER32(00000000,00007F02), ref: 00D49339
Part of subcall function 00D492CA: SetCursor.USER32(00000000,?,?,?,?), ref: 00D49340

Part of subcall function 00D419C8: __EH_prolog3_GS.LIBCMT ref: 00D419CF

Part of subcall function 00D43ED6: __EH_prolog3_GS.LIBCMT ref: 00D43EE0

Part of subcall function 00D43728: __EH_prolog3_GS.LIBCMT ref: 00D4372F
Part of subcall function 00D43728: __CxxThrowException@8.LIBCMT ref: 00D4377A

CloseHandle.KERNEL32(000002D0,00000001), ref: 00D45CD2
CoUninitialize.OLE32(00000001), ref: 00D45D01
FreeLibrary.KERNEL32(?), ref: 00D45D50

Part of subcall function 00D2AA24: _memmove.LIBCMT ref: 00D2AA49

Part of subcall function 00D3F58E: __EH_prolog3.LIBCMT ref: 00D3F595

Strings

There is a reboot pending, xrefs: 00D45454
Package failed with message "%s", xrefs: 00D45BFF
Application targets %s platform, installed on %s, xrefs: 00D47716
Application, xrefs: 00D45727
afterreboot.cfg, xrefs: 00D45940, 00D473B4
install.log, xrefs: 00D4539D
Download of Application file failed with result %d, xrefs: 00D477DE
Launching Application., xrefs: 00D4788D
User has cancelled install, xrefs: 00D47004
Downloading files to "%s", xrefs: 00D46193
-afterreboot="%s" %s, xrefs: 00D46B90
Copying files to temporary directory "%s", xrefs: 00D4613F
.msi, xrefs: 00D475AF
Resuming after a reboot. Original Application location: '%s', xrefs: 00D453F6
riched20.dll, xrefs: 00D451A6
:, xrefs: 00D4787B
A prerequisite failed for Package "%s", xrefs: 00D45BD4
Intel, xrefs: 00D47611

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_$CloseFreeHandleLibraryUninitializeWindow$CursorH_prolog3MessageText$Exception@8ExitForegroundH_prolog3_catch_HeapInformationInitializeItemLoadShowThrowWindows_memmove
String ID: -afterreboot="%s" %s$.msi$:$A prerequisite failed for Package "%s"$Application$Application targets %s platform, installed on %s$Copying files to temporary directory "%s"$Download of Application file failed with result %d$Downloading files to "%s"$Intel$Launching Application.$Package failed with message "%s"$Resuming after a reboot. Original Application location: '%s'$There is a reboot pending$User has cancelled install$afterreboot.cfg$install.log$riched20.dll
API String ID: 337884292-3509691487
Opcode ID: d32f78b7b683d6c8be754539b128d779f74d8ee987cd41a18856e37d3c5aa411
Instruction ID: 53f38e2c934b8f1627710ff4e29e62e8e6021e7214fe7b1f25f6e930ccbadff5
Opcode Fuzzy Hash: d32f78b7b683d6c8be754539b128d779f74d8ee987cd41a18856e37d3c5aa411
Instruction Fuzzy Hash: 07231A71800228ABDB65EB54DC85EEEB7B8EF25304F4041DAE54AA2191EF305F89CF71

Function 00D2B0F4 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 94
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D49FAB: _memset.LIBCMT ref: 00D49FD6
Part of subcall function 00D49FAB: GetVersionExW.KERNEL32(?,?,?), ref: 00D49FEF

_memset.LIBCMT ref: 00D2B128
ShellExecuteExW.SHELL32(?), ref: 00D2B1BB
GetLastError.KERNEL32(?,?,?,?,?,?,00000000,?,00000008), ref: 00D2B1C5
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00D2B1F0
CloseHandle.KERNEL32(00000000), ref: 00D2B1F9

Strings

Running command '%s' with arguments '%s', xrefs: 00D2B1A4
runas, xrefs: 00D2B18B
Will attempt to elevate process., xrefs: 00D2B173
ShellExecuteEx failed with error code %d, xrefs: 00D2B1CE

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: _memset$CloseErrorExecuteHandleLastObjectShellSingleVersionWait
String ID: Running command '%s' with arguments '%s'$ShellExecuteEx failed with error code %d$Will attempt to elevate process.$runas
API String ID: 2595187793-1521493396
Opcode ID: 88687dfe12d4db6680ac8082a42f143fb5c78a7a4f8c231c7ba3f188fae87d4b
Instruction ID: 1906e0b34f61f210558c83b6caf48e79bd8828908c92d04d4809ee45521a2d6f
Opcode Fuzzy Hash: 88687dfe12d4db6680ac8082a42f143fb5c78a7a4f8c231c7ba3f188fae87d4b
Instruction Fuzzy Hash: 5C31A275900328EFCB11DF98EC49A8DBBB5FF24329F10442AF555E6290D7B099A4CB71

Function 00D2B669 Relevance: 53.1, APIs: 8, Strings: 22, Instructions: 560
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00D2B673
__CxxThrowException@8.LIBCMT ref: 00D2B73A

Part of subcall function 00D2AA24: _memmove.LIBCMT ref: 00D2AA49

Part of subcall function 00D2AD06: __EH_prolog3_GS.LIBCMT ref: 00D2AD0D

FreeLibrary.KERNEL32(00000000), ref: 00D2BAAE

Strings

iexplore.exe, xrefs: 00D2BC96
Microsoft Shared\VSTO, xrefs: 00D2B9AB
Application appears to be a VSTO manifest, xrefs: 00D2B944
Installing VSTO solution via vstoee, xrefs: 00D2BA31
Application appears to be a WPF Browser Application, xrefs: 00D2BAE2
.application, xrefs: 00D2B8C7
.vsto, xrefs: 00D2B901, 00D2B929
msiexec.exe, xrefs: 00D2B789
InstallSolution failed with HRESULT '%d', xrefs: 00D2BA9A
-I "%s" %s, xrefs: 00D2B7FA
LaunchApplication failed with HRESULT '%d', xrefs: 00D2BC37
CommonFilesFolder, xrefs: 00D2B973
"%s", xrefs: 00D2BC86
"%s", xrefs: 00D2BB1E
dfshim.dll, xrefs: 00D2BBBB
.msi, xrefs: 00D2B6DE
Launching application manifest via dfshim, xrefs: 00D2BBF0
LaunchApplication, xrefs: 00D2BBD4
.xbap, xrefs: 00D2B8E4, 00D2BAC7
Application appears to be an application manifest, xrefs: 00D2BB9A
InstallSolution, xrefs: 00D2BA11
vstoee.dll, xrefs: 00D2B9D8, 00D2B9FC

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_$Exception@8FreeLibraryThrow_memmove
String ID: "%s"$ -I "%s" %s$"%s"$.application$.msi$.vsto$.xbap$Application appears to be a VSTO manifest$Application appears to be a WPF Browser Application$Application appears to be an application manifest$CommonFilesFolder$InstallSolution$InstallSolution failed with HRESULT '%d'$Installing VSTO solution via vstoee$LaunchApplication$LaunchApplication failed with HRESULT '%d'$Launching application manifest via dfshim$Microsoft Shared\VSTO$dfshim.dll$iexplore.exe$msiexec.exe$vstoee.dll
API String ID: 2841979529-2877636624
Opcode ID: adb103dffb0175afc5cceda4b7627b4e37fa12bf69de8dc1f12b518ae7666886
Instruction ID: f41289f8790f1a8c64e07d105b2b4d0398b0dc4815f5f79cd9326d8077610b8f
Opcode Fuzzy Hash: adb103dffb0175afc5cceda4b7627b4e37fa12bf69de8dc1f12b518ae7666886
Instruction Fuzzy Hash: 88227074D00368AFCF10DBA8ED85BDEBBB8EF65318F14405AE545A7141DBB05A88CB71

Function 00D3E406 Relevance: 35.4, APIs: 1, Strings: 19, Instructions: 406
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00D3E410

Part of subcall function 00D4D303: GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00D4D33B
Part of subcall function 00D4D303: GetNativeSystemInfo.KERNEL32(?), ref: 00D4D349
Part of subcall function 00D4D303: FreeLibrary.KERNEL32(00000000), ref: 00D4D34E
Part of subcall function 00D4D303: GetSystemInfo.KERNEL32(?), ref: 00D4D35C

Strings

AMD64, xrefs: 00D3E467
ProcessorArchitecture, xrefs: 00D3E4A0
Version9x, xrefs: 00D3E5F4
IA64, xrefs: 00D3E46E
InstallMode, xrefs: 00D3E7A8, 00D3E808, 00D3E85D
%d.%d.%d, xrefs: 00D3E58D
AdminUser, xrefs: 00D3E6EB
SpecificSite, xrefs: 00D3E7F9
Property: [%s] = , xrefs: 00D3E938
The following properties have been set:, xrefs: 00D3E908
HomeSite, xrefs: 00D3E799
Unknown, xrefs: 00D3E460
%d.%d, xrefs: 00D3E5CD
SameSite, xrefs: 00D3E84E
PPC, xrefs: 00D3E475
Alpha, xrefs: 00D3E47C
VersionNT, xrefs: 00D3E63C
Mips, xrefs: 00D3E483
Intel, xrefs: 00D3E48A, 00D3E48F

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: InfoSystem$AddressFreeH_prolog3_LibraryNativeProc
String ID: %d.%d$%d.%d.%d$AMD64$AdminUser$Alpha$HomeSite$IA64$InstallMode$Intel$Mips$PPC$ProcessorArchitecture$Property: [%s] = $SameSite$SpecificSite$The following properties have been set:$Unknown$Version9x$VersionNT
API String ID: 1816300761-3446401881
Opcode ID: c643385a21c2adb0df1252448f22d50e99a62174c469187f131039ccd1a5ae6d
Instruction ID: 013cd74b3b8034db6c61d8527660660fb758a9b44404ff2539111cd310cdea3e
Opcode Fuzzy Hash: c643385a21c2adb0df1252448f22d50e99a62174c469187f131039ccd1a5ae6d
Instruction Fuzzy Hash: 8DF12670C1026CAECB11EBE4D991BEDBBB5FF24304F54409AE015A7292DBB05A49DF72

Function 00D2AEA6 Relevance: 35.3, APIs: 9, Strings: 11, Instructions: 289
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00D2AEAD
GetProcAddress.KERNEL32(00000000,CertCompareCertificate), ref: 00D2AF64
GetProcAddress.KERNEL32(?,CertFreeCertificateContext), ref: 00D2AF72
FreeLibrary.KERNEL32(?), ref: 00D2B059

Part of subcall function 00D2A9C9: WriteFile.KERNEL32(?,?,?,00000000,00000000), ref: 00D2AA09

FreeLibrary.KERNEL32(?), ref: 00D2B08E
__CxxThrowException@8.LIBCMT ref: 00D2B0E9
_memset.LIBCMT ref: 00D2B128
ShellExecuteExW.SHELL32(?), ref: 00D2B1BB

Part of subcall function 00D4D524: _memset.LIBCMT ref: 00D4D589

Strings

Running command '%s' with arguments '%s', xrefs: 00D2B1A4
crypt32.dll, xrefs: 00D2AF15, 00D2AF1A, 00D2AF2E, 00D2B071
Wintrust not found on machine, xrefs: 00D2AFAA
Unable to find functions '%s' and '%s' in '%s', xrefs: 00D2B078
runas, xrefs: 00D2B18B
Will attempt to elevate process., xrefs: 00D2B173
CertCompareCertificate, xrefs: 00D2AF5D, 00D2AF62, 00D2B077
CertFreeCertificateContext, xrefs: 00D2AF66, 00D2AF6B, 00D2B076
ShellExecuteEx failed with error code %d, xrefs: 00D2B1CE
Unable to find local path for '%s' at '%s', xrefs: 00D2B0B2
Unable to load Crypto dll '%s', xrefs: 00D2AF2F

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: AddressFreeLibraryProc_memset$Exception@8ExecuteFileH_prolog3_ShellThrowWrite
String ID: CertCompareCertificate$CertFreeCertificateContext$Running command '%s' with arguments '%s'$ShellExecuteEx failed with error code %d$Unable to find functions '%s' and '%s' in '%s'$Unable to find local path for '%s' at '%s'$Unable to load Crypto dll '%s'$Will attempt to elevate process.$Wintrust not found on machine$crypt32.dll$runas
API String ID: 2146536375-805390676
Opcode ID: dd500de75ce281b151c79d910dcd3a15d0d730a19d26ede82307de6ed73350cb
Instruction ID: 50ec8de4bb3088214a6f866dd855c38d54a0c316a02e3cb8aced54286ad973d9
Opcode Fuzzy Hash: dd500de75ce281b151c79d910dcd3a15d0d730a19d26ede82307de6ed73350cb
Instruction Fuzzy Hash: 56A1CF71D00228EBCF21DFA8EC45A9EBBB5FF24718F14842AF505A7241D7B19984CBB1

Function 00D394D4 Relevance: 28.5, APIs: 14, Strings: 2, Instructions: 508
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateCompatibleDC.GDI32(00000000), ref: 00D39553

Strings

msctls_trackbar32, xrefs: 00D39991
@, xrefs: 00D3973C

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: CompatibleCreate
String ID: @$msctls_trackbar32
API String ID: 3111197059-876234929
Opcode ID: 7865519057143df84dd724dfc8b4b483e1ca6a43d091bd7ee3e902d6beec9b92
Instruction ID: 442f31ea0f007255f5e6b23e8309834fa4bbb2e4fb7bf09bf88f0421f1d04a9d
Opcode Fuzzy Hash: 7865519057143df84dd724dfc8b4b483e1ca6a43d091bd7ee3e902d6beec9b92
Instruction Fuzzy Hash: 8E321575D00228CFDB20CF69C991BADF7B1BF49314F2842AAD449A7292D7749E81CF20

Function 00D4B78E Relevance: 28.2, APIs: 8, Strings: 8, Instructions: 240
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00D4B798
RegOpenKeyExW.KERNEL32(80000002,?,00000000,00020019,?,HKLM,?,00000001), ref: 00D4B912
RegQueryValueExW.KERNEL32(?,?,00000000,?,00000000,?), ref: 00D4B943
RegQueryValueExW.ADVAPI32(?,?,00000000,00000004,?,?), ref: 00D4B983
RegCloseKey.KERNEL32(?), ref: 00D4B99F
RegQueryValueExW.KERNEL32(?,?,00000000,00000001,?,?,?,00000000), ref: 00D4BA04
ExpandEnvironmentStringsW.KERNEL32(?,00000000,00000000), ref: 00D4BA35
ExpandEnvironmentStringsW.KERNEL32(?,?,?,00000000,?), ref: 00D4BA80

Strings

HKEY_CLASSES_ROOT, xrefs: 00D4B889
HKEY_CURRENT_USER, xrefs: 00D4B867
HKLM, xrefs: 00D4B828
HKCR, xrefs: 00D4B878
HKEY_LOCAL_MACHINE, xrefs: 00D4B841
HKCU, xrefs: 00D4B856
HKEY_USERS, xrefs: 00D4B8AB
HKU, xrefs: 00D4B89A

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: QueryValue$EnvironmentExpandStrings$CloseH_prolog3_catch_Open
String ID: HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 342522750-1642377470
Opcode ID: 73a3ec0d7f457e242c27e6be392fbde62e3de4743fa2060fb1af922cd87911bf
Instruction ID: 047b66a80b5006bb0f75f071ab97971cf28077b5577e33010e1f5903a3ad6277
Opcode Fuzzy Hash: 73a3ec0d7f457e242c27e6be392fbde62e3de4743fa2060fb1af922cd87911bf
Instruction Fuzzy Hash: 98913A70900218AFDB20EBA4DD91BEDB779FF20318F54406AE549A3152EB719E89CF31

Function 00D49034 Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00D4903E
SystemParametersInfoW.USER32(00000029,000001F4,?,00000000), ref: 00D490A1
FindResourceW.KERNEL32(?,?,00000005,Fonts,?,?), ref: 00D4919A
LoadResource.KERNEL32(?,00000000,?,?), ref: 00D491AA
LockResource.KERNEL32(00000000,?,?), ref: 00D491B5
SizeofResource.KERNEL32(?,00000000,00000000,?,?,?,?), ref: 00D491D0
CreateDialogIndirectParamW.USER32(?,?,?,?,?), ref: 00D491FB
CreateDialogParamW.USER32(?,?,?,?,?), ref: 00D4922C
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00D49282
SetForegroundWindow.USER32(?), ref: 00D4928B

Strings

BaseFont, xrefs: 00D49129
Name, xrefs: 00D49117
Fonts, xrefs: 00D490B7
Font, xrefs: 00D490E4
BoldFont, xrefs: 00D4913F

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Resource$CreateDialogParamWindow$FindForegroundH_prolog3_IndirectInfoLoadLockMoveParametersSizeofSystem
String ID: BaseFont$BoldFont$Font$Fonts$Name
API String ID: 1124334105-2070303938
Opcode ID: 25f2a8f97d7752a891cefb79c0ecd265c132e83508668db0f2748f856e32a406
Instruction ID: f7a753b2230352e61e2759c48d11ef5e2cfcb84243d4c2c07031ac97913a49a3
Opcode Fuzzy Hash: 25f2a8f97d7752a891cefb79c0ecd265c132e83508668db0f2748f856e32a406
Instruction Fuzzy Hash: 0E615F71900715EFCB209FA5DD89AAEBBB5FF18300F1484A9F54AA2661D7319E94CF30

Function 00D49486 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D2B217: std::_Xinvalid_argument.LIBCPMT ref: 00D2B233

Part of subcall function 00D2B217: _memmove.LIBCMT ref: 00D2B28E

Part of subcall function 00D49034: __EH_prolog3_GS.LIBCMT ref: 00D4903E
Part of subcall function 00D49034: SystemParametersInfoW.USER32(00000029,000001F4,?,00000000), ref: 00D490A1
Part of subcall function 00D49034: FindResourceW.KERNEL32(?,?,00000005,Fonts,?,?), ref: 00D4919A
Part of subcall function 00D49034: LoadResource.KERNEL32(?,00000000,?,?), ref: 00D491AA
Part of subcall function 00D49034: LockResource.KERNEL32(00000000,?,?), ref: 00D491B5
Part of subcall function 00D49034: SizeofResource.KERNEL32(?,00000000,00000000,?,?,?,?), ref: 00D491D0
Part of subcall function 00D49034: CreateDialogIndirectParamW.USER32(?,?,?,?,?), ref: 00D491FB

GetDlgItem.USER32(?,0000040B), ref: 00D49520
GetWindowRect.USER32(00000000), ref: 00D4952D
GetWindowRect.USER32(?,?), ref: 00D49536

Part of subcall function 00D47DB3: SendDlgItemMessageW.USER32(?,?,00000030,?,?), ref: 00D47DD9

SetWindowTextW.USER32(00000429,?), ref: 00D4959F
SetDlgItemTextW.USER32(00000429,00000410,?), ref: 00D495B9
GetDlgItem.USER32(00000429,00000069), ref: 00D495C4
ShowWindow.USER32(00000000), ref: 00D495D1
GetDlgItem.USER32(00000429,000003F0), ref: 00D495DD
ShowWindow.USER32(00000000), ref: 00D495E4
ShowWindow.USER32(00000429,00000000), ref: 00D495EA

Strings

h, xrefs: 00D4955B
f, xrefs: 00D49551

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Window$Item$Resource$Show$RectText$CreateDialogFindH_prolog3_IndirectInfoLoadLockMessageParamParametersSendSizeofSystemXinvalid_argument_memmovestd::_
String ID: f$h
API String ID: 2112275004-26895948
Opcode ID: 7754da234c347768cff165ce7cd10db9095ec546f9c11dc38f0b7dfea5682707
Instruction ID: fcaad86a41ff76d848f5098872a9a02efbf2bc625986bebfc35e9eb52c118adf
Opcode Fuzzy Hash: 7754da234c347768cff165ce7cd10db9095ec546f9c11dc38f0b7dfea5682707
Instruction Fuzzy Hash: F14127B0900208EFDB20DF9ADC89E9EBBB9FF58310F10451AF515A62A0CB71A955CB74

Function 00D40227 Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 261
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00D40231

Part of subcall function 00D40068: __EH_prolog3_GS.LIBCMT ref: 00D4006F

Strings

Not setting value for property '%s', xrefs: 00D403AC
Setting value ', xrefs: 00D402E4
' for property '%s', xrefs: 00D4030A
'%s' RunCheck result: , xrefs: 00D4054B
Running checks for package '%s', phase , xrefs: 00D40244
The following properties have been set for package '%s':, xrefs: 00D4040B
Property: [%s] = , xrefs: 00D40437

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_
String ID: ' for property '%s'$'%s' RunCheck result: $Not setting value for property '%s'$Property: [%s] = $Running checks for package '%s', phase $Setting value '$The following properties have been set for package '%s':
API String ID: 2427045233-2478332948
Opcode ID: 32b5ffb707c3dcd69f44f526437d6ea6b326300439c78dc5c21ff6402f086538
Instruction ID: 2625b8a9f38fc0dc62fc89fb10be843548be09065fc0f7c3fce9f1e901baebba
Opcode Fuzzy Hash: 32b5ffb707c3dcd69f44f526437d6ea6b326300439c78dc5c21ff6402f086538
Instruction Fuzzy Hash: C7B11571900218DFCB14DFA8D881BDEBBB5FF58304F50816AE55AE7291DB30AA85CB74

Function 00D30FDB Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00D30FE5

Part of subcall function 00D2B217: std::_Xinvalid_argument.LIBCPMT ref: 00D2B233

Part of subcall function 00D2B217: _memmove.LIBCMT ref: 00D2B28E

Strings

true, xrefs: 00D310E0, 00D31108, 00D31120, 00D31154
Skipping %s because Property '%s' was not defined, xrefs: 00D31068
Result of running operator '%s' on property '%s' and value '%s': %s, xrefs: 00D31158
ByPassIf, xrefs: 00D3104A, 00D31067
Result of running operator '%s' on property '%s': %s, xrefs: 00D3110B
FailIf, xrefs: 00D31053
false, xrefs: 00D310E9, 00D31129

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_Xinvalid_argument_memmovestd::_
String ID: ByPassIf$FailIf$Result of running operator '%s' on property '%s' and value '%s': %s$Result of running operator '%s' on property '%s': %s$Skipping %s because Property '%s' was not defined$false$true
API String ID: 874089573-871101263
Opcode ID: 6a195252ddaab257cef901c4d5c53a6b6f3a2356097b899cd210162c5470f0d4
Instruction ID: 28532dc4e7ee5250c57887e7edd92282f0a29ebcda956cd242feb15a17d8d8fe
Opcode Fuzzy Hash: 6a195252ddaab257cef901c4d5c53a6b6f3a2356097b899cd210162c5470f0d4
Instruction Fuzzy Hash: 90619BB4900359AFCB24DF98D8809EEBBB4FF65304F548069E559A7251DA309E89CB30

Function 00D2B4D5 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 00D2B519
#92.MSI(?,00000000,?), ref: 00D2B54C
#78.MSI(?,00000000,00000000,?,?,00000000,?), ref: 00D2B564
#150.MSI(?,00000007,0000001E,00000000,00000000,?,00000040,?,00000000,00000000,?,?,00000000,?), ref: 00D2B58C
_wcschr.LIBCMT ref: 00D2B5A8
#8.MSI(?,?,00000000,?), ref: 00D2B5C6
#8.MSI(?,?,00000000,?), ref: 00D2B5D9

Strings

@, xrefs: 00D2B535

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: #150_memset_wcschr
String ID: @
API String ID: 605335943-2766056989
Opcode ID: f7992ef131ce89b998dc07e78e607e4c44ad49d415fc5c78e19b393c9cfa5a9c
Instruction ID: 3238e5b0b66544556397b3367f057bb2f85a7a08361976f63e769824d365bc7f
Opcode Fuzzy Hash: f7992ef131ce89b998dc07e78e607e4c44ad49d415fc5c78e19b393c9cfa5a9c
Instruction Fuzzy Hash: 10314D71900128ABDB20DB65DC41F9AB7B8FF44714F4081EAF54CE6156EB709E888F30

Function 00D3D863 Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 83
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00D3D86A

Strings

%s {string}, xrefs: 00D3D920
true, xrefs: 00D3D8F6
%s {boolean}, xrefs: 00D3D903
%d {int}, xrefs: 00D3D90D
%s {version}, xrefs: 00D3D8D8
{empty}, xrefs: 00D3D89A
false, xrefs: 00D3D8FD, 00D3D902

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_
String ID: %d {int}$%s {boolean}$%s {string}$%s {version}$false$true${empty}
API String ID: 2427045233-4233488036
Opcode ID: 74de02cecdf8289fd32869c4139df781ef41b8042527275a86b837ed71c199d8
Instruction ID: b9a71c668578d42112e7695383eee2bc9f464b7fb9bb90754f6327db79884281
Opcode Fuzzy Hash: 74de02cecdf8289fd32869c4139df781ef41b8042527275a86b837ed71c199d8
Instruction Fuzzy Hash: D8216071D052189FCB04EFA8F881EEDB7B5EF28304F54402AF145A7192DA709A49CF75

Function 00D393C7 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 56
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDC.USER32(00000000), ref: 00D393DE
SelectObject.GDI32(00000000), ref: 00D393F3
GetTextMetricsW.GDI32(?,?), ref: 00D393FF
GetTextExtentPoint32W.GDI32(?,ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz,00000034,?), ref: 00D39413
SelectObject.GDI32(?,?), ref: 00D39432
GetDialogBaseUnits.USER32 ref: 00D39436
ReleaseDC.USER32(00000000,?), ref: 00D3944B

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz, xrefs: 00D3940B

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: ObjectSelectText$BaseDialogExtentMetricsPoint32ReleaseUnits
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
API String ID: 1972319055-222967699
Opcode ID: 9fdb0660e642fda4ed6efe65dc790a0e073f76402dfdaa2bffd6fdbd8113d974
Instruction ID: 4acf0850330a6526f97d83b613decf1735d528e62890f3c77fdf864185626005
Opcode Fuzzy Hash: 9fdb0660e642fda4ed6efe65dc790a0e073f76402dfdaa2bffd6fdbd8113d974
Instruction Fuzzy Hash: 73113675D01219EBCB21AFA4DC06AADBBB8FF28300F044126F951EA250DA70A8128B64

Function 00D429C4 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 159
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D429F7

Part of subcall function 00D6291B: std::exception::exception.LIBCMT ref: 00D62930
Part of subcall function 00D6291B: __CxxThrowException@8.LIBCMT ref: 00D62945

_Allocate.LIBCPMT ref: 00D42A1B
_memmove.LIBCMT ref: 00D42A47
_memmove.LIBCMT ref: 00D42A64
_memmove.LIBCMT ref: 00D42AB9
_memmove.LIBCMT ref: 00D42B15

Strings

vector<T> too long, xrefs: 00D429F2

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: _memmove$AllocateException@8ThrowXinvalid_argumentstd::_std::exception::exception
String ID: vector<T> too long
API String ID: 2152629851-3788999226
Opcode ID: 117e75b7a0c2b982e881ab0fa2ab8f6e9eaeadb1ed70c989b6ca5f391d905ee3
Instruction ID: 11e7b3a881451a2768da7e4f726b650fa4dcd57b4bad7bbba1a9a65939264ed0
Opcode Fuzzy Hash: 117e75b7a0c2b982e881ab0fa2ab8f6e9eaeadb1ed70c989b6ca5f391d905ee3
Instruction Fuzzy Hash: 3B516175A00609EFCB14DF6CCD868AEB7F5EF54304754892DF955D7254EA30EA40CB60

Function 00D3D29D Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 266COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D3D2A7

Part of subcall function 00D2B217: std::_Xinvalid_argument.LIBCPMT ref: 00D2B233

Part of subcall function 00D2B217: _memmove.LIBCMT ref: 00D2B28E

Strings

Code, xrefs: 00D3D371
Package, xrefs: 00D3D30D
Package '%s' has not been installed, xrefs: 00D3D450
Package '%s' has been installed, xrefs: 00D3D4BE
Installed, xrefs: 00D3D42C

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_Xinvalid_argument_memmovestd::_
String ID: Code$Installed$Package$Package '%s' has been installed$Package '%s' has not been installed
API String ID: 874089573-4160827312
Opcode ID: 0e09c1097341c98d9f06563af68a6a5c0b78c25c428f597b348057e8798a0e64
Instruction ID: d75a68ec479bd945e06705b609ec592c28e0462a37d2f5b3da65abdfb8cbc914
Opcode Fuzzy Hash: 0e09c1097341c98d9f06563af68a6a5c0b78c25c428f597b348057e8798a0e64
Instruction Fuzzy Hash: D4B12771901228DFDB24DBA4DC81BEDB7B5EF15308F1445AAE50AA7291DB706E88CF31

Function 00D2FBDC Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 107COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D2FBE3

Strings

Result of checks for command '%s' is '%s', xrefs: 00D2FCF4
Result of checks for command '%s' is 'Install', xrefs: 00D2FC9E
Bypass, xrefs: 00D2FCE5
Running checks for command '%s', xrefs: 00D2FC15
Fail, xrefs: 00D2FCDE, 00D2FCF2

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_
String ID: Bypass$Fail$Result of checks for command '%s' is '%s'$Result of checks for command '%s' is 'Install'$Running checks for command '%s'
API String ID: 2427045233-1246856847
Opcode ID: 23acf7b93ac8d69e4d93adc4316193046314a4f12e254033b119c10e0453c0ff
Instruction ID: 3f3453142a9fff24c356bf64e7b7ce24791a31e569fc9de48c6a0d3966d66df1
Opcode Fuzzy Hash: 23acf7b93ac8d69e4d93adc4316193046314a4f12e254033b119c10e0453c0ff
Instruction Fuzzy Hash: 6E417C30910228EFDB11DFA8EC86B9DB7B4FF25318F108525F855AB291EB706954CBB1

Function 00D4BDA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D4BDD1
_memset.LIBCMT ref: 00D4BDE8
GetTempPathW.KERNEL32(00000104,?), ref: 00D4BDFD
GetTempFileNameW.KERNEL32(?,VSD,00000000,?), ref: 00D4BE20

Part of subcall function 00D4A0E5: GetFileAttributesW.KERNEL32(00D2E067,?,00D2E067,?), ref: 00D4A0F8

DeleteFileW.KERNEL32(?), ref: 00D4BE42

Strings

VSD, xrefs: 00D4BE14

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: File$Temp_memset$AttributesDeleteNamePath
String ID: VSD
API String ID: 1299154628-2002190350
Opcode ID: 19ce347d85bb5640f554e66adc16965d37e6d322b96a9fc978229b68831c431f
Instruction ID: dad318c3069f1efc97d5624607717c00d3a4954a8c90b3b1e308c42cc27761e1
Opcode Fuzzy Hash: 19ce347d85bb5640f554e66adc16965d37e6d322b96a9fc978229b68831c431f
Instruction Fuzzy Hash: 06219FB5901318ABDF20DB64DC49BEA73BCDF69720F1444B2B208E3142DB34DA868B75

Function 00D4D303 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4CDA4: _memset.LIBCMT ref: 00D4CDD4
Part of subcall function 00D4CDA4: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00D4CDE9
Part of subcall function 00D4CDA4: _memset.LIBCMT ref: 00D4CE19
Part of subcall function 00D4CDA4: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00D4CE29
Part of subcall function 00D4CDA4: LoadLibraryW.KERNEL32(?), ref: 00D4CE52

GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00D4D33B
GetNativeSystemInfo.KERNEL32(?), ref: 00D4D349
FreeLibrary.KERNEL32(00000000), ref: 00D4D34E
GetSystemInfo.KERNEL32(?), ref: 00D4D35C

Strings

GetNativeSystemInfo, xrefs: 00D4D335
kernel32.dll, xrefs: 00D4D320

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: System$DirectoryInfoLibrary_memset$AddressFreeLoadNativeProcWindows
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 3576978690-192647395
Opcode ID: 777dd5278ca37ccc0227e70b92030bfc3cb9bf2ca95b2fac2fdd85f8da8eda08
Instruction ID: adedfdb882bb233d683b6086e5a318f6ad82f2bc6a51b91fea0850e6869cacf4
Opcode Fuzzy Hash: 777dd5278ca37ccc0227e70b92030bfc3cb9bf2ca95b2fac2fdd85f8da8eda08
Instruction Fuzzy Hash: 17F0F936A41348AB8724EF71EC099DE7BB8EF95724B080415F901F3180DA34D949C670

Function 00D4B43D Relevance: 9.1, APIs: 6, Instructions: 81COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D4B444
FindResourceW.KERNEL32(00000000,?,?,00000024,00D4C5D7,0000002B,00000000,?,Files,?), ref: 00D4B47C
LoadResource.KERNEL32(?,00000000,?,Files,?), ref: 00D4B490
SizeofResource.KERNEL32(?,00000000,?,Files,?), ref: 00D4B4A1
LockResource.KERNEL32(?,?,Files,?), ref: 00D4B4B4
_memmove.LIBCMT ref: 00D4B4C1

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Resource$FindH_prolog3LoadLockSizeof_memmove
String ID:
API String ID: 825505968-0
Opcode ID: 14bc4ecc7d84bba6b4e571bc8fe56084930dc3b14b29640fe9979f9c685cad0d
Instruction ID: 67687106dc98c9cccb522fb7171d64298daf438aacaa95f807f6de9aab365061
Opcode Fuzzy Hash: 14bc4ecc7d84bba6b4e571bc8fe56084930dc3b14b29640fe9979f9c685cad0d
Instruction Fuzzy Hash: 3A2119B5D00228ABCF11AFA4DC858EEFBB9FF68714B188516E805A3225E7718D51DB70

Function 00D492CA Relevance: 9.0, APIs: 6, Instructions: 47COMMON

Download Yara Rule

APIs

Part of subcall function 00D49034: __EH_prolog3_GS.LIBCMT ref: 00D4903E
Part of subcall function 00D49034: SystemParametersInfoW.USER32(00000029,000001F4,?,00000000), ref: 00D490A1
Part of subcall function 00D49034: FindResourceW.KERNEL32(?,?,00000005,Fonts,?,?), ref: 00D4919A
Part of subcall function 00D49034: LoadResource.KERNEL32(?,00000000,?,?), ref: 00D491AA
Part of subcall function 00D49034: LockResource.KERNEL32(00000000,?,?), ref: 00D491B5
Part of subcall function 00D49034: SizeofResource.KERNEL32(?,00000000,00000000,?,?,?,?), ref: 00D491D0
Part of subcall function 00D49034: CreateDialogIndirectParamW.USER32(?,?,?,?,?), ref: 00D491FB

SetWindowTextW.USER32(?,?), ref: 00D492FE
SetDlgItemTextW.USER32(?,0000040F,?), ref: 00D49318
SetForegroundWindow.USER32(?), ref: 00D49321
ShowWindow.USER32(?,00000005,?,?,?,?), ref: 00D4932C
LoadCursorW.USER32(00000000,00007F02), ref: 00D49339
SetCursor.USER32(00000000,?,?,?,?), ref: 00D49340

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Resource$Window$CursorLoadText$CreateDialogFindForegroundH_prolog3_IndirectInfoItemLockParamParametersShowSizeofSystem
String ID:
API String ID: 2553933429-0
Opcode ID: cad5e4eb5a9630826846512017f617090064448c950a2718cf828617d7c311fa
Instruction ID: 9c41508033ab129b08c19a767869b9fbd02c79eb1e38271f9f29607e3372c444
Opcode Fuzzy Hash: cad5e4eb5a9630826846512017f617090064448c950a2718cf828617d7c311fa
Instruction Fuzzy Hash: 08011335100205EFDB209F96DC5EE9B7BA6EF26342B018168FA16DA2B1C731D852DB74

Function 00D42C06 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 97registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D42C0D
RegOpenKeyExW.KERNEL32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000001,?,00000000,00000000,00000044), ref: 00D42C3E
RegCloseKey.KERNEL32(?), ref: 00D42CFF

Part of subcall function 00D2AA24: _memmove.LIBCMT ref: 00D2AA49

Strings

vsbootstrapper, xrefs: 00D42CC0
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00D42C31

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: CloseH_prolog3_Open_memmove
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce$vsbootstrapper
API String ID: 416362967-3239284363
Opcode ID: 59706308a86a245ead19285dc313c4f6cfc61efa307e79d34bb0a9c6b8f14400
Instruction ID: e0306198055046529659dfdcbad9668ee09ba5852a223fbe06f31799f5cbf523
Opcode Fuzzy Hash: 59706308a86a245ead19285dc313c4f6cfc61efa307e79d34bb0a9c6b8f14400
Instruction Fuzzy Hash: C231F5B1D11258BFDF11AFA8EDC5AEEBB78EF14348F54402AF905A2191DA304D45DB30

Function 00D4CDA4 Relevance: 7.6, APIs: 5, Instructions: 67libraryCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D4CDD4
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00D4CDE9
_memset.LIBCMT ref: 00D4CE19
GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00D4CE29
LoadLibraryW.KERNEL32(?), ref: 00D4CE52

Part of subcall function 00D4C3C8: __EH_prolog3_GS.LIBCMT ref: 00D4C3CF
Part of subcall function 00D4C3C8: LoadLibraryW.KERNEL32(00000000,?,00000020,00D4CE46,?,?), ref: 00D4C410

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: DirectoryLibraryLoad_memset$H_prolog3_SystemWindows
String ID:
API String ID: 2112805268-0
Opcode ID: 1cce22b75dfa3f9c366cb79daad9266a04effe21162afc11bb0fe0579cc3a0f6
Instruction ID: 292fdb6edf6d6687668aaf5f5b7e5524d9aaa0c5e826063964bccdc4f8e0a1ff
Opcode Fuzzy Hash: 1cce22b75dfa3f9c366cb79daad9266a04effe21162afc11bb0fe0579cc3a0f6
Instruction Fuzzy Hash: 671151BA94131CABDB20AB64EC89BCEB7BCEB24710F1045A5F515E3151EA709E848A70

Function 00D3EB71 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 163COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D3EB7B

Part of subcall function 00D2B217: std::_Xinvalid_argument.LIBCPMT ref: 00D2B233

Part of subcall function 00D2B217: _memmove.LIBCMT ref: 00D2B28E

Part of subcall function 00D3E406: __EH_prolog3_GS.LIBCMT ref: 00D3E410

__CxxThrowException@8.LIBCMT ref: 00D3ED75

Strings

ApplicationName, xrefs: 00D3EC0A
Package, xrefs: 00D3ECCE

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: ApplicationName$Package
API String ID: 3998058384-86433421
Opcode ID: cdb17c510e56944af93beff8cae167791fe2140d1fb5c3297c0ca330fae479e8
Instruction ID: 8845d6622e2cdde255fea4b533dc6f91dd733d847a69546e884b90ea3ce20035
Opcode Fuzzy Hash: cdb17c510e56944af93beff8cae167791fe2140d1fb5c3297c0ca330fae479e8
Instruction Fuzzy Hash: 88516771900218AFCB14EFA8D891AEDB7B5FF58314F244169E41AB32C1DB706E44CB71

Function 00D37D83 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 114COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D37D8D

Part of subcall function 00D36637: __EH_prolog3.LIBCMT ref: 00D3663E

_memset.LIBCMT ref: 00D37E56

Part of subcall function 00D2B608: __EH_prolog3.LIBCMT ref: 00D2B60F

__CxxThrowException@8.LIBCMT ref: 00D37DF1

Part of subcall function 00D4EE98: RaiseException.KERNEL32(?,?,00D2A9A0,?,?,?,?,?,00D2A9A0,?,00D6A6A8,00000000), ref: 00D4EEDA

Part of subcall function 00D2AD7D: __EH_prolog3_GS.LIBCMT ref: 00D2AD84

Strings

Could not open configuration file., xrefs: 00D37DD9

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3H_prolog3_$ExceptionException@8RaiseThrow_memset
String ID: Could not open configuration file.
API String ID: 528018053-2987739602
Opcode ID: 49c5c7cc7fc82c042a2f772450edfa290757a9277300787ac8ba7f34c678a81d
Instruction ID: a2a16773896b4e3de98eb88cf0f78fd44d934df0bcfbdf055e193679d134511a
Opcode Fuzzy Hash: 49c5c7cc7fc82c042a2f772450edfa290757a9277300787ac8ba7f34c678a81d
Instruction Fuzzy Hash: 24414D71D00208AFDB20DBA8D982FEEB7F8EF04704F108069F515B7291DA749E458B70

Function 00D4BAC9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D4BAD3

Part of subcall function 00D4A0E5: GetFileAttributesW.KERNEL32(00D2E067,?,00D2E067,?), ref: 00D4A0F8

GlobalAlloc.KERNEL32(00000040,00000000,?,?), ref: 00D4BB7A
GlobalFree.KERNEL32(00000000), ref: 00D4BC19

Strings

%d.%d.%d.%d, xrefs: 00D4BBE2

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Global$AllocAttributesFileFreeH_prolog3_
String ID: %d.%d.%d.%d
API String ID: 965710651-3491811756
Opcode ID: 217356ad1c7eb216c7b33a0472cc81af6857f2525f32e2c6e349eea3a5ea2e17
Instruction ID: 605d8e0504398f7a44189c0b1fb1ac636fde6e35a495dbd515af2277beb06974
Opcode Fuzzy Hash: 217356ad1c7eb216c7b33a0472cc81af6857f2525f32e2c6e349eea3a5ea2e17
Instruction Fuzzy Hash: 034180718411296BCF20AFA4DCC9AEEB778EB69310F5441E9F909A7152DB309E85CF70

Function 00D4BCB3 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D4BCBD

Part of subcall function 00D4B78E: __EH_prolog3_catch_GS.LIBCMT ref: 00D4B798

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00D4BD5C

Part of subcall function 00D2B217: std::_Xinvalid_argument.LIBCPMT ref: 00D2B233

Strings

InstallerLocation, xrefs: 00D4BCFF
HKLM\Software\Microsoft\Windows\CurrentVersion\Installer, xrefs: 00D4BD04

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: DirectoryH_prolog3_H_prolog3_catch_SystemXinvalid_argumentstd::_
String ID: HKLM\Software\Microsoft\Windows\CurrentVersion\Installer$InstallerLocation
API String ID: 3161095846-3782479466
Opcode ID: 8703f0ec9c19935f8defc5abeb0a654e815c603a07d10d993088cccb5735ae15
Instruction ID: fcf03f7299e249070d5e71d9f175320eec5d73a95acaa3d437449c1928fa2f11
Opcode Fuzzy Hash: 8703f0ec9c19935f8defc5abeb0a654e815c603a07d10d993088cccb5735ae15
Instruction Fuzzy Hash: 2B213E70D02238ABCB60EF54DC89BDD7778EF68714F1005D6A00AA6152DB749A85CF71

Function 00D4A6F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D4A706

Part of subcall function 00D6291B: std::exception::exception.LIBCMT ref: 00D62930
Part of subcall function 00D6291B: __CxxThrowException@8.LIBCMT ref: 00D62945

_Allocate.LIBCPMT ref: 00D4A71E
_memmove.LIBCMT ref: 00D4A733

Strings

vector<T> too long, xrefs: 00D4A701

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: AllocateException@8ThrowXinvalid_argument_memmovestd::_std::exception::exception
String ID: vector<T> too long
API String ID: 1114612255-3788999226
Opcode ID: ef6934d57392faa53df6cf70e6171ad2c67e90b08afff4674dcb139d3fd3a51d
Instruction ID: e630cc4df3a47def811664b1842d7c3eafa7017e3343371c39a439fd92e16cfa
Opcode Fuzzy Hash: ef6934d57392faa53df6cf70e6171ad2c67e90b08afff4674dcb139d3fd3a51d
Instruction Fuzzy Hash: 4101B171100605AFCB20EFADC8C5D6AB7E8EF843107548A2DF59AD7284EA70FD408BB0

Function 00D4EE13 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00D4EE2D

Part of subcall function 00D53605: __FF_MSGBANNER.LIBCMT ref: 00D5361E
Part of subcall function 00D53605: __NMSG_WRITE.LIBCMT ref: 00D53625
Part of subcall function 00D53605: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00D56B38,00000000,00000001,00000000,?,00D56DCA,00000018,00D6DEB0,0000000C,00D56E5F), ref: 00D5364A

std::exception::exception.LIBCMT ref: 00D4EE62
__CxxThrowException@8.LIBCMT ref: 00D4EE8D

Strings

bad allocation, xrefs: 00D4EE5B

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 1264268182-2104205924
Opcode ID: 0e397afc8316763b4ef8cbceef65b9ad44e1a5eaf565d0bc02abb777e9cc31c9
Instruction ID: ae0da5d30fa143418bb9537abe573e2fc4aa8cd19c80fd6d6c6b54c26ef31429
Opcode Fuzzy Hash: 0e397afc8316763b4ef8cbceef65b9ad44e1a5eaf565d0bc02abb777e9cc31c9
Instruction Fuzzy Hash: A0F0A476900319BBDF10FB68DC02A9DBBA4FF40754F180529F804E6291EB70DA4AC675

Function 00D43638 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 35COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00D43652

Strings

x64, xrefs: 00D43673
Intel64, xrefs: 00D4367A
Intel, xrefs: 00D43681

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: InfoNativeSystem
String ID: Intel$Intel64$x64
API String ID: 1721193555-2803704216
Opcode ID: a1acb4fad835436af346eec8580d3bec4666dcfca549ed348a349e01412f01f1
Instruction ID: dda26697a1c08328a27a0a1593fde0c0c95938840b88974d245bd736e905753a
Opcode Fuzzy Hash: a1acb4fad835436af346eec8580d3bec4666dcfca549ed348a349e01412f01f1
Instruction Fuzzy Hash: 55F0E93070131AFB8E08DB58A805CBD77A4EB68B55B5A401AF842E7390DA60DE4987B9

Function 00D43728 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D4372F

Part of subcall function 00D4B43D: __EH_prolog3.LIBCMT ref: 00D4B444
Part of subcall function 00D4B43D: FindResourceW.KERNEL32(00000000,?,?,00000024,00D4C5D7,0000002B,00000000,?,Files,?), ref: 00D4B47C
Part of subcall function 00D4B43D: LoadResource.KERNEL32(?,00000000,?,Files,?), ref: 00D4B490
Part of subcall function 00D4B43D: SizeofResource.KERNEL32(?,00000000,?,Files,?), ref: 00D4B4A1

Part of subcall function 00D2B608: __EH_prolog3.LIBCMT ref: 00D2B60F

__CxxThrowException@8.LIBCMT ref: 00D4377A

Part of subcall function 00D4EE98: RaiseException.KERNEL32(?,?,00D2A9A0,?,?,?,?,?,00D2A9A0,?,00D6A6A8,00000000), ref: 00D4EEDA

Strings

An error occurred attempting to extract setup configuration file., xrefs: 00D43762
SETUPCFG, xrefs: 00D4374F

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Resource$H_prolog3$ExceptionException@8FindH_prolog3_LoadRaiseSizeofThrow
String ID: An error occurred attempting to extract setup configuration file.$SETUPCFG
API String ID: 3704036767-3123322425
Opcode ID: 404cd633a51b5d354513878acb11d2e5c7891aa1bcd4ca202cfe205392afeeb8
Instruction ID: 6be2075c65ca79ef94e0282f8c90bd96cb999d165c48b1f005544c0484cb1dc4
Opcode Fuzzy Hash: 404cd633a51b5d354513878acb11d2e5c7891aa1bcd4ca202cfe205392afeeb8
Instruction Fuzzy Hash: E8F0FF71E402186BDF00EBE8D857BEDB3B4EF14719F408025F515B6185DBB466098B75

Function 00D47EE0 Relevance: 6.0, APIs: 4, Instructions: 43windowCOMMON

Download Yara Rule

APIs

IsDialogMessageW.USER32(?,?), ref: 00D47F08
TranslateMessage.USER32(?), ref: 00D47F16
DispatchMessageW.USER32(?), ref: 00D47F20
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D47F2F

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Message$DialogDispatchPeekTranslate
String ID:
API String ID: 1266772231-0
Opcode ID: c425570f73b61869430c28274aeec57e68b91696e118b3373182606e7840ff9d
Instruction ID: 6bded8b85c46e2659bde8755993b19659732912322f80634a4b2c46a2dd53bea
Opcode Fuzzy Hash: c425570f73b61869430c28274aeec57e68b91696e118b3373182606e7840ff9d
Instruction Fuzzy Hash: E9F01976A00219EBDF209BA59C89DEAB7BDEFA87047044169F501E2110E664D9098B74

Function 00D2ABA6 Relevance: 4.6, APIs: 3, Instructions: 66memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00D2ABAD
_Allocate.LIBCPMT ref: 00D2ABFD
_memmove.LIBCMT ref: 00D2AC4B

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: AllocateH_prolog3_catch_memmove
String ID:
API String ID: 1361164945-0
Opcode ID: 1912feb3f7fc286e3e65b25c3f6e970c22a42919580fbb700d997db6f268ee79
Instruction ID: fbd224d912b37e541afa0fb590ed291d163988cb443cc21b8d2a2bd18ffbc98f
Opcode Fuzzy Hash: 1912feb3f7fc286e3e65b25c3f6e970c22a42919580fbb700d997db6f268ee79
Instruction Fuzzy Hash: DC21CD31B002119BDB28DF2CE88176D77A2FFA4314F28451DF445DB290DB70AA44CBB2

Function 00D47E82 Relevance: 4.5, APIs: 3, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,00000001,?,00000000,00D47F79,00000008,00D478E2,?,.msi), ref: 00D47E93
DeleteObject.GDI32(?), ref: 00D47EB3
DeleteObject.GDI32(?), ref: 00D47EC0

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: DeleteObject$DestroyWindow
String ID:
API String ID: 409195656-0
Opcode ID: 969c542ca09b775333d0438b2b4b29bd5bf59f8ecc835fe73853b59acfe7b220
Instruction ID: 80e0233272b16440bde12c404180708a56be733887485c0a719b990cb0ac3a05
Opcode Fuzzy Hash: 969c542ca09b775333d0438b2b4b29bd5bf59f8ecc835fe73853b59acfe7b220
Instruction Fuzzy Hash: 01F0FEBA5057419F87309F6AD8C4817FBF8BFA82103558A7EE559D3710C374EC498A70

Function 00D4C908 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D4C90F

Part of subcall function 00D4BCB3: __EH_prolog3_GS.LIBCMT ref: 00D4BCBD

Part of subcall function 00D2AA24: _memmove.LIBCMT ref: 00D2AA49

Strings

msi.dll, xrefs: 00D4C974

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_$_memmove
String ID: msi.dll
API String ID: 2992230404-3974507041
Opcode ID: 2a2b05e8c7c5c38cf9528d31007ce029bbf3971ffbcfaef7d6017ca4e873aeda
Instruction ID: bc8c7c844daf5eb443c7ec942e8f880edb8248d5d838ddac75e950b8c0063c05
Opcode Fuzzy Hash: 2a2b05e8c7c5c38cf9528d31007ce029bbf3971ffbcfaef7d6017ca4e873aeda
Instruction Fuzzy Hash: 5C213B71D15208AFDF00DFE8E891AEEBBB8EF18314F54542AE115B7181D6309A49CBB5

Function 00D3D9FD Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D3DA04

Strings

VersionMsi, xrefs: 00D3DA16

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_
String ID: VersionMsi
API String ID: 2427045233-3588216237
Opcode ID: 5524a8cd5d66dc77512da11a96a9077674c57dd8d714e7bb1d35570624aac1be
Instruction ID: faf278c77f940e6b3766d7816ac5158c874d1f89b604204045987d25972b8eae
Opcode Fuzzy Hash: 5524a8cd5d66dc77512da11a96a9077674c57dd8d714e7bb1d35570624aac1be
Instruction Fuzzy Hash: 4A21E431944205DBCF00EFA4E8426EEB376EF34324F548129E555AB291EB329A05DF70

Function 00D2ADED Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D2AE03

Part of subcall function 00D6291B: std::exception::exception.LIBCMT ref: 00D62930
Part of subcall function 00D6291B: __CxxThrowException@8.LIBCMT ref: 00D62945

Strings

string too long, xrefs: 00D2ADFE

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_std::exception::exception
String ID: string too long
API String ID: 2884196479-2556327735
Opcode ID: aac7e24399c3e6733fcfbae0d03f32a2aaa398fb5b6e0cc9051c2e09bc3448b4
Instruction ID: 32d72c50f6ee8493e151f48536a4860ac60e16cee78c89c0f60c1e9f26a9a62e
Opcode Fuzzy Hash: aac7e24399c3e6733fcfbae0d03f32a2aaa398fb5b6e0cc9051c2e09bc3448b4
Instruction Fuzzy Hash: DCF0C2327402306BCB21A92CA8449BA368AEF7576DB324955F4A1DF181C622CC4387F7

Function 00D3570E Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D3572B

Part of subcall function 00D6291B: std::exception::exception.LIBCMT ref: 00D62930
Part of subcall function 00D6291B: __CxxThrowException@8.LIBCMT ref: 00D62945

Strings

string too long, xrefs: 00D35726

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_std::exception::exception
String ID: string too long
API String ID: 2884196479-2556327735
Opcode ID: f4a9f5dba6590d77015c762a5943866391a101e765e0708d7d84b21d0240382c
Instruction ID: 0510ddb5148186cac05d6b1d2f24c6a6938a359272f8a43611ea8512fb73c92c
Opcode Fuzzy Hash: f4a9f5dba6590d77015c762a5943866391a101e765e0708d7d84b21d0240382c
Instruction Fuzzy Hash: 80F02871300B10ABCB306E6DE98191AF7F9FF54B20F14062EF492D7690CB61AC0483B4

Function 00D4AD7B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D4AD9D

Part of subcall function 00D6291B: std::exception::exception.LIBCMT ref: 00D62930
Part of subcall function 00D6291B: __CxxThrowException@8.LIBCMT ref: 00D62945

Strings

vector<T> too long, xrefs: 00D4AD98

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argumentstd::_std::exception::exception
String ID: vector<T> too long
API String ID: 2884196479-3788999226
Opcode ID: 296a64463a11e834763c86e68a6f6a23ff2bd2b6edfb08427e4f7c80c820a802
Instruction ID: 5851db5d9e9afe01dd1cd7bb2527fe1a463d4474cf01470b03d3b1a94925d8c6
Opcode Fuzzy Hash: 296a64463a11e834763c86e68a6f6a23ff2bd2b6edfb08427e4f7c80c820a802
Instruction Fuzzy Hash: 79E0ED327408106B4708EE6EC88281E3BCA9BD8311329C228F129C3288DE30A84146B9

Function 00D41A4B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D41A52

Part of subcall function 00D4B43D: __EH_prolog3.LIBCMT ref: 00D4B444
Part of subcall function 00D4B43D: FindResourceW.KERNEL32(00000000,?,?,00000024,00D4C5D7,0000002B,00000000,?,Files,?), ref: 00D4B47C
Part of subcall function 00D4B43D: LoadResource.KERNEL32(?,00000000,?,Files,?), ref: 00D4B490
Part of subcall function 00D4B43D: SizeofResource.KERNEL32(?,00000000,?,Files,?), ref: 00D4B4A1

Part of subcall function 00D392E6: __EH_prolog3_GS.LIBCMT ref: 00D391FE

Strings

SETUPRES, xrefs: 00D41A72

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Resource$H_prolog3_$FindH_prolog3LoadSizeof
String ID: SETUPRES
API String ID: 1574261694-336410042
Opcode ID: b31903846497ffaf8cd4b610170bfd0a131780bffabbe42a857a0f93a25aad58
Instruction ID: 015a217999c4833435ec833c7c6c1e16785960ecd45b26fab69090f5cbea6799
Opcode Fuzzy Hash: b31903846497ffaf8cd4b610170bfd0a131780bffabbe42a857a0f93a25aad58
Instruction Fuzzy Hash: 97F03072E502099BDB00EBA8D817BEE73B4DF08718F40C015E505BA182DB7596088BB1

Function 00D4C9DB Relevance: 3.1, APIs: 2, Instructions: 144COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D4C9E2

Part of subcall function 00D2C5D3: std::_Xinvalid_argument.LIBCPMT ref: 00D2C5EC
Part of subcall function 00D2C5D3: std::_Xinvalid_argument.LIBCPMT ref: 00D2C60E
Part of subcall function 00D2C5D3: _memmove.LIBCMT ref: 00D2C652

CreateDirectoryW.KERNEL32(?,00000000,?,00000000,000000FF,?,?,00000001,?,?,?,?,00000058,00D3AF8B,?), ref: 00D4CAEA

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$CreateDirectoryH_prolog3__memmove
String ID:
API String ID: 3408557616-0
Opcode ID: 93c03dfa69619ab36c6d80aa3a4f46d1005aa043855f571bf81dbd91f8248a90
Instruction ID: 0d18cd2c400d60563839da0e39dbc78113f2d01f8f2947955b655a3e4f350e7b
Opcode Fuzzy Hash: 93c03dfa69619ab36c6d80aa3a4f46d1005aa043855f571bf81dbd91f8248a90
Instruction Fuzzy Hash: F541AE31D51218ABCF10EBACDC56EEEBBB8EF25354F148015F512B7181D670AA45CBB1

Function 00D4C3C8 Relevance: 3.0, APIs: 2, Instructions: 37libraryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D4C3CF

Part of subcall function 00D4BF95: _memset.LIBCMT ref: 00D4BFD6

LoadLibraryW.KERNEL32(00000000,?,00000020,00D4CE46,?,?), ref: 00D4C410

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_LibraryLoad_memset
String ID:
API String ID: 463936710-0
Opcode ID: 03137f6a0abe2e4a1196001359c90ec5efd7295092e96ab471cdd0dd46ce5212
Instruction ID: 55ab6e4798cb2059c3386e1574134f7cbacd45f704782fed871a21930b5c686a
Opcode Fuzzy Hash: 03137f6a0abe2e4a1196001359c90ec5efd7295092e96ab471cdd0dd46ce5212
Instruction Fuzzy Hash: 08F04971D112189BDB10DFA9C855AFFBBB8EF58390F508025F919AB241DB34AA05CBF1

Function 00D4369F Relevance: 3.0, APIs: 2, Instructions: 34fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000001,00000000,?,08000080,00000000), ref: 00D436C8
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00D436DA

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: ab36d9791897b723a7a0fec51e9d5d8c70b4d04439f6f68aca53067ef1da5a28
Instruction ID: 2ea6d227f18ad7fed72244d52cc7200bf7d72ac7debedd1045a72dabc8789db2
Opcode Fuzzy Hash: ab36d9791897b723a7a0fec51e9d5d8c70b4d04439f6f68aca53067ef1da5a28
Instruction Fuzzy Hash: CBF0E5B20002087FE7205F64EC8AFA7BB5DFB50378F15C525F555CA1A1D6719E988BB0

Function 00D3FE53 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D3FE5A

Part of subcall function 00D2FBDC: __EH_prolog3_GS.LIBCMT ref: 00D2FBE3

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-0
Opcode ID: da297a0216476f25fbdaa2931ea7131f8db0a6ed4348f2f945ddaca9d0c7d63e
Instruction ID: f6dbe9aebfcae7795e7ed3561cd05538a9902dfcafad1cda1107862b3c500c7c
Opcode Fuzzy Hash: da297a0216476f25fbdaa2931ea7131f8db0a6ed4348f2f945ddaca9d0c7d63e
Instruction Fuzzy Hash: 1D312971D40259EFDB10EFA4D841BDEB7B4EF18314F108129E515BB291DBB46948CB71

Function 00D37487 Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00D3748E

Part of subcall function 00D34E9C: __EH_prolog3_catch.LIBCMT ref: 00D34EA3
Part of subcall function 00D34E9C: std::ios_base::getloc.LIBCPMT ref: 00D34EEB
Part of subcall function 00D34E9C: std::ios_base::clear.LIBCPMT ref: 00D34F3D

Part of subcall function 00D2AA74: std::_Xinvalid_argument.LIBCPMT ref: 00D2AA8C
Part of subcall function 00D2AA74: _memmove.LIBCMT ref: 00D2AACA

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_catchH_prolog3_catch_Xinvalid_argument_memmovestd::_std::ios_base::clearstd::ios_base::getloc
String ID:
API String ID: 661421567-0
Opcode ID: c9987fef65f47ad14933333143d18177357295ae821db653d758ee9265dfe777
Instruction ID: f709c75056a0f6a552bf5110d57e0ea12dae4a235225d26d09dc155deab06bb5
Opcode Fuzzy Hash: c9987fef65f47ad14933333143d18177357295ae821db653d758ee9265dfe777
Instruction Fuzzy Hash: FF317C74A04659DFCB24EF98C551BBDBBB0EF14314F648198E4926B2D2CB34AE00DB74

Function 00D392E6 Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D392F0

Part of subcall function 00D37F9D: __EH_prolog3.LIBCMT ref: 00D37FA4
Part of subcall function 00D37F9D: std::ios_base::clear.LIBCPMT ref: 00D38027

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3H_prolog3_std::ios_base::clear
String ID:
API String ID: 3738461641-0
Opcode ID: f6f558db60a1c4cf35a3f8c9abbe2eb4b8f28c8bd1b14c118ca9f715ffab57e5
Instruction ID: f6edb91079596f7796e9b7d0c7a28634917926a98a7c7b3a34ca10cca297f2d5
Opcode Fuzzy Hash: f6f558db60a1c4cf35a3f8c9abbe2eb4b8f28c8bd1b14c118ca9f715ffab57e5
Instruction Fuzzy Hash: 862132B1D4425DABDB24DFA8D891FEEB7B8EF14304F1081A9F419A3191EE705A48DB30

Function 00D2B2B9 Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D2B313

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 3cfe98217aa5096d1ca9ea3fd296ca66c1879ea702fcae0b43656ac4080a30db
Instruction ID: f4ab9d39651079f907271583c8299ff6aa9b0df5a67a95717623e7e497da7981
Opcode Fuzzy Hash: 3cfe98217aa5096d1ca9ea3fd296ca66c1879ea702fcae0b43656ac4080a30db
Instruction Fuzzy Hash: 1201A131200324E78A209E5DB84499EBBB9EFA1769710091BF48687210D7B1ED458BB5

Function 00D4C024 Relevance: 1.5, APIs: 1, Instructions: 48COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D4C02B

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 42fda15481426558db52440f74d529470cba169f2d60e2186ea16686200156f1
Instruction ID: 30aa15f77ea1ff5d7c0ba3bf24f0285052c4765af50f028cb60e6542a1aab17c
Opcode Fuzzy Hash: 42fda15481426558db52440f74d529470cba169f2d60e2186ea16686200156f1
Instruction Fuzzy Hash: 8B11E5B1D0021A9FDF01EFD4C8819EEBBB4FF18310F54502AF515B2261EA39AA11CBB5

Function 00D2A9C9 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,00000000,00000000), ref: 00D2AA09

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: ca17ff7b81c5ef342d0d5091841c831f3bf3fc077583ad58da6719b9ff42ae7b
Instruction ID: 0e359fc00dc48d86e617aad27c7f7befcf317b8f06e7b79e885a09766c30d4e0
Opcode Fuzzy Hash: ca17ff7b81c5ef342d0d5091841c831f3bf3fc077583ad58da6719b9ff42ae7b
Instruction Fuzzy Hash: 38F0F072600204BFC304CB1CCC06EFFB7A9DFA9720F46425AF801D72A0E770AE0486A0

Function 00D2AD06 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D2AD0D

Part of subcall function 00D4C024: __EH_prolog3.LIBCMT ref: 00D4C02B

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3H_prolog3_
String ID:
API String ID: 3355343447-0
Opcode ID: e8f4dbdd8970770a4a072012152f06566ab2b970156ca6b55cefe86c8553ee3a
Instruction ID: f5f152732cabda6320d5cb41a648d2883fcd9f9e9db0935bf77520a07dc2b25f
Opcode Fuzzy Hash: e8f4dbdd8970770a4a072012152f06566ab2b970156ca6b55cefe86c8553ee3a
Instruction Fuzzy Hash: 5101F671E10219ABDF00EBA8D846BEEB3B8EF18319F408025E515A6281DB7496088BB5

Function 00D3D0AC Relevance: 1.5, APIs: 1, Instructions: 32COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D3D0B3

Part of subcall function 00D4C024: __EH_prolog3.LIBCMT ref: 00D4C02B

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3H_prolog3_
String ID:
API String ID: 3355343447-0
Opcode ID: b93915396aff260871dbc5a263ebebfaa2f15df7de24d7f02ee1e36ea67cb627
Instruction ID: 7149017397b94b20ae7844408e4e1cf1a49d284afaddb02c4075d92a094b7d85
Opcode Fuzzy Hash: b93915396aff260871dbc5a263ebebfaa2f15df7de24d7f02ee1e36ea67cb627
Instruction Fuzzy Hash: E8F0C471D10259ABDF00DFA8D846BEEB3B8EF08319F508025E615A6281DB7496198BB5

Function 00D4A0E5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00D2E067,?,00D2E067,?), ref: 00D4A0F8

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 4097636394bc73e0d5a1cdbf790619d8f3ec86daf6fed833b00051deaa00fdf4
Instruction ID: 4f6ff66175733199b538a611a7b9e5bad5cd22b607529197e97d6acbe63d80a3
Opcode Fuzzy Hash: 4097636394bc73e0d5a1cdbf790619d8f3ec86daf6fed833b00051deaa00fdf4
Instruction Fuzzy Hash: B8D05E31AD43585BBF205ABCA809662339C9B86338F1C4A51F82CC25D1E635EC92D472

Function 00D4A119 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00D2DFA4,?,00D2DFA4,?), ref: 00D4A12C

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 104a9306f072389a47d85270d583ca449698b8c1afa97adb43f690d98ca7380b
Instruction ID: 690a949cbc5e8a4998f281ccdf906552b22594b2002dc2b99bd29734246c72c8
Opcode Fuzzy Hash: 104a9306f072389a47d85270d583ca449698b8c1afa97adb43f690d98ca7380b
Instruction Fuzzy Hash: B3D05E315D030A5BBF205ABDAD095A6339C8B8232CF1C4692F43CE60D5E638DC92D072

Function 00D4865D Relevance: 1.5, APIs: 1, Instructions: 15COMMON

Download Yara Rule

APIs

SetDlgItemTextW.USER32(000000FF,00000000,?), ref: 00D4867D

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 6231a0cf2c80df0eedfbe6e369683991bc7f3249fb453dbf67fc3475a84800a7
Instruction ID: e54a66b414fd06f55f6b3371503d0f7321b79fb3d4fa771b156af2289d9525a3
Opcode Fuzzy Hash: 6231a0cf2c80df0eedfbe6e369683991bc7f3249fb453dbf67fc3475a84800a7
Instruction Fuzzy Hash: FAD05E31001608BFDF212F58DC08AA97F19EB603A4F2D8255B86C480B1CB3289A7EB64

Function 00D47E5F Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 00D47E73

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 748091bfedb43bf0e2c10c2eefb908cf42257f19380f436ca8e5f43acd9a02e5
Instruction ID: 77f9c0a6164af93980dfa6beb4d5101192d2cb88525158d298e2d15b2e824624
Opcode Fuzzy Hash: 748091bfedb43bf0e2c10c2eefb908cf42257f19380f436ca8e5f43acd9a02e5
Instruction Fuzzy Hash: 90C08C320A428DAA87000A75DC0ACB67FECCBA06023198061B518C1091E62AD852D574

Non-executed Functions

Function 00D43221 Relevance: 56.3, APIs: 21, Strings: 11, Instructions: 262sleepprocessCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00D4322B
GetCurrentProcessId.KERNEL32(00000294), ref: 00D43245
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00D43250
__CxxThrowException@8.LIBCMT ref: 00D43278
_memset.LIBCMT ref: 00D4328C
Process32FirstW.KERNEL32(00000000,?), ref: 00D432A2
Process32NextW.KERNEL32(00000000,?), ref: 00D432D2
Process32FirstW.KERNEL32(00000000,?), ref: 00D4330E
Process32NextW.KERNEL32(00000000,?), ref: 00D43341
OpenProcess.KERNEL32(00000400,00000000,?,?), ref: 00D43424

Part of subcall function 00D51840: __towlower_l.LIBCMT ref: 00D5184A

GetExitCodeProcess.KERNEL32(00000000,?), ref: 00D43465
Sleep.KERNEL32(00000064), ref: 00D4349D
GetExitCodeProcess.KERNEL32(00000000,?), ref: 00D434AB

Strings

Timed out waiting to open destination file for writing - ERROR_SHARING_VIOLATION, xrefs: 00D43576
Unable to find current process, xrefs: 00D432DB
Unable to open parent process, xrefs: 00D43436
Unable to create system snapshot, xrefs: 00D43262
Unknown error trying to open destination file for writing, xrefs: 00D4358B
Unable to get exit code for parent process (first time), xrefs: 00D4346B
Unable to access process information (2nd time), xrefs: 00D43317
Timed out waiting for parent process to finish., xrefs: 00D434EE
Unable to get exit code for parent process, xrefs: 00D434B1
Unable to find parent process, xrefs: 00D4334A
Unable to access process information, xrefs: 00D432AB

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: ProcessProcess32$CodeExitFirstNext$CreateCurrentException@8H_prolog3_catch_OpenSleepSnapshotThrowToolhelp32__towlower_l_memset
String ID: Timed out waiting for parent process to finish.$Timed out waiting to open destination file for writing - ERROR_SHARING_VIOLATION$Unable to access process information$Unable to access process information (2nd time)$Unable to create system snapshot$Unable to find current process$Unable to find parent process$Unable to get exit code for parent process$Unable to get exit code for parent process (first time)$Unable to open parent process$Unknown error trying to open destination file for writing
API String ID: 420453142-2110499973
Opcode ID: 605647c3eafe368bb9fb834cad4b1160c7bf5286b599f81df7a48833e07539ea
Instruction ID: 158e8ac252a08d7adca94382878a15942e7e7e809c6010aac6e96481a6a5854c
Opcode Fuzzy Hash: 605647c3eafe368bb9fb834cad4b1160c7bf5286b599f81df7a48833e07539ea
Instruction Fuzzy Hash: E4A17970905329EBDF20DFA8DC89AEDB7B8BF10744F5440A6E549A6180DB709F858F70

Function 00D2DE9F Relevance: 28.3, APIs: 5, Strings: 11, Instructions: 303fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D2DEA9

Part of subcall function 00D2A9C9: WriteFile.KERNEL32(?,?,?,00000000,00000000), ref: 00D2AA09

FindFirstFileW.KERNEL32(?,?), ref: 00D2E1A7
FindNextFileW.KERNEL32(00000000,00000010), ref: 00D2E23D
FindClose.KERNEL32(00000000), ref: 00D2E24C
FindClose.KERNEL32(00000000), ref: 00D2E267

Part of subcall function 00D2AA24: _memmove.LIBCMT ref: 00D2AA49

Strings

Error constructing path: The pathname principles exceed _MAX_PATH., xrefs: 00D2E01F
Unable to find special folder, xrefs: 00D2DF26
Could not find file '%s' in folder '%s', xrefs: 00D2E12D
Running check with folder '%s' and file '%s', xrefs: 00D2DF80
., xrefs: 00D2E1C1
Looking up path for special folder '%s', xrefs: 00D2DEFF
%s\*.*, xrefs: 00D2E17C
File version is '%s', xrefs: 00D2E0B4
Attempting to find file '%s', xrefs: 00D2E043
Unable to find directory '%s', xrefs: 00D2DFB5
Could not determine file version, xrefs: 00D2E0DB

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Find$File$Close$FirstH_prolog3_NextWrite_memmove
String ID: %s\*.*$.$Attempting to find file '%s'$Could not determine file version$Could not find file '%s' in folder '%s'$Error constructing path: The pathname principles exceed _MAX_PATH.$File version is '%s'$Looking up path for special folder '%s'$Running check with folder '%s' and file '%s'$Unable to find directory '%s'$Unable to find special folder
API String ID: 1808150035-2904976425
Opcode ID: 58ef90e91bad985804b9497c85de94a333d3ca71e25e69fe175f0d272259bf91
Instruction ID: 3582bebc062b2d31ab1e37481fdafa168c46f315b686324be2744f8e5ee28191
Opcode Fuzzy Hash: 58ef90e91bad985804b9497c85de94a333d3ca71e25e69fe175f0d272259bf91
Instruction Fuzzy Hash: E5B16B31D40229AFDF11DBA8ED82BEDB7B8EF28308F548065F505A7281E7709A44CB75

Function 00D5BE6C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00000000,00000002,?,?,00D5C4DB,?,00D55A00,?,000000BC,?,00000001,?,00000000), ref: 00D5BEAB
GetLocaleInfoW.KERNEL32(?,20001004,00000000,00000002,?,?,00D5C4DB,?,00D55A00,?,000000BC,?,00000001,?,00000000), ref: 00D5BED4
GetACP.KERNEL32(?,?,00D5C4DB,?,00D55A00,?,000000BC,?,00000001), ref: 00D5BEE8

Strings

OCP, xrefs: 00D5BE8C
ACP, xrefs: 00D5BE7B

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 9300b34e69d783ceef9b2c662bcbff74156cecbc531b47c76a4aba2fa5271a0a
Instruction ID: 96639b3ab064ea6cd44a668a1f3878b954afdc6efc4f96a717aa6c7ad53886e6
Opcode Fuzzy Hash: 9300b34e69d783ceef9b2c662bcbff74156cecbc531b47c76a4aba2fa5271a0a
Instruction Fuzzy Hash: 0B017531605706BEEF219B64AC47B9B77A8AF2176AF284016FF01E1180DB70CA499774

Function 00D4EF49 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00D53938
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00D5394D
UnhandledExceptionFilter.KERNEL32(00D2732C), ref: 00D53958
GetCurrentProcess.KERNEL32(C0000409), ref: 00D53974
TerminateProcess.KERNEL32(00000000), ref: 00D5397B

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 409a88596b38b1f50158453fd7319d34881ac99b8884fd197e65ecb5471d1cf1
Instruction ID: 1b7ff080265120b790cacc97d92e928fd391c9384fd54f93837b10d4399e87a8
Opcode Fuzzy Hash: 409a88596b38b1f50158453fd7319d34881ac99b8884fd197e65ecb5471d1cf1
Instruction Fuzzy Hash: 4621BDB8842388DBD755DF29EC456643BE0FB28311F98801AEA1CC2361F7B15AC58F76

Function 00D311E7 Relevance: 47.7, APIs: 2, Strings: 25, Instructions: 438COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D311F1

Part of subcall function 00D2B217: std::_Xinvalid_argument.LIBCPMT ref: 00D2B233

__CxxThrowException@8.LIBCMT ref: 00D316B3

Strings

Property, xrefs: 00D312CC
ValueExists, xrefs: 00D3161C
BypassIf, xrefs: 00D31260
ValueGreaterThanOrEqualTo, xrefs: 00D31482
ValueGreaterThan, xrefs: 00D31447
VersionEqualTo, xrefs: 00D314BD
VersionLessThanOrEqualTo, xrefs: 00D3156E
VersionNotEqualTo, xrefs: 00D314F8
ValueNotExists, xrefs: 00D3164C
Text, xrefs: 00D312B7
Compare, xrefs: 00D3130F
ValueEqualTo, xrefs: 00D31360
No Compare value specified in '%s' Condition for Package '%s'., xrefs: 00D31342
VersionGreaterThanOrEqualTo, xrefs: 00D315E4
FailIf, xrefs: 00D3127E
VersionGreaterThan, xrefs: 00D315A9
Could not determine Property of '%s' Condition for Package '%s'., xrefs: 00D312FF
Could not determine Condition Type '%s' for Package '%s'., xrefs: 00D3178F
VersionLessThan, xrefs: 00D31533
Schedule, xrefs: 00D316CF
Value, xrefs: 00D3134D
Could not determine Compare operator '%s' for Package '%s'., xrefs: 00D31769
ValueNotEqualTo, xrefs: 00D3139E
ValueLessThanOrEqualTo, xrefs: 00D3140C
ValueLessThan, xrefs: 00D313D5

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Exception@8H_prolog3_ThrowXinvalid_argumentstd::_
String ID: BypassIf$Compare$Could not determine Compare operator '%s' for Package '%s'.$Could not determine Condition Type '%s' for Package '%s'.$Could not determine Property of '%s' Condition for Package '%s'.$FailIf$No Compare value specified in '%s' Condition for Package '%s'.$Property$Schedule$Text$Value$ValueEqualTo$ValueExists$ValueGreaterThan$ValueGreaterThanOrEqualTo$ValueLessThan$ValueLessThanOrEqualTo$ValueNotEqualTo$ValueNotExists$VersionEqualTo$VersionGreaterThan$VersionGreaterThanOrEqualTo$VersionLessThan$VersionLessThanOrEqualTo$VersionNotEqualTo
API String ID: 4175701135-3657231789
Opcode ID: 0b1b47020e0a593f80f1fdca6fb4a06d12a0f875aaa1b534b8a2ab37eef1f710
Instruction ID: ee12220edcadb9aec20a0d06b7f705936a6abc65df91559f1b6f5d5733abc425
Opcode Fuzzy Hash: 0b1b47020e0a593f80f1fdca6fb4a06d12a0f875aaa1b534b8a2ab37eef1f710
Instruction Fuzzy Hash: 52F18175A04319ABDF14DBA8DD42BADBBF4AF24304F14846DF449E7181EB709A48CB35

Function 00D4D524 Relevance: 47.5, APIs: 12, Strings: 15, Instructions: 275libraryloaderCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D4D589

Part of subcall function 00D4CDA4: _memset.LIBCMT ref: 00D4CDD4
Part of subcall function 00D4CDA4: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00D4CDE9
Part of subcall function 00D4CDA4: _memset.LIBCMT ref: 00D4CE19
Part of subcall function 00D4CDA4: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00D4CE29
Part of subcall function 00D4CDA4: LoadLibraryW.KERNEL32(?), ref: 00D4CE52

GetProcAddress.KERNEL32(00000000,WinVerifyTrust), ref: 00D4D5FE
GetProcAddress.KERNEL32(00000000,WTHelperProvDataFromStateData), ref: 00D4D60C
GetProcAddress.KERNEL32(00000000,WTHelperGetProvSignerFromChain), ref: 00D4D61A
GetProcAddress.KERNEL32(00000000,WTHelperGetProvCertFromChain), ref: 00D4D628

Part of subcall function 00D2A9C9: WriteFile.KERNEL32(?,?,?,00000000,00000000), ref: 00D2AA09

Strings

crypt32.dll, xrefs: 00D4D78E
Wintrust not found on machine., xrefs: 00D4D5D5
Subject form unknown, xrefs: 00D4D722
File not trusted, xrefs: 00D4D6BA
WTHelperProvDataFromStateData, xrefs: 00D4D600
WTHelperGetProvSignerFromChain, xrefs: 00D4D60E
File not signed, xrefs: 00D4D6FE
CertDuplicateCertificateContext, xrefs: 00D4D7A3
Wintrust not on machine, xrefs: 00D4D729
WinVerifyTrust returned %d, xrefs: 00D4D67F
File trusted, xrefs: 00D4D6DC
wintrust.dll, xrefs: 00D4D59A
Could not get procedures out of Wintrust., xrefs: 00D4D89D
WinVerifyTrust, xrefs: 00D4D5F8
WTHelperGetProvCertFromChain, xrefs: 00D4D61C

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: AddressProc$_memset$Directory$FileLibraryLoadSystemWindowsWrite
String ID: CertDuplicateCertificateContext$Could not get procedures out of Wintrust.$File not signed$File not trusted$File trusted$Subject form unknown$WTHelperGetProvCertFromChain$WTHelperGetProvSignerFromChain$WTHelperProvDataFromStateData$WinVerifyTrust$WinVerifyTrust returned %d$Wintrust not found on machine.$Wintrust not on machine$crypt32.dll$wintrust.dll
API String ID: 268569407-3272105283
Opcode ID: d0b0355f4b048b8392744398a47a1a4f9e3bf8b3de11752dc5a29a2889e8fc8f
Instruction ID: dd4b275d51d30482d4a87e30d38f9338dd3318a5022e8c88b8c022bc8fb311b6
Opcode Fuzzy Hash: d0b0355f4b048b8392744398a47a1a4f9e3bf8b3de11752dc5a29a2889e8fc8f
Instruction Fuzzy Hash: B2A15B75A00328AFDB209FA5DC85BAEBBB6EF64304F1440A9E149E7251DB708D85CF71

Function 00D4DA53 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 222COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D4DA5A
__wcsicoll.LIBCMT ref: 00D4DA96
__wcsicoll.LIBCMT ref: 00D4DAB4
GetEnvironmentVariableW.KERNEL32(?,00000000,00000000,0000005C,00D2DF19,?,?,Looking up path for special folder '%s',?,000002EC,00D2E6F3,?,?,?,?,?), ref: 00D4DBE4
GetEnvironmentVariableW.KERNEL32(?,?,00000000,00000000,?), ref: 00D4DC1E
__wcsicoll.LIBCMT ref: 00D4DC61

Strings

ProgramFiles, xrefs: 00D4DB07
APPDATA, xrefs: 00D4DAA4
CommonProgramFilesFolder, xrefs: 00D4DAD7
windir, xrefs: 00D4DB49, 00D4DB70
LocalAppDataFolder, xrefs: 00D4DADE
CommonFilesFolder, xrefs: 00D4DAC3
SystemFolder, xrefs: 00D4DB1F
ProgramFilesFolder, xrefs: 00D4DAF3
WindowsFolder, xrefs: 00D4DB35
WindowsVolume, xrefs: 00D4DB58, 00D4DC5B
AppDataFolder, xrefs: 00D4DA89
CommonAppDataFolder, xrefs: 00D4DAAE
StartupFolder, xrefs: 00D4DB0E

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: __wcsicoll$EnvironmentVariable$H_prolog3_
String ID: APPDATA$AppDataFolder$CommonAppDataFolder$CommonFilesFolder$CommonProgramFilesFolder$LocalAppDataFolder$ProgramFiles$ProgramFilesFolder$StartupFolder$SystemFolder$WindowsFolder$WindowsVolume$windir
API String ID: 3619938276-201842807
Opcode ID: b96515e962f8c331a74ba1d6af17ea000acd96b681dcbd8b226e2c8ac69ff95a
Instruction ID: 5096cc82e4b71b6ef1e42dd897d67e93fc15345afe589c34e15c09733ede359a
Opcode Fuzzy Hash: b96515e962f8c331a74ba1d6af17ea000acd96b681dcbd8b226e2c8ac69ff95a
Instruction Fuzzy Hash: 1D619571944359AFDF10EBA8EC82EEDBBB9EF25724F14001AF100BB191EA709949C775

Function 00D40E3A Relevance: 30.1, APIs: 2, Strings: 15, Instructions: 367COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D40E44

Part of subcall function 00D3FC14: std::exception::exception.LIBCMT ref: 00D3FC4A
Part of subcall function 00D3FC14: __CxxThrowException@8.LIBCMT ref: 00D3FC5F

Part of subcall function 00D3CF0E: std::exception::exception.LIBCMT ref: 00D3CF5A
Part of subcall function 00D3CF0E: __CxxThrowException@8.LIBCMT ref: 00D3CF6F

Part of subcall function 00D40998: __EH_prolog3_GS.LIBCMT ref: 00D4099F

Part of subcall function 00D4A5EC: __EH_prolog3_GS.LIBCMT ref: 00D4A5F3

Part of subcall function 00D2AD7D: __EH_prolog3_GS.LIBCMT ref: 00D2AD84

__CxxThrowException@8.LIBCMT ref: 00D413AE

Part of subcall function 00D4EE98: RaiseException.KERNEL32(?,?,00D2A9A0,?,?,?,?,?,00D2A9A0,?,00D6A6A8,00000000), ref: 00D4EEDA

Strings

LicenseAgreement, xrefs: 00D40FE0
InstallChecks, xrefs: 00D40FF9
PackageFiles, xrefs: 00D41015
PackageCode, xrefs: 00D40F76
BuildList, xrefs: 00D411CB
IfNotHomeSite, xrefs: 00D4104F
Command, xrefs: 00D4131D
BeforePackage, xrefs: 00D411E9
Commands, xrefs: 00D412F4
Name, xrefs: 00D40FCC, 00D411A9
Schedules, xrefs: 00D4114E
Schedule, xrefs: 00D4116D
CopyAllPackageFiles, xrefs: 00D4103D, 00D41073
PackageFile, xrefs: 00D41113
AfterPackage, xrefs: 00D41204

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_$Exception@8Throw$std::exception::exception$ExceptionRaise
String ID: AfterPackage$BeforePackage$BuildList$Command$Commands$CopyAllPackageFiles$IfNotHomeSite$InstallChecks$LicenseAgreement$Name$PackageCode$PackageFile$PackageFiles$Schedule$Schedules
API String ID: 2151410129-3733023836
Opcode ID: 41ad287a3414f06939e587bf25a3a1a5f004d26901456a21d2d7751039b2884f
Instruction ID: 9f9306ae4a4c55e0983f48f739ca7e680011c8df3a2a7e504f38ad16f6f0f942
Opcode Fuzzy Hash: 41ad287a3414f06939e587bf25a3a1a5f004d26901456a21d2d7751039b2884f
Instruction Fuzzy Hash: 1AF10A719006589FDB20DFA9D881BDEBBB4FF18304F1484AEE55AA3241DB706A84CF71

Function 00D2C398 Relevance: 28.2, APIs: 5, Strings: 11, Instructions: 162libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D2C39F

Part of subcall function 00D4BCB3: __EH_prolog3_GS.LIBCMT ref: 00D4BCBD

LoadLibraryW.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000048), ref: 00D2C415
GetProcAddress.KERNEL32(?,MsiQueryProductStateW), ref: 00D2C4A3
GetProcAddress.KERNEL32(?,MsiQueryFeatureStateW), ref: 00D2C4F6
FreeLibrary.KERNEL32(00000000), ref: 00D2C579

Strings

MsiQueryFeatureStateW, xrefs: 00D2C4EE
No ProductCode specified in MsiProductCheck, xrefs: 00D2C437
Could not find MsiQueryProductState function, xrefs: 00D2C4B0
Could not load msi.dll, xrefs: 00D2C470
Running MsiFeatureCheck with ProductCode '%s' and FeatureCode '%s', xrefs: 00D2C52D
Could not find MsiQueryFeatureState function, xrefs: 00D2C503
Running MsiProductCheck with ProductCode '%s', xrefs: 00D2C4C7
msi.dll, xrefs: 00D2C3CD, 00D2C3F9, 00D2C45C
MsiQueryProductStateW, xrefs: 00D2C49B
MsiQueryProductState returned '%d', xrefs: 00D2C4E7
MsiQueryFeatureState returned '%d', xrefs: 00D2C556

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: AddressH_prolog3_LibraryProc$FreeLoad
String ID: Could not find MsiQueryFeatureState function$Could not find MsiQueryProductState function$Could not load msi.dll$MsiQueryFeatureState returned '%d'$MsiQueryFeatureStateW$MsiQueryProductState returned '%d'$MsiQueryProductStateW$No ProductCode specified in MsiProductCheck$Running MsiFeatureCheck with ProductCode '%s' and FeatureCode '%s'$Running MsiProductCheck with ProductCode '%s'$msi.dll
API String ID: 3583740701-465683338
Opcode ID: ec65dbfd043d909d4121eed821b380986e9b84a0b79034d8291e51245673b1e7
Instruction ID: 3ea761ca59f468c2804b655b0b18a52d382c58181818af1231037f173f413b12
Opcode Fuzzy Hash: ec65dbfd043d909d4121eed821b380986e9b84a0b79034d8291e51245673b1e7
Instruction Fuzzy Hash: 72518C31A10234DFCB21EBA8EC45AAEBBB1FF34709F509019E445A7250D770AD59CBB1

Function 00D2F595 Relevance: 26.7, APIs: 7, Strings: 8, Instructions: 448synchronizationCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D2F59F
GetLastError.KERNEL32 ref: 00D2F991

Part of subcall function 00D2AA24: _memmove.LIBCMT ref: 00D2AA49

Part of subcall function 00D2B217: std::_Xinvalid_argument.LIBCPMT ref: 00D2B233

WaitForSingleObject.KERNEL32(?,00000000,0000010C,00D40745,?), ref: 00D2FA8B
GetExitCodeProcess.KERNEL32(?,?), ref: 00D2FAB9
__CxxThrowException@8.LIBCMT ref: 00D2FB43
CloseHandle.KERNEL32(?), ref: 00D2FB73
GetTickCount.KERNEL32 ref: 00D2FB7B

Strings

Unable to run create process. GetLastError returned: %d, xrefs: 00D2F998
-I "%s" -q %s, xrefs: 00D2F7D3
.msi, xrefs: 00D2F729
Process exited with code %d, xrefs: 00D2FACD
Installing with log file '%s', xrefs: 00D2F918
Unable to get process exitcode., xrefs: 00D2FB55
msiexec.exe, xrefs: 00D2F778
Installing using command '%s' and parameters '%s', xrefs: 00D2F861

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: CloseCodeCountErrorException@8ExitH_prolog3_HandleLastObjectProcessSingleThrowTickWaitXinvalid_argument_memmovestd::_
String ID: -I "%s" -q %s$.msi$Installing using command '%s' and parameters '%s'$Installing with log file '%s'$Process exited with code %d$Unable to get process exitcode.$Unable to run create process. GetLastError returned: %d$msiexec.exe
API String ID: 1951572231-3914699998
Opcode ID: 01b4f4378e568b5f1b440eb9d7b58478f5539dcc140bdf3612bba461a4deca06
Instruction ID: fd0f1f707002327eaa78bcc840112aeceb4788255c86a046c766d4c7925c4f5d
Opcode Fuzzy Hash: 01b4f4378e568b5f1b440eb9d7b58478f5539dcc140bdf3612bba461a4deca06
Instruction Fuzzy Hash: 4A022CB1900228EFDB25DF98DD81AEEB7B8EF25308F4045A9E54AA3151DB705E84CF31

Function 00D5603D Relevance: 24.1, APIs: 16, Instructions: 95COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00D56056

Part of subcall function 00D56B71: Sleep.KERNEL32(00000000), ref: 00D56B99

__calloc_crt.LIBCMT ref: 00D5607A
_free.LIBCMT ref: 00D56088
__calloc_crt.LIBCMT ref: 00D56096
_free.LIBCMT ref: 00D560A6
_free.LIBCMT ref: 00D560AC
__copytlocinfo_nolock.LIBCMT ref: 00D560BB
__setlocale_nolock.LIBCMT ref: 00D560C8
___removelocaleref.LIBCMT ref: 00D560D4
___freetlocinfo.LIBCMT ref: 00D560DB
_free.LIBCMT ref: 00D560E1
__setmbcp_nolock.LIBCMT ref: 00D560F3
_free.LIBCMT ref: 00D56101
___removelocaleref.LIBCMT ref: 00D56108
___freetlocinfo.LIBCMT ref: 00D5610F
_free.LIBCMT ref: 00D56115

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref$Sleep__copytlocinfo_nolock__setlocale_nolock__setmbcp_nolock
String ID:
API String ID: 888903860-0
Opcode ID: 83d2f6e5141d541a24a6b2aa3fd16a4eb6cb8a7a6cc754af66ffec33763964ac
Instruction ID: 645fc0451250cafedfd4f7ef5842157ea4e730257a6d870fe20d8feabed2734f
Opcode Fuzzy Hash: 83d2f6e5141d541a24a6b2aa3fd16a4eb6cb8a7a6cc754af66ffec33763964ac
Instruction Fuzzy Hash: 7021E235104A01ABDF227F69E853D1BBBE4DF40752B648429FC89972A2EF31D8488A70

Function 00D2E9A2 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 189libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D2E9A9

Part of subcall function 00D4CDA4: _memset.LIBCMT ref: 00D4CDD4
Part of subcall function 00D4CDA4: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00D4CDE9
Part of subcall function 00D4CDA4: _memset.LIBCMT ref: 00D4CE19
Part of subcall function 00D4CDA4: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00D4CE29
Part of subcall function 00D4CDA4: LoadLibraryW.KERNEL32(?), ref: 00D4CE52

FreeLibrary.KERNEL32(00000000,00000064), ref: 00D2E9DA

Part of subcall function 00D2A9C9: WriteFile.KERNEL32(?,?,?,00000000,00000000), ref: 00D2AA09

GetProcAddress.KERNEL32(00000000,CreateAssemblyCache), ref: 00D2EA00
GetProcAddress.KERNEL32(?,CreateAssemblyNameObject), ref: 00D2EA10
FreeLibrary.KERNEL32(?), ref: 00D2EA1C

Strings

CreateAssemblyNameObject, xrefs: 00D2EA06
mscoree.dll, xrefs: 00D2E9B1
fusion.dll, xrefs: 00D2E9E3
msil, xrefs: 00D2EB20
Unable to find assembly in GAC, xrefs: 00D2EBB0
Could not Create AssemblyName, xrefs: 00D2EA27
CreateAssemblyCache, xrefs: 00D2E9FA
Could not get AssemblyCache, xrefs: 00D2EA54

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Library$AddressDirectoryFreeProc_memset$FileH_prolog3_LoadSystemWindowsWrite
String ID: Could not Create AssemblyName$Could not get AssemblyCache$CreateAssemblyCache$CreateAssemblyNameObject$Unable to find assembly in GAC$fusion.dll$mscoree.dll$msil
API String ID: 1877927997-3920661512
Opcode ID: 0bd5412755d241742c7a8f767eebfdd027d89954ef5dccbd051bdde9e167c4e2
Instruction ID: d0f7a24de8bfdf815c80079b31eb4b46b2ef765a4d6cb7d2e19ccc943882874b
Opcode Fuzzy Hash: 0bd5412755d241742c7a8f767eebfdd027d89954ef5dccbd051bdde9e167c4e2
Instruction Fuzzy Hash: 67616C71D40328AFCF11DBA8E8929EDB7B9FF28308F54442AF116A7291DB709945CB71

Function 00D3A269 Relevance: 22.9, APIs: 3, Strings: 10, Instructions: 116COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D3A270

Part of subcall function 00D4A574: __EH_prolog3_GS.LIBCMT ref: 00D4A57B

Part of subcall function 00D2B608: __EH_prolog3.LIBCMT ref: 00D2B60F

__CxxThrowException@8.LIBCMT ref: 00D3A2EF

Part of subcall function 00D4EE98: RaiseException.KERNEL32(?,?,00D2A9A0,?,?,?,?,?,00D2A9A0,?,00D6A6A8,00000000), ref: 00D4EEDA

__EH_prolog3.LIBCMT ref: 00D3A3A3

Strings

Result, xrefs: 00D3A2BF
Could not determine Result '%s' for Exit Code., xrefs: 00D3A38A
Success, xrefs: 00D3A326
FailReboot, xrefs: 00D3A30D
No Result value found specified for Exit Code., xrefs: 00D3A2D7
Value, xrefs: 00D3A29D
Text, xrefs: 00D3A357
FormatMessageFromSystem, xrefs: 00D3A3BD
SuccessReboot, xrefs: 00D3A33F
Fail, xrefs: 00D3A2F4

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3H_prolog3_$ExceptionException@8RaiseThrow
String ID: Could not determine Result '%s' for Exit Code.$Fail$FailReboot$FormatMessageFromSystem$No Result value found specified for Exit Code.$Result$Success$SuccessReboot$Text$Value
API String ID: 4273899721-3249030018
Opcode ID: 5cc5ce2183474c080b54a714ea03510a485fdf8a8ca2407e7d964d9ccaaced17
Instruction ID: d37be4d365bdd541b375a36219857c8e7cbbc7de69b2e67942c547a7856ebe46
Opcode Fuzzy Hash: 5cc5ce2183474c080b54a714ea03510a485fdf8a8ca2407e7d964d9ccaaced17
Instruction Fuzzy Hash: 6F419471E40214AFDB10EFA8ED02BDDBBB4EF24704F104025F655A7191EBB49A48CB76

Function 00D43ED6 Relevance: 21.4, APIs: 9, Strings: 3, Instructions: 350COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D43EE0

Part of subcall function 00D4B43D: __EH_prolog3.LIBCMT ref: 00D4B444
Part of subcall function 00D4B43D: FindResourceW.KERNEL32(00000000,?,?,00000024,00D4C5D7,0000002B,00000000,?,Files,?), ref: 00D4B47C
Part of subcall function 00D4B43D: LoadResource.KERNEL32(?,00000000,?,Files,?), ref: 00D4B490
Part of subcall function 00D4B43D: SizeofResource.KERNEL32(?,00000000,?,Files,?), ref: 00D4B4A1

__fassign.LIBCMT ref: 00D43F6B
_memset.LIBCMT ref: 00D43F93

Part of subcall function 00D2AA24: _memmove.LIBCMT ref: 00D2AA49

Strings

FILEDATA, xrefs: 00D44054
FILEKEY, xrefs: 00D43FC0
COUNT, xrefs: 00D43F21

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Resource$FindH_prolog3H_prolog3_LoadSizeof__fassign_memmove_memset
String ID: COUNT$FILEDATA$FILEKEY
API String ID: 105933430-4046824674
Opcode ID: 9f4ab530564a06fc097f1b82fcf6341baac9c7e3371c2c3b75171d9a5088058f
Instruction ID: 793f4dd6e291acc69659451d80311b9c48a6a4d2e77e134012cdb1abff73d232
Opcode Fuzzy Hash: 9f4ab530564a06fc097f1b82fcf6341baac9c7e3371c2c3b75171d9a5088058f
Instruction Fuzzy Hash: 70E1E4B19412699BDB24DB68CC81AEDB7F8FF54304F4481EAE589A2141EE705F84CFA1

Function 00D4AA7D Relevance: 21.3, APIs: 10, Strings: 2, Instructions: 316COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D4AAD4
_memmove.LIBCMT ref: 00D4AB31
_memmove.LIBCMT ref: 00D4AB5F
_memmove.LIBCMT ref: 00D4AB95
_memmove.LIBCMT ref: 00D4AC08
_memmove.LIBCMT ref: 00D4AC6B
_memmove.LIBCMT ref: 00D4ACCB
_memmove.LIBCMT ref: 00D4AD0A
_memmove.LIBCMT ref: 00D4AD42
std::_Xinvalid_argument.LIBCPMT ref: 00D4AD70

Strings

string too long, xrefs: 00D4AACF
invalid string position, xrefs: 00D4AD6B

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: _memmove$Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1771113911-4289949731
Opcode ID: 1613292236fc9a9754a79708cff46637c65c7101cb03d30fa52a9fcb6ebde2ab
Instruction ID: 6aa17d725a0f03d12756aea0201e09b2bc913fb87c91f7050ba7d8660838b16b
Opcode Fuzzy Hash: 1613292236fc9a9754a79708cff46637c65c7101cb03d30fa52a9fcb6ebde2ab
Instruction Fuzzy Hash: 8FB137707405199BCB28CF4CD8D08AAB3F7FF84705724892EE4928B655EB30E955CBB6

Function 00D2D50C Relevance: 21.3, APIs: 1, Strings: 11, Instructions: 264COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D2D513

Part of subcall function 00D2A9C9: WriteFile.KERNEL32(?,?,?,00000000,00000000), ref: 00D2AA09

Strings

AssemblyCheck: error setting public key token: %d, xrefs: 00D2D6D1
AssemblyCheck: Error setting assembly name: %d, xrefs: 00D2D5A4
AssemblyCheck: Error getting display name: %d, xrefs: 00D2D77E
Could not Create AssemblyName, xrefs: 00D2D538
AssemblyCheck: error setting culture: %d, xrefs: 00D2D701
AssemblyCheck: Error setting culture: %d, xrefs: 00D2D720
AssemblyCheck: error setting minor version number: %d, xrefs: 00D2D633
AssemblyCheck: error setting major version number: %d, xrefs: 00D2D5F5
AssemblyCheck: Error creating assembly name object, xrefs: 00D2D564
AssemblyCheck: error setting build number: %d, xrefs: 00D2D671
AssemblyCheck: error setting revision number: %d, xrefs: 00D2D6AF

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: FileH_prolog3_Write
String ID: AssemblyCheck: Error creating assembly name object$AssemblyCheck: Error getting display name: %d$AssemblyCheck: Error setting assembly name: %d$AssemblyCheck: Error setting culture: %d$AssemblyCheck: error setting build number: %d$AssemblyCheck: error setting culture: %d$AssemblyCheck: error setting major version number: %d$AssemblyCheck: error setting minor version number: %d$AssemblyCheck: error setting public key token: %d$AssemblyCheck: error setting revision number: %d$Could not Create AssemblyName
API String ID: 4181851173-3855258871
Opcode ID: 27c513fdd35d758decdfb162954fe936e488688305f9065a08ca2a4987c27953
Instruction ID: ad0bd6f2f5b9eab950fbbc944f93e631b77649e4d847bebf5df048f601451995
Opcode Fuzzy Hash: 27c513fdd35d758decdfb162954fe936e488688305f9065a08ca2a4987c27953
Instruction Fuzzy Hash: F19166B0A00215AFDB04EF94E885DBEB7BAEF69708F604459F502E7281D770AD458BB1

Function 00D487B5 Relevance: 21.1, APIs: 14, Instructions: 117COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(00000002,0000042F), ref: 00D487E7
ShowWindow.USER32(00000000), ref: 00D487EA
GetDlgItem.USER32(00000002,00000430), ref: 00D487F9
ShowWindow.USER32(00000000), ref: 00D487FC
GetDlgItem.USER32(00000002,0000042C), ref: 00D4880B
ShowWindow.USER32(00000000), ref: 00D4880E
GetDlgItem.USER32(00000002,00000431), ref: 00D4881D
ShowWindow.USER32(00000000), ref: 00D48820
GetDlgItem.USER32(00000002,0000042F), ref: 00D48856
GetWindowRect.USER32(00000000), ref: 00D48859
GetDlgItem.USER32(00000002,00000432), ref: 00D4886B
GetWindowRect.USER32(00000000), ref: 00D48874
GetWindowRect.USER32(00000002,?), ref: 00D4887D

Part of subcall function 00D482EA: GetDlgItem.USER32(?,?), ref: 00D48308
Part of subcall function 00D482EA: GetWindowRect.USER32(00000000,?), ref: 00D48327
Part of subcall function 00D482EA: ScreenToClient.USER32(?,?), ref: 00D48344
Part of subcall function 00D482EA: MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 00D48368

MoveWindow.USER32(00000002,?,?,?,?,00000001), ref: 00D488EB

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Window$Item$RectShow$Move$ClientScreen
String ID:
API String ID: 4252227071-0
Opcode ID: be739ec9bd443125831ef13cbbeebd2b374c9f765381f70b5ac0634be620a5b8
Instruction ID: d97b48412b22d3fe1ae9a5c8e8b14c105c05f437488cede74b089359872e543e
Opcode Fuzzy Hash: be739ec9bd443125831ef13cbbeebd2b374c9f765381f70b5ac0634be620a5b8
Instruction Fuzzy Hash: 8E41B9B1A00209FFDF10AFA9DD85CAEBBB9FF58341F518429F205E2260CB715951DB68

Function 00D4D37A Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 89COMMON

Download Yara Rule

Strings

AdjustTokenPrivileges, xrefs: 00D4D3D9
SeShutdownPrivilege, xrefs: 00D4D40C
LookupPrivilegeValueW, xrefs: 00D4D3CE
advapi32.dll, xrefs: 00D4D3A4
OpenProcessToken, xrefs: 00D4D3C6

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Version_memset
String ID: AdjustTokenPrivileges$LookupPrivilegeValueW$OpenProcessToken$SeShutdownPrivilege$advapi32.dll
API String ID: 963298953-3661999180
Opcode ID: 4f600102c906eb8b220803c3849ca904815717af2badfe0617daa5d4069f9d42
Instruction ID: 6beb221039d6854c001b0ca3238491cbf78cd47345beeb6a647e204a3fa0a18f
Opcode Fuzzy Hash: 4f600102c906eb8b220803c3849ca904815717af2badfe0617daa5d4069f9d42
Instruction Fuzzy Hash: 80219D71E00318ABCF20AFA59C4A9BFBBBDEF99714B14401AF505F3240DA7599468B72

Function 00D3A7D6 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 232COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D3A818
_memmove.LIBCMT ref: 00D3A873
_memmove.LIBCMT ref: 00D3A8B2
_memmove.LIBCMT ref: 00D3A8DF
std::_Xinvalid_argument.LIBCPMT ref: 00D3A90D
std::_Xinvalid_argument.LIBCPMT ref: 00D3A961
std::_Xinvalid_argument.LIBCPMT ref: 00D3A978
_memmove.LIBCMT ref: 00D3A9C8
_memmove.LIBCMT ref: 00D3A9E6

Strings

string too long, xrefs: 00D3A813, 00D3A973
invalid string position, xrefs: 00D3A908, 00D3A95C

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: _memmove$Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1771113911-4289949731
Opcode ID: 09ea912037106e1902b8d6d5a38302a99851c62abf8f0dd9d0c23baa915479b3
Instruction ID: ee35a65389c16723affd8fde4fc1d06c93e7bb781d0bc87b47a4a5b87e0abaa9
Opcode Fuzzy Hash: 09ea912037106e1902b8d6d5a38302a99851c62abf8f0dd9d0c23baa915479b3
Instruction Fuzzy Hash: 45719F31700214ABCB24DF5CDC8496AB7E6EFC4704B65492DE8C29B241EB70ED56CBB2

Function 00D63438 Relevance: 18.1, APIs: 12, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

____lc_handle_func.LIBCMT ref: 00D6346C
____lc_codepage_func.LIBCMT ref: 00D63474
__GetLocaleForCP.LIBCPMT ref: 00D6349C
____mb_cur_max_l_func.LIBCMT ref: 00D634B2
MultiByteToWideChar.KERNEL32(?,00000009,?,00000002,?,00000000,?,?,?,?,00D320E0,?,?,?,?,?), ref: 00D634D1
____mb_cur_max_l_func.LIBCMT ref: 00D634DF
___pctype_func.LIBCMT ref: 00D63504
____mb_cur_max_l_func.LIBCMT ref: 00D6352A
____mb_cur_max_l_func.LIBCMT ref: 00D63542
____mb_cur_max_l_func.LIBCMT ref: 00D6355A
MultiByteToWideChar.KERNEL32(?,00000009,?,00000000,?,00000000,?,?,?,?,00D320E0,?,?,?,?,?), ref: 00D63567
MultiByteToWideChar.KERNEL32(?,00000009,?,00000001,?,00000000,?,?,?,?,00D320E0,?,?,?,?,?), ref: 00D63598

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: ____mb_cur_max_l_func$ByteCharMultiWide$Locale____lc_codepage_func____lc_handle_func___pctype_func
String ID:
API String ID: 3819326198-0
Opcode ID: 65f82e74a93acbb74766fd48f3b8d48a19dd31805f15c5404c04f128ac16e75b
Instruction ID: aced9a0625c6287d46c00befff41dee77c01ebd81b6a1b1db34e607f4f7eb280
Opcode Fuzzy Hash: 65f82e74a93acbb74766fd48f3b8d48a19dd31805f15c5404c04f128ac16e75b
Instruction Fuzzy Hash: 3B41C631504255AFDB225F35DC45B6ABBA4EF11361F288429FC55CA1A2EF30EA90D770

Function 00D2E289 Relevance: 17.7, APIs: 1, Strings: 9, Instructions: 186COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D2E293

Part of subcall function 00D2D49E: __EH_prolog3.LIBCMT ref: 00D2D4A5
Part of subcall function 00D2D49E: __CxxThrowException@8.LIBCMT ref: 00D2D4F8

Strings

No Name value specified for Assembly Check '%s', xrefs: 00D2E32C
ProcessorArchitecture, xrefs: 00D2E445
Name, xrefs: 00D2E305
PublicKeyToken, xrefs: 00D2E35D
No PublicKeyToken value specified for Assembly Check '%s'., xrefs: 00D2E4CC
No Version value specified for Assembly Check '%s'., xrefs: 00D2E3D0
Culture, xrefs: 00D2E3FF
Version, xrefs: 00D2E3A9
neutral, xrefs: 00D2E419

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Exception@8H_prolog3H_prolog3_Throw
String ID: Culture$Name$No Name value specified for Assembly Check '%s'$No PublicKeyToken value specified for Assembly Check '%s'.$No Version value specified for Assembly Check '%s'.$ProcessorArchitecture$PublicKeyToken$Version$neutral
API String ID: 3648411918-1850210091
Opcode ID: 2fe941ce24de51147b5deb4b097cd12c9a0a4d8d5904eece98644a6e0489ae53
Instruction ID: 5351a80694e764a38de4e38abde3aea8da4bab7cd6f8d2af07eb2f57ec2f7035
Opcode Fuzzy Hash: 2fe941ce24de51147b5deb4b097cd12c9a0a4d8d5904eece98644a6e0489ae53
Instruction Fuzzy Hash: A4715D709103289FCB21DFA8D981AEEB7F4FF25718F50456AE449A3251E770AA48CB71

Function 00D48D9E Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 141filewindowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D48DA5
CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000002,00000080,00000000,?,?,00000002), ref: 00D48E0E
MessageBoxW.USER32(?,?,?,00000010), ref: 00D48E5F
WriteFile.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,00000002,?,00000000), ref: 00D48E96
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00D48EB8
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00D48ED8
CloseHandle.KERNEL32(?), ref: 00D48EE1
SetEvent.KERNEL32(?,00000048,00D49003,00000002), ref: 00D48F32

Strings

eula.rtf, xrefs: 00D48DDE
open, xrefs: 00D48F06

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: File$Write$CloseCreateEventH_prolog3_HandleMessage
String ID: eula.rtf$open
API String ID: 3097060125-387166277
Opcode ID: 03f1cdae3ee7abeecfa8fea58ccf9822bb283718714b6913944878feeab0c109
Instruction ID: f4c9d11b0356b568544187dc286746cade69bfe2ebc3fbcec9be82206d7e63b7
Opcode Fuzzy Hash: 03f1cdae3ee7abeecfa8fea58ccf9822bb283718714b6913944878feeab0c109
Instruction Fuzzy Hash: F9512871900208AFDB14CFA8DC85EEEBBB9EF54740F508429F116AB1A0DB71A949DB74

Function 00D2FD5A Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 135COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D2FD61

Part of subcall function 00D2B217: std::_Xinvalid_argument.LIBCPMT ref: 00D2B233

Strings

Arguments, xrefs: 00D2FE40
ExitCodes, xrefs: 00D2FEC8
EstimatedInstallSeconds, xrefs: 00D2FE99
EstimatedTempBytes, xrefs: 00D2FE7D
Log, xrefs: 00D2FE4F
EstimatedInstalledBytes, xrefs: 00D2FE61
PackageFile, xrefs: 00D2FDE9
InstallConditions, xrefs: 00D2FEAE
No PackageFile specified for package '%s'., xrefs: 00D2FE30

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_Xinvalid_argumentstd::_
String ID: Arguments$EstimatedInstallSeconds$EstimatedInstalledBytes$EstimatedTempBytes$ExitCodes$InstallConditions$Log$No PackageFile specified for package '%s'.$PackageFile
API String ID: 4049434844-3536121905
Opcode ID: 48ad77e249a8f80bfb025dbe071ea7632ebc48fb1f4ddb97a14c1674ee9470bf
Instruction ID: 756c5677b75dc593a95b763372cabac3ebaf54a8050688072e552bf74f184a84
Opcode Fuzzy Hash: 48ad77e249a8f80bfb025dbe071ea7632ebc48fb1f4ddb97a14c1674ee9470bf
Instruction Fuzzy Hash: 22519EB1900754AFCB10DFA9D842B9EBBB4FF24304F10482EF55AA3252DB74A609CB75

Function 00D48ACF Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D48AD9
GetDC.USER32(?), ref: 00D48AF4

Part of subcall function 00D4A574: __EH_prolog3_GS.LIBCMT ref: 00D4A57B

Part of subcall function 00D4A574: __fassign.LIBCMT ref: 00D4A5D7

_memset.LIBCMT ref: 00D48BAC
_memset.LIBCMT ref: 00D48BB8
EnumFontFamiliesExW.GDI32(?,?,Function_00027F49,?,00000000), ref: 00D48BFD
CreateFontIndirectW.GDI32(?), ref: 00D48C39

Strings

Weight, xrefs: 00D48B8C
FontName, xrefs: 00D48B1C
Height, xrefs: 00D48B6F
CharSet, xrefs: 00D48B52

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: FontH_prolog3__memset$CreateEnumFamiliesIndirect__fassign
String ID: CharSet$FontName$Height$Weight
API String ID: 3771659125-1759768386
Opcode ID: b34237791a28dd94dcdce4732d0213667cd490699929a1c5f797be638f69d9e9
Instruction ID: f542bba31802379ff5ef0f0c3e8a05b69ed394b89622697cd598a4ccdfa00431
Opcode Fuzzy Hash: b34237791a28dd94dcdce4732d0213667cd490699929a1c5f797be638f69d9e9
Instruction Fuzzy Hash: 0A415E70D40258AFDF10DF688D81FAEB7B8EF19304F0484A9E548E7252D7349A889F31

Function 00D40998 Relevance: 16.0, APIs: 2, Strings: 7, Instructions: 231COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D4099F

Part of subcall function 00D2AD7D: __EH_prolog3_GS.LIBCMT ref: 00D2AD84

__CxxThrowException@8.LIBCMT ref: 00D40BC2

Part of subcall function 00D4EE98: RaiseException.KERNEL32(?,?,00D2A9A0,?,?,?,?,?,00D2A9A0,?,00D6A6A8,00000000), ref: 00D4EEDA

Strings

RegistryCheck, xrefs: 00D40A09
AssemblyCheck, xrefs: 00D40B2F
MsiProductCheck, xrefs: 00D40A73
ExternalCheck, xrefs: 00D40AA8
FileCheck, xrefs: 00D409D4
Could not determine Check type '%s' for Package '%s'., xrefs: 00D40BE5
RegistryFileCheck, xrefs: 00D40A3E

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_$ExceptionException@8RaiseThrow
String ID: AssemblyCheck$Could not determine Check type '%s' for Package '%s'.$ExternalCheck$FileCheck$MsiProductCheck$RegistryCheck$RegistryFileCheck
API String ID: 2193040975-1850567849
Opcode ID: 33585c7dbd53934f3ba72a75e2658b85b0e411a9e7df1d00bc2f576ba47fa526
Instruction ID: 8c76597e1514edd10a327318b56e88e0e9264978d612a0ad56c7bfc56ef4f71d
Opcode Fuzzy Hash: 33585c7dbd53934f3ba72a75e2658b85b0e411a9e7df1d00bc2f576ba47fa526
Instruction Fuzzy Hash: F871B631A04218AFDB14EFA8E992EAEBBF5EF54308F14402DF645A7181DB709944CB76

Function 00D44E0D Relevance: 15.9, APIs: 1, Strings: 8, Instructions: 181COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D44E17

Strings

0, xrefs: 00D44F70
Status of package '%s' after install is 'Installing', xrefs: 00D44F97
Status of package '%s' after install is 'InstallNeeded', xrefs: 00D44FAB
Status of package '%s' after install is 'InstallFailed', xrefs: 00D44F24
Status of package '%s' after install is 'InstallUnknown', xrefs: 00D44F38
Status of package '%s' after install is 'InstallSucceeded', xrefs: 00D44F5D
Status of package '%s' after install is 'Fail', xrefs: 00D44EE8
Status of package '%s' after install is 'LaunchConditionFailed', xrefs: 00D44F10

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_
String ID: 0$Status of package '%s' after install is 'Fail'$Status of package '%s' after install is 'InstallFailed'$Status of package '%s' after install is 'InstallNeeded'$Status of package '%s' after install is 'InstallSucceeded'$Status of package '%s' after install is 'InstallUnknown'$Status of package '%s' after install is 'Installing'$Status of package '%s' after install is 'LaunchConditionFailed'
API String ID: 2427045233-2489974127
Opcode ID: 19832e9400cfc41ba66cdfb16303fa4a06e8d19538787a8efef0275c36245d78
Instruction ID: 8f63f5cb0d0964187e436bcbd97aa6a43529413626fce8b16e8bde11e1b114c4
Opcode Fuzzy Hash: 19832e9400cfc41ba66cdfb16303fa4a06e8d19538787a8efef0275c36245d78
Instruction Fuzzy Hash: A861E970D106199BDF11DFA8D982BEDB7B8FF15304F9080A9E549B6181EB705A88CF71

Function 00D4A911 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 148memoryCOMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D4A93C

Part of subcall function 00D6291B: std::exception::exception.LIBCMT ref: 00D62930
Part of subcall function 00D6291B: __CxxThrowException@8.LIBCMT ref: 00D62945

_Allocate.LIBCPMT ref: 00D4A95E
_memmove.LIBCMT ref: 00D4A983
_memmove.LIBCMT ref: 00D4A99B
_memmove.LIBCMT ref: 00D4A9E3
_memset.LIBCMT ref: 00D4AA17
_memmove.LIBCMT ref: 00D4AA3A
_memmove.LIBCMT ref: 00D4AA52

Strings

vector<T> too long, xrefs: 00D4A937

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: _memmove$AllocateException@8ThrowXinvalid_argument_memsetstd::_std::exception::exception
String ID: vector<T> too long
API String ID: 3468635988-3788999226
Opcode ID: 5e4305da8e177b1631597833beb96e12c036c2459bedf7bb2e6b05cc2a572a53
Instruction ID: 135ba5cf2a8a44873e68922a977b45806f30febdd77877e469850e6e5b7523de
Opcode Fuzzy Hash: 5e4305da8e177b1631597833beb96e12c036c2459bedf7bb2e6b05cc2a572a53
Instruction Fuzzy Hash: D3414C75A40209BFCF14DFACC9998AEBBA9EF54344B14892DF899D7341D630EA44CB70

Function 00D49993 Relevance: 15.1, APIs: 10, Instructions: 106windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D4999D
GetDC.USER32(?), ref: 00D499B5
ShowScrollBar.USER32(?,00000001,00000000,?,?,?,00D49B9C,?,?,?,?,?,?,?,00000020,00D4151A), ref: 00D499C7
GetClientRect.USER32(?,?), ref: 00D499DE
GetSystemMetrics.USER32(00000002), ref: 00D499E6

Part of subcall function 00D4DF3D: __EH_prolog3_GS.LIBCMT ref: 00D4DF44

ReleaseDC.USER32(?,?), ref: 00D49AA6
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00D49AB6
GetStockObject.GDI32(0000000D), ref: 00D49AC2
GetObjectW.GDI32(00000000,0000005C,?), ref: 00D49AD3
ShowScrollBar.USER32(?,00000001,00000001), ref: 00D49AFA

Part of subcall function 00D48907: GetTextExtentPoint32W.GDI32(?,?,?,?), ref: 00D48947

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_ObjectScrollShow$ClientExtentMessageMetricsPoint32RectReleaseSendStockSystemText
String ID:
API String ID: 1108648939-0
Opcode ID: b8cad9e2e3dfd0754b00a7db94211a8717dfb3121e82b54bcf1398d1cf6eeb26
Instruction ID: 0344dc49454587b484fe96b219d9a6792eb2fcb536f5c21018c7297df1d8df69
Opcode Fuzzy Hash: b8cad9e2e3dfd0754b00a7db94211a8717dfb3121e82b54bcf1398d1cf6eeb26
Instruction Fuzzy Hash: 3141E475D00269DFDF209FA9CD46B9EBBB9FF54300F14809AE109E2251CA715A85CF34

Function 00D4D20F Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 93libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4CDA4: _memset.LIBCMT ref: 00D4CDD4
Part of subcall function 00D4CDA4: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00D4CDE9
Part of subcall function 00D4CDA4: _memset.LIBCMT ref: 00D4CE19
Part of subcall function 00D4CDA4: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00D4CE29
Part of subcall function 00D4CDA4: LoadLibraryW.KERNEL32(?), ref: 00D4CE52

GetProcAddress.KERNEL32(00000000,IsUserAnAdmin), ref: 00D4D25D
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 00D4D2B9
FreeLibrary.KERNEL32(?), ref: 00D4D2D3
FreeLibrary.KERNEL32(?), ref: 00D4D2E7

Strings

shell32.dll, xrefs: 00D4D239
advapi32.dll, xrefs: 00D4D29E
IsUserAnAdmin, xrefs: 00D4D257
CheckTokenMembership, xrefs: 00D4D2B3

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Library$AddressDirectoryFreeProc_memset$LoadSystemWindows
String ID: CheckTokenMembership$IsUserAnAdmin$advapi32.dll$shell32.dll
API String ID: 2049529260-4205908389
Opcode ID: 52d1773c9b833a77158fad08d9f8ce235cd4cc10a8395c45978d5a252f3b0d1f
Instruction ID: 51e03524b90964fa810cb5bd131530c19f7557463613040266fa9c000a303f04
Opcode Fuzzy Hash: 52d1773c9b833a77158fad08d9f8ce235cd4cc10a8395c45978d5a252f3b0d1f
Instruction Fuzzy Hash: B221AC71A00319AFCF10DFE0EDC69AEBBB9EF54304B14453AE101E3190E6B0DA499B78

Function 00D3A4DB Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 93COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D3A4E2

Strings

TargetPath, xrefs: 00D3A54C
PublicKey, xrefs: 00D3A5AB
Name, xrefs: 00D3A567
HomeSite, xrefs: 00D3A5C8
UrlName, xrefs: 00D3A57E
Hash, xrefs: 00D3A59C
Size, xrefs: 00D3A58A

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_
String ID: Hash$HomeSite$Name$PublicKey$Size$TargetPath$UrlName
API String ID: 2427045233-2227013664
Opcode ID: 399ffc79609a4b43a1c64a445b3da019ded7fa2abe6d96df62273ccca2e86558
Instruction ID: 3c0bfd3f407bb87b8cdbb746d1c3b3a0cc763271853acffbc95876478f2bcdef
Opcode Fuzzy Hash: 399ffc79609a4b43a1c64a445b3da019ded7fa2abe6d96df62273ccca2e86558
Instruction Fuzzy Hash: 883148B0900704AFC710DFA9D841A9BFBE8FF69714F00492EF89AA3651D770A504CB35

Function 00D343DE Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D343E5
std::_Lockit::_Lockit.LIBCPMT ref: 00D343F2

Part of subcall function 00D3187C: std::_Lockit::_Lockit.LIBCPMT ref: 00D3189A

std::locale::_Getfacet.LIBCPMT ref: 00D34411
ctype.LIBCPMT ref: 00D34429
std::bad_exception::bad_exception.LIBCMT ref: 00D3443D
__CxxThrowException@8.LIBCMT ref: 00D3444B
std::locale::facet::_Facet_Register.LIBCPMT ref: 00D34461

Strings

bad cast, xrefs: 00D34435

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_GetfacetH_prolog3_RegisterThrowctypestd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_
String ID: bad cast
API String ID: 894495367-3145022300
Opcode ID: f949e1a5c127b5ed25e6fa64f18abdac6d6825736cbf9f158c309b96dbe18a4d
Instruction ID: 6015256d91fd60001229158ae00ec5b59ce7d0874219668ca382ade609a8c0de
Opcode Fuzzy Hash: f949e1a5c127b5ed25e6fa64f18abdac6d6825736cbf9f158c309b96dbe18a4d
Instruction Fuzzy Hash: 4E0184396003055BCB14EBB499426AE7374EF54320F644539E211A72D2DF78AE448BB0

Function 00D3433C Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D34343
std::_Lockit::_Lockit.LIBCPMT ref: 00D34350

Part of subcall function 00D3187C: std::_Lockit::_Lockit.LIBCPMT ref: 00D3189A

std::locale::_Getfacet.LIBCPMT ref: 00D3436F
ctype.LIBCPMT ref: 00D34387
std::bad_exception::bad_exception.LIBCMT ref: 00D3439B
__CxxThrowException@8.LIBCMT ref: 00D343A9
std::locale::facet::_Facet_Register.LIBCPMT ref: 00D343BF

Strings

bad cast, xrefs: 00D34393

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_GetfacetH_prolog3_RegisterThrowctypestd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_
String ID: bad cast
API String ID: 894495367-3145022300
Opcode ID: 5a50c0a6d08912fc9b75c388e9e88fad7755118c95e3724bc44c140b5d646e68
Instruction ID: 4afe3fef3dc12df808321379725ef705abe661f08f9af1e834d91d08e3e926b6
Opcode Fuzzy Hash: 5a50c0a6d08912fc9b75c388e9e88fad7755118c95e3724bc44c140b5d646e68
Instruction Fuzzy Hash: B7015275A403096BCB14FBB4C993AAEB774EF54320F640629E211A72D2DF74AE4497B0

Function 00D34C09 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D34C10
std::_Lockit::_Lockit.LIBCPMT ref: 00D34C1D

Part of subcall function 00D3187C: std::_Lockit::_Lockit.LIBCPMT ref: 00D3189A

std::locale::_Getfacet.LIBCPMT ref: 00D34C3C
codecvt.LIBCPMT ref: 00D34C54
std::bad_exception::bad_exception.LIBCMT ref: 00D34C68
__CxxThrowException@8.LIBCMT ref: 00D34C76
std::locale::facet::_Facet_Register.LIBCPMT ref: 00D34C8C

Strings

bad cast, xrefs: 00D34C60

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_GetfacetH_prolog3_RegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_
String ID: bad cast
API String ID: 2707858659-3145022300
Opcode ID: 30d632a3d6657920fc83611cf17915ad2e1f8f7ed3c517b69d9693593c0960a8
Instruction ID: 3dd2276758ad899492a3b9653496a02ee08f883ffca737402972900d7b14d97b
Opcode Fuzzy Hash: 30d632a3d6657920fc83611cf17915ad2e1f8f7ed3c517b69d9693593c0960a8
Instruction Fuzzy Hash: 57019635A013056BCB04FBB4C9929BE7774EF54320F640928F211A72D2DF749E4497B0

Function 00D355CA Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D355D1
std::_Lockit::_Lockit.LIBCPMT ref: 00D355DE

Part of subcall function 00D3187C: std::_Lockit::_Lockit.LIBCPMT ref: 00D3189A

std::locale::_Getfacet.LIBCPMT ref: 00D355FD
messages.LIBCPMT ref: 00D35615
std::bad_exception::bad_exception.LIBCMT ref: 00D35629
__CxxThrowException@8.LIBCMT ref: 00D35637
std::locale::facet::_Facet_Register.LIBCPMT ref: 00D3564D

Strings

bad cast, xrefs: 00D35621

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_GetfacetH_prolog3_RegisterThrowmessagesstd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_
String ID: bad cast
API String ID: 2776438353-3145022300
Opcode ID: 619fbdbefe380ff15a41a607bd60b8f30a138ba1cd041e90a6b2b571233ae78d
Instruction ID: c19f2bb190e1318700760aacf6746c1357aeada52af386b501c8878d568c4d2c
Opcode Fuzzy Hash: 619fbdbefe380ff15a41a607bd60b8f30a138ba1cd041e90a6b2b571233ae78d
Instruction Fuzzy Hash: 5D018075A00605ABCB04FBB4D993AAEB774EF54320F640A28F111A72D2DF749E4497B0

Function 00D35528 Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D3552F
std::_Lockit::_Lockit.LIBCPMT ref: 00D3553C

Part of subcall function 00D3187C: std::_Lockit::_Lockit.LIBCPMT ref: 00D3189A

std::locale::_Getfacet.LIBCPMT ref: 00D3555B
codecvt.LIBCPMT ref: 00D35573
std::bad_exception::bad_exception.LIBCMT ref: 00D35587
__CxxThrowException@8.LIBCMT ref: 00D35595
std::locale::facet::_Facet_Register.LIBCPMT ref: 00D355AB

Strings

bad cast, xrefs: 00D3557F

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_GetfacetH_prolog3_RegisterThrowcodecvtstd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_
String ID: bad cast
API String ID: 2707858659-3145022300
Opcode ID: 440bc1b8699718d6e41429932540d65aecdc384b02d7d162f017aa59a1f4cadd
Instruction ID: d0f637914c00f2b8e053ccc5970ebf8be7468ae7432846ec9299324715a53588
Opcode Fuzzy Hash: 440bc1b8699718d6e41429932540d65aecdc384b02d7d162f017aa59a1f4cadd
Instruction Fuzzy Hash: FD0184356017055BCB04FBB4D9525AEB374EF58320F640528F112A72D2EF74AE449770

Function 00D3566C Relevance: 14.0, APIs: 7, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D35673
std::_Lockit::_Lockit.LIBCPMT ref: 00D35680

Part of subcall function 00D3187C: std::_Lockit::_Lockit.LIBCPMT ref: 00D3189A

std::locale::_Getfacet.LIBCPMT ref: 00D3569F
numpunct.LIBCPMT ref: 00D356B7
std::bad_exception::bad_exception.LIBCMT ref: 00D356CB
__CxxThrowException@8.LIBCMT ref: 00D356D9
std::locale::facet::_Facet_Register.LIBCPMT ref: 00D356EF

Strings

bad cast, xrefs: 00D356C3

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_GetfacetH_prolog3_RegisterThrownumpunctstd::bad_exception::bad_exceptionstd::locale::_std::locale::facet::_
String ID: bad cast
API String ID: 3998126553-3145022300
Opcode ID: c3d91123321fbc6422ee953a7f2a5ca1bb99f2afc3cf98a5fd3d9c408ce05907
Instruction ID: 96cf4652ca37694275e1a9f2eba8f9ae3b4b02658f73378b826c5637b4ad2c0d
Opcode Fuzzy Hash: c3d91123321fbc6422ee953a7f2a5ca1bb99f2afc3cf98a5fd3d9c408ce05907
Instruction Fuzzy Hash: 7F01963AA0070557CB04FBB4D9536AEB374EF18320F640528F111A72D6DF749E459BB0

Function 00D4968D Relevance: 13.6, APIs: 9, Instructions: 137windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D2B217: std::_Xinvalid_argument.LIBCPMT ref: 00D2B233

Part of subcall function 00D2B217: _memmove.LIBCMT ref: 00D2B28E

Part of subcall function 00D49034: __EH_prolog3_GS.LIBCMT ref: 00D4903E
Part of subcall function 00D49034: SystemParametersInfoW.USER32(00000029,000001F4,?,00000000), ref: 00D490A1
Part of subcall function 00D49034: FindResourceW.KERNEL32(?,?,00000005,Fonts,?,?), ref: 00D4919A
Part of subcall function 00D49034: LoadResource.KERNEL32(?,00000000,?,?), ref: 00D491AA
Part of subcall function 00D49034: LockResource.KERNEL32(00000000,?,?), ref: 00D491B5
Part of subcall function 00D49034: SizeofResource.KERNEL32(?,00000000,00000000,?,?,?,?), ref: 00D491D0
Part of subcall function 00D49034: CreateDialogIndirectParamW.USER32(?,?,?,?,?), ref: 00D491FB

SetWindowTextW.USER32(?,?), ref: 00D49712
LoadImageW.USER32(?,0000006B,00000001,00000000,00000000,00008000), ref: 00D49726
SetClassLongW.USER32(?,000000DE,00000000), ref: 00D49736
GetDlgItem.USER32(00000433,00000434), ref: 00D497C7
GetWindowRect.USER32(00000000), ref: 00D497CA
LoadImageW.USER32(?,0000006C,00000001,?,?,00000000), ref: 00D497E6
SendDlgItemMessageW.USER32(00000433,0000042C,000000F7,00000001,00000000), ref: 00D497FC
GetDlgItem.USER32(00000433,00000434), ref: 00D4980B
ShowWindow.USER32(00000000), ref: 00D4980E

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Resource$ItemLoadWindow$Image$ClassCreateDialogFindH_prolog3_IndirectInfoLockLongMessageParamParametersRectSendShowSizeofSystemTextXinvalid_argument_memmovestd::_
String ID:
API String ID: 2976025800-0
Opcode ID: 788393c1fe351e04a891b9fc98db3e71fbd370d1aecef7298771fbc3ef5bd33f
Instruction ID: 5a685c3930350d1b7611e332fa2187604362b4816a9dc04a4c19eb1a419c6e80
Opcode Fuzzy Hash: 788393c1fe351e04a891b9fc98db3e71fbd370d1aecef7298771fbc3ef5bd33f
Instruction Fuzzy Hash: 2B515BB0A00209EFDB20DF95DC89EAFBBBAFF58710F004519F651A62A1C7719945CB74

Function 00D43A7B Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 341windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D43A85

Part of subcall function 00D3F7A2: __EH_prolog3_GS.LIBCMT ref: 00D3F7A9

MessageBoxW.USER32(00000000,?,?,00000040), ref: 00D43D51

Part of subcall function 00D4201F: __EH_prolog3_GS.LIBCMT ref: 00D42026

Part of subcall function 00D482CB: SetDlgItemTextW.USER32(?,0000042E,00D216C0), ref: 00D482DE

Part of subcall function 00D4993B: __EH_prolog3_GS.LIBCMT ref: 00D49942

Strings

EULA for components '%s' was accepted., xrefs: 00D43BC8
EULA for components '%s' was declined., xrefs: 00D43E0C
Installation of components '%s' was declined., xrefs: 00D43D6C
Installation of components '%s' was accepted., xrefs: 00D43E68

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_$ItemMessageText
String ID: EULA for components '%s' was accepted.$EULA for components '%s' was declined.$Installation of components '%s' was accepted.$Installation of components '%s' was declined.
API String ID: 3858461166-97280692
Opcode ID: 45e7cc0c934c0cfc19ad476b4498cb7ccb359724ec4791c80e2235fc7b8bce43
Instruction ID: 8ee62cbf749012ef7255e84806f2d78f20af4f631feb6c7e9d656b4205e97303
Opcode Fuzzy Hash: 45e7cc0c934c0cfc19ad476b4498cb7ccb359724ec4791c80e2235fc7b8bce43
Instruction Fuzzy Hash: 5DD14871E00218AFDB15EFA9D992BEDBBB8EF18704F504069F209A7182DB705A44CF75

Function 00D4AF1E Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 140COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D4AF6B
std::_Xinvalid_argument.LIBCPMT ref: 00D4AF8E
_memmove.LIBCMT ref: 00D4AFCC
_memmove.LIBCMT ref: 00D4B034
_memmove.LIBCMT ref: 00D4B055

Strings

string too long, xrefs: 00D4AF89
invalid string position, xrefs: 00D4AF66

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: _memmove$Xinvalid_argumentstd::_
String ID: invalid string position$string too long
API String ID: 1771113911-4289949731
Opcode ID: d45ad543010d92d2a3e511e0cff09a8ded37cfd97cf328fc013d814b9174cc88
Instruction ID: cfaa9551056ca147d6c61089d816c64b3369738f02c056b34c7ff2750216a8bd
Opcode Fuzzy Hash: d45ad543010d92d2a3e511e0cff09a8ded37cfd97cf328fc013d814b9174cc88
Instruction Fuzzy Hash: 5A41BF70200108ABCF24CF1CD8848ABB7B6EF91715B24492EF8568B251DB31ED19CBB5

Function 00D437A1 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 115COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D437A8
GetCurrentProcessId.KERNEL32(00000064), ref: 00D437D5

Part of subcall function 00D4C774: __EH_prolog3_GS.LIBCMT ref: 00D4C77B

Strings

vsbootstrapper, xrefs: 00D437DB
Unable to set RunOnce key. RegSetValue failed with error code '%d', xrefs: 00D438A0
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00D43851
Unable to set RunOnce key. RegCreateKey failed with error code '%d', xrefs: 00D43869
%s_%d, xrefs: 00D437E3

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_$CurrentProcess
String ID: %s_%d$SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce$Unable to set RunOnce key. RegCreateKey failed with error code '%d'$Unable to set RunOnce key. RegSetValue failed with error code '%d'$vsbootstrapper
API String ID: 2139083982-46394189
Opcode ID: 10478a78d81db7292a044a754d6eca37fd2c25ef9b75c44489d52a6d86414e07
Instruction ID: eb1b976e72eaefa71333a7fcd080f2ca34113be3457dd0f08e799c2b3259cef9
Opcode Fuzzy Hash: 10478a78d81db7292a044a754d6eca37fd2c25ef9b75c44489d52a6d86414e07
Instruction Fuzzy Hash: 584125B1D01228ABDF20DBE8EC859EEFBB8EF59714F10402AF409A7111D7705A49CBB0

Function 00D4A455 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00D49FAB: _memset.LIBCMT ref: 00D49FD6
Part of subcall function 00D49FAB: GetVersionExW.KERNEL32(?,?,?), ref: 00D49FEF

_memset.LIBCMT ref: 00D4A48C
ShellExecuteExW.SHELL32(0000003C), ref: 00D4A4E4

Part of subcall function 00D2A9C9: WriteFile.KERNEL32(?,?,?,00000000,00000000), ref: 00D2AA09

CloseHandle.KERNEL32(?,?,00000001), ref: 00D4A505

Strings

runas, xrefs: 00D4A4D9
Will attempt to elevate process., xrefs: 00D4A4C1
@, xrefs: 00D4A4A5
<, xrefs: 00D4A498

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: _memset$CloseExecuteFileHandleShellVersionWrite
String ID: <$@$Will attempt to elevate process.$runas
API String ID: 2938871625-2395962226
Opcode ID: 18b83dbec241336e1d28994f5731b2728e5fa7286cd9ab3ee7cc162c514b0f2c
Instruction ID: 4418d82d735df31953a4f38c83fbb8bbc8276ef5dfdb8b07cba76b55428f5fb4
Opcode Fuzzy Hash: 18b83dbec241336e1d28994f5731b2728e5fa7286cd9ab3ee7cc162c514b0f2c
Instruction Fuzzy Hash: 9E216D75A00318EFDF10DF98D845B8EBBB8EF54304F55405AE905EB290D7B4AA45CB71

Function 00D3A702 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D3A709
InitializeCriticalSection.KERNEL32(?,00000004,00D3C704,0000000C,00D439B1), ref: 00D3A763

Part of subcall function 00D4CDA4: _memset.LIBCMT ref: 00D4CDD4
Part of subcall function 00D4CDA4: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00D4CDE9
Part of subcall function 00D4CDA4: _memset.LIBCMT ref: 00D4CE19
Part of subcall function 00D4CDA4: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00D4CE29
Part of subcall function 00D4CDA4: LoadLibraryW.KERNEL32(?), ref: 00D4CE52

GetProcAddress.KERNEL32(00000000,URLDownloadToFileW), ref: 00D3A793
GetProcAddress.KERNEL32(?,URLDownloadToCacheFileW), ref: 00D3A7A3

Strings

URLDownloadToFileW, xrefs: 00D3A78D
URLDownloadToCacheFileW, xrefs: 00D3A795
urlmon.dll, xrefs: 00D3A769

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: AddressDirectoryProc_memset$CriticalH_prolog3InitializeLibraryLoadSectionSystemWindows
String ID: URLDownloadToCacheFileW$URLDownloadToFileW$urlmon.dll
API String ID: 1362827196-2432372630
Opcode ID: 8f85652ff12d7958aa9b5dabb1de0b5ae83ddb9052d747a30a629ebfab21db70
Instruction ID: 2c0cb2a7273285812926fb70caba993ecc12540004c6036d4e4cd2c22370431b
Opcode Fuzzy Hash: 8f85652ff12d7958aa9b5dabb1de0b5ae83ddb9052d747a30a629ebfab21db70
Instruction Fuzzy Hash: 7C21EFB1901B508FD371DF7A9985606FAF0BF28700B908D2EE29EC3B21DB70A044CB64

Function 00D4D462 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 52libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4CDA4: _memset.LIBCMT ref: 00D4CDD4
Part of subcall function 00D4CDA4: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00D4CDE9
Part of subcall function 00D4CDA4: _memset.LIBCMT ref: 00D4CE19
Part of subcall function 00D4CDA4: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00D4CE29
Part of subcall function 00D4CDA4: LoadLibraryW.KERNEL32(?), ref: 00D4CE52

GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00D4D498
FreeLibrary.KERNEL32(00000000,?,00D4D9E6,00000000,?,00000000,00000001,?,?), ref: 00D4D49F
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00D4D4B8
FreeLibrary.KERNEL32(00000000,?,00D4D9E6,00000000,?,00000000,00000001,?,?), ref: 00D4D4D3

Strings

shell32.dll, xrefs: 00D4D46E
shfolder.dll, xrefs: 00D4D4A5
SHGetFolderPathW, xrefs: 00D4D491, 00D4D496, 00D4D4B6

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Library$AddressDirectoryFreeProc_memset$LoadSystemWindows
String ID: SHGetFolderPathW$shell32.dll$shfolder.dll
API String ID: 2049529260-240897930
Opcode ID: 3fd24abac9e0e8afe05ec90cd90ff7c15c5618b1b85fc2cfa3c3e4e3d24b708a
Instruction ID: 64ab8462a9cb2e4fc3a67563e5b1c6395e01ac9a8ea8d7108d4acd59f00c9744
Opcode Fuzzy Hash: 3fd24abac9e0e8afe05ec90cd90ff7c15c5618b1b85fc2cfa3c3e4e3d24b708a
Instruction Fuzzy Hash: EC01DF32600346FB9F119FE5DD80C9B3FADEFA93107048029FA00E6510CB72D8118B70

Function 00D3B8AD Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 215COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00D3B8B7
GetLastError.KERNEL32 ref: 00D3BA56
__CxxThrowException@8.LIBCMT ref: 00D3BA95

Strings

Copying from '%s' to '%s', xrefs: 00D3BA20
File '%s' not found. Skipping file copy., xrefs: 00D3B9C2
File '%s' already copied. Skipping file copy., xrefs: 00D3B9ED

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: ErrorException@8H_prolog3_catch_LastThrow
String ID: Copying from '%s' to '%s'$File '%s' already copied. Skipping file copy.$File '%s' not found. Skipping file copy.
API String ID: 3568844311-1508121953
Opcode ID: 3d4bf32e8750bc3046cfa143265aa96c1f765d96f30b8225900e836ae9ee19f2
Instruction ID: dd715e382fbead8251ddbc550a428b08a420491063c932b5565095a5e60c925d
Opcode Fuzzy Hash: 3d4bf32e8750bc3046cfa143265aa96c1f765d96f30b8225900e836ae9ee19f2
Instruction Fuzzy Hash: 34815971910218ABCF15DB98DC86EEEBBB8FF55320F40805AE649A7141EB709A45CF71

Function 00D3AC0E Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 153registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D3AC18

Part of subcall function 00D4CE6C: __EH_prolog3_GS.LIBCMT ref: 00D4CE76
Part of subcall function 00D4CE6C: GetComputerObjectNameW.SECUR32 ref: 00D4CE95

RegQueryValueExW.ADVAPI32 ref: 00D3ACB7

Part of subcall function 00D4D036: __EH_prolog3_GS.LIBCMT ref: 00D4D03D
Part of subcall function 00D4D036: _memset.LIBCMT ref: 00D4D070
Part of subcall function 00D4D036: InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 00D4D0AD

Part of subcall function 00D4CF99: __EH_prolog3_GS.LIBCMT ref: 00D4CFA0
Part of subcall function 00D4CF99: _memset.LIBCMT ref: 00D4CFD3
Part of subcall function 00D4CF99: InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 00D4D010

Part of subcall function 00D4D0D3: InternetCombineUrlW.WININET(?,?,?,00000825,20000000), ref: 00D4D167

Part of subcall function 00D2D096: _memmove.LIBCMT ref: 00D2D0BF

Part of subcall function 00D2AA24: _memmove.LIBCMT ref: 00D2AA49

Strings

DownloadManager, xrefs: 00D3AC9C
Software\Microsoft\VisualStudio\Setup, xrefs: 00D3AC6E
http://, xrefs: 00D3AD49
Downloading "%s" instead of "%s", xrefs: 00D3AE1B

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_$Internet$Crack_memmove_memset$CombineComputerNameObjectQueryValue
String ID: DownloadManager$Downloading "%s" instead of "%s"$Software\Microsoft\VisualStudio\Setup$http://
API String ID: 551540626-1408139357
Opcode ID: 967d24384b54e0c4a81082a96e73ef172dda7c6d432478e7f0cd97dd89285d46
Instruction ID: 69c832b4594dcb2138040267ac69577645e667ecea4cfead67ba77ddfc2abd4f
Opcode Fuzzy Hash: 967d24384b54e0c4a81082a96e73ef172dda7c6d432478e7f0cd97dd89285d46
Instruction Fuzzy Hash: EB510971901268AACB61EB55DD45EEEB7FCFF65304F0480DAB489A2141DE345B88CFB1

Function 00D2E4DB Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 145COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D2E4E5

Strings

Attempting to find '%s' in the Global Assembly Cache, xrefs: 00D2E542
AssemblyCheck: Error creating assembly cache: %d, xrefs: 00D2E58B
AssemblyCheck: Error querying assembly info: %d, xrefs: 00D2E5D1
Could not get AssemblyCache, xrefs: 00D2E562
Assembly found at '%s', xrefs: 00D2E5F0

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_
String ID: Assembly found at '%s'$AssemblyCheck: Error creating assembly cache: %d$AssemblyCheck: Error querying assembly info: %d$Attempting to find '%s' in the Global Assembly Cache$Could not get AssemblyCache
API String ID: 2427045233-1108112992
Opcode ID: e656b905ebf18cec6a5d628c8fe948eecd366ac0116b11b04e066f7a337ecacb
Instruction ID: 4385664d868586e604b97853f939b270f817d27d3e6b2f2bdbd2a5563052971c
Opcode Fuzzy Hash: e656b905ebf18cec6a5d628c8fe948eecd366ac0116b11b04e066f7a337ecacb
Instruction Fuzzy Hash: 52516D70944328DFDF10DFA8E881AEDBBB4EF28308F508459F509A7291DB705A88CB71

Function 00D4B31B Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 98memoryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00D4B322
std::_Xinvalid_argument.LIBCPMT ref: 00D4B352

Part of subcall function 00D6291B: std::exception::exception.LIBCMT ref: 00D62930
Part of subcall function 00D6291B: __CxxThrowException@8.LIBCMT ref: 00D62945

_Allocate.LIBCPMT ref: 00D4B376
_memmove.LIBCMT ref: 00D4B395
_memmove.LIBCMT ref: 00D4B3C2

Strings

vector<T> too long, xrefs: 00D4B34D

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: _memmove$AllocateException@8H_prolog3_catchThrowXinvalid_argumentstd::_std::exception::exception
String ID: vector<T> too long
API String ID: 453418590-3788999226
Opcode ID: e988b28cbb86b583e76735ff98d62a79fac0949539f173dfcee193b258933138
Instruction ID: adbc92765bfa834e7760ab126af947f59e5e8a92538e1455c60583271cf7c5b2
Opcode Fuzzy Hash: e988b28cbb86b583e76735ff98d62a79fac0949539f173dfcee193b258933138
Instruction Fuzzy Hash: 9631A07160060AAFCB14DFB8CC86D7E77A5EF54314B14892DF99A97281EB71E9108B70

Function 00D3DC63 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 87COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D3DC6D

Part of subcall function 00D2AD06: __EH_prolog3_GS.LIBCMT ref: 00D2AD0D

Strings

True, xrefs: 00D3DD43
Code, xrefs: 00D3DD29
Package, xrefs: 00D3DD0C
Writing Reboot Information to '%s', xrefs: 00D3DC76
Installed, xrefs: 00D3DD48

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_
String ID: Code$Installed$Package$True$Writing Reboot Information to '%s'
API String ID: 2427045233-1329836656
Opcode ID: add495db35092dab360b963bed216d7c6b1b7f5763ff4951c9bd6918448adfc9
Instruction ID: 9d454350341418343f95e037cdab923986460a7c57e949ccad74489cc02487f4
Opcode Fuzzy Hash: add495db35092dab360b963bed216d7c6b1b7f5763ff4951c9bd6918448adfc9
Instruction Fuzzy Hash: BD310670D002289FCB14EF68E882BDDB7B1EF25304F5081A9E559B3292DB706A48CF71

Function 00D2D9F3 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D2D9FA

Part of subcall function 00D2D49E: __EH_prolog3.LIBCMT ref: 00D2D4A5
Part of subcall function 00D2D49E: __CxxThrowException@8.LIBCMT ref: 00D2D4F8

Strings

No Key value specified for Registry File Check '%s'., xrefs: 00D2DA6C
FileName, xrefs: 00D2DA87
Value, xrefs: 00D2DA79
SearchDepth, xrefs: 00D2DA98
Key, xrefs: 00D2DA45

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID: FileName$Key$No Key value specified for Registry File Check '%s'.$SearchDepth$Value
API String ID: 2489616738-425042624
Opcode ID: b48799aeb1769a8a6eb5906f2ce5cee3b2a3a6eebec7b77474a8f44c47bfe751
Instruction ID: 8f04c2c956397e59bb549eea39a3fba55e34267d3b5bcaddd90bec7c6bde1758
Opcode Fuzzy Hash: b48799aeb1769a8a6eb5906f2ce5cee3b2a3a6eebec7b77474a8f44c47bfe751
Instruction Fuzzy Hash: D721DF70904704BFCB08EF65E841A5ABBE1FF69B04B008469F8089B271D7B0E645CBB5

Function 00D2D7CB Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D2D7D2

Part of subcall function 00D2D49E: __EH_prolog3.LIBCMT ref: 00D2D4A5
Part of subcall function 00D2D49E: __CxxThrowException@8.LIBCMT ref: 00D2D4F8

Strings

No FileName value specified for File Check '%s'., xrefs: 00D2D844
SearchPath, xrefs: 00D2D851
FileName, xrefs: 00D2D81D
SearchDepth, xrefs: 00D2D870
SpecialFolder, xrefs: 00D2D85F

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID: FileName$No FileName value specified for File Check '%s'.$SearchDepth$SearchPath$SpecialFolder
API String ID: 2489616738-2343128853
Opcode ID: c62601a5a6c216cb502322e3601522addc22f0c744040e9918549cb9bf83e973
Instruction ID: 7991584f49009abdf0b81f875a98a6fa923c74b82fe02c1dcbafe68651f4d74b
Opcode Fuzzy Hash: c62601a5a6c216cb502322e3601522addc22f0c744040e9918549cb9bf83e973
Instruction Fuzzy Hash: 5321CD71940704BFCB18EF65E801A5ABBE5FF68704B008469F4488B261D7B0E644CBB5

Function 00D65B0C Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 00D65B13

Part of subcall function 00D52E75: GetLastError.KERNEL32(?,?,00D5542E,00D4FAC4,?,?,00D4ECF2,?,?,00D2A8F8), ref: 00D52E79
Part of subcall function 00D52E75: ___set_flsgetvalue.LIBCMT ref: 00D52E87
Part of subcall function 00D52E75: __calloc_crt.LIBCMT ref: 00D52E9B
Part of subcall function 00D52E75: _DecodePointerInternal@4.SETUP(00000000,?,?,00D5542E,00D4FAC4,?,?,00D4ECF2,?,?,00D2A8F8), ref: 00D52EB5
Part of subcall function 00D52E75: __initptd.LIBCMT ref: 00D52EC4
Part of subcall function 00D52E75: GetCurrentThreadId.KERNEL32 ref: 00D52ECB
Part of subcall function 00D52E75: SetLastError.KERNEL32(00000000,?,?,00D5542E,00D4FAC4,?,?,00D4ECF2,?,?,00D2A8F8), ref: 00D52EE3

__calloc_crt.LIBCMT ref: 00D65B35
__get_sys_err_msg.LIBCMT ref: 00D65B53
_strcpy_s.LIBCMT ref: 00D65B5B
__invoke_watson.LIBCMT ref: 00D65B70

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 00D65B20, 00D65B43

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: ErrorLast__calloc_crt$CurrentDecodeInternal@4PointerThread___set_flsgetvalue__get_sys_err_msg__getptd_noexit__initptd__invoke_watson_strcpy_s
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 2148361204-798102604
Opcode ID: 4c292cd1841b442c56ab2f6e9199d7c7e943b195b5d8e7cde46d7d4c5042352c
Instruction ID: 7ed427e929352da367787fd413c02daa268429bf7aa795a18652cb9b220df623
Opcode Fuzzy Hash: 4c292cd1841b442c56ab2f6e9199d7c7e943b195b5d8e7cde46d7d4c5042352c
Instruction Fuzzy Hash: A2F02422600A106BDB30792D7CC2E2BB29CDB65B65F18003AFD0A97209F921DC8542B4

Function 00D53A28 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00D53A49

Part of subcall function 00D52EF3: __getptd_noexit.LIBCMT ref: 00D52EF6
Part of subcall function 00D52EF3: __amsg_exit.LIBCMT ref: 00D52F03

__getptd.LIBCMT ref: 00D53A5A
__getptd.LIBCMT ref: 00D53A68

Strings

csm, xrefs: 00D53A42
MOC, xrefs: 00D53A3B
RCC, xrefs: 00D53A34

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: MOC$RCC$csm
API String ID: 803148776-2671469338
Opcode ID: 74257bb0f9998e6f45ce478ddcbee54ba1a33af80dc38de670e750f0a549a9c8
Instruction ID: 38fbc0b5a1435181f5cfbdd9b12e754540bb59f107b22d60229d1147cd127d1e
Opcode Fuzzy Hash: 74257bb0f9998e6f45ce478ddcbee54ba1a33af80dc38de670e750f0a549a9c8
Instruction Fuzzy Hash: A4E012301002448FDF14A764C0CA77833D4FB4935AF1A10A1ED8DC7662CB78DD5D59B2

Function 00D39BDD Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 17libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,?,00D39C2D), ref: 00D39BEC
GetProcAddress.KERNEL32(00000000,EncodePointer), ref: 00D39C03
GetProcAddress.KERNEL32(DecodePointer), ref: 00D39C15

Strings

DecodePointer, xrefs: 00D39C05
kernel32.dll, xrefs: 00D39BE7
EncodePointer, xrefs: 00D39BF8

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: DecodePointer$EncodePointer$kernel32.dll
API String ID: 2238633743-1525541703
Opcode ID: a41605b6708998fd1673f0f879937987835274e4c9d6a8f0c6a3ef255d09e3bb
Instruction ID: 3cbf9d14ee0908bdf3d73736efb20abbd36062d44a01ff7981e2e6f96579a3ae
Opcode Fuzzy Hash: a41605b6708998fd1673f0f879937987835274e4c9d6a8f0c6a3ef255d09e3bb
Instruction Fuzzy Hash: 77E0EC7ED64324AECB109F79BD08949BEB4AF28755B004256E508D23A0E3740494CF70

Function 00D36FF1 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 399COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D36FFB
std::ios_base::getloc.LIBCPMT ref: 00D3703C

Part of subcall function 00D3566C: __EH_prolog3_GS.LIBCMT ref: 00D35673
Part of subcall function 00D3566C: std::_Lockit::_Lockit.LIBCPMT ref: 00D35680
Part of subcall function 00D3566C: std::locale::_Getfacet.LIBCPMT ref: 00D3569F

_localeconv.LIBCMT ref: 00D370A3
_strcspn.LIBCMT ref: 00D371AB

Strings

e, xrefs: 00D370B5

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_$GetfacetLockitLockit::__localeconv_strcspnstd::_std::ios_base::getlocstd::locale::_
String ID: e
API String ID: 2496886237-4024072794
Opcode ID: 0b256931cd7022728db9ce39cfbe471f841bc76d78d698d38c9007dff4477cd6
Instruction ID: fc67a8bb2664b03893dc6537748be4b91c7c6551848e576e2426183d101604fc
Opcode Fuzzy Hash: 0b256931cd7022728db9ce39cfbe471f841bc76d78d698d38c9007dff4477cd6
Instruction Fuzzy Hash: D90226B1D04249AFDF15DFE8C980AEDBBB5FF08300F048069E905AB262D771AA55CF60

Function 00D53D13 Relevance: 9.0, APIs: 6, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__CreateFrameInfo.LIBCMT ref: 00D53D3B

Part of subcall function 00D4F264: __getptd.LIBCMT ref: 00D4F272
Part of subcall function 00D4F264: __getptd.LIBCMT ref: 00D4F280

__getptd.LIBCMT ref: 00D53D45

Part of subcall function 00D52EF3: __getptd_noexit.LIBCMT ref: 00D52EF6
Part of subcall function 00D52EF3: __amsg_exit.LIBCMT ref: 00D52F03

__getptd.LIBCMT ref: 00D53D53
__getptd.LIBCMT ref: 00D53D61
__getptd.LIBCMT ref: 00D53D6C
_CallCatchBlock2.LIBCMT ref: 00D53D92

Part of subcall function 00D4F318: __CallSettingFrame@12.LIBCMT ref: 00D4F364

Part of subcall function 00D53E39: __getptd.LIBCMT ref: 00D53E48
Part of subcall function 00D53E39: __getptd.LIBCMT ref: 00D53E56

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: __getptd$Call$Block2CatchCreateFrameFrame@12InfoSetting__amsg_exit__getptd_noexit
String ID:
API String ID: 1602911419-0
Opcode ID: e4de470c17cd6959889b4769de72ff785a44a2e30b04ca665f8f65c44db4607e
Instruction ID: d261a70ba3f1842df456a3731b8dc0953bbe4c0d976def55e9a9dc1d90899d82
Opcode Fuzzy Hash: e4de470c17cd6959889b4769de72ff785a44a2e30b04ca665f8f65c44db4607e
Instruction Fuzzy Hash: 1111D3B1C00249DFDF04EFA4D886BAD7BB0FB09311F108469FC14A7251DB789A199B60

Function 00D54A03 Relevance: 9.0, APIs: 6, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00D54A0F

Part of subcall function 00D52EF3: __getptd_noexit.LIBCMT ref: 00D52EF6
Part of subcall function 00D52EF3: __amsg_exit.LIBCMT ref: 00D52F03

__amsg_exit.LIBCMT ref: 00D54A2F
__lock.LIBCMT ref: 00D54A3F
InterlockedDecrement.KERNEL32(?), ref: 00D54A5C
_free.LIBCMT ref: 00D54A6F
InterlockedIncrement.KERNEL32(02351878), ref: 00D54A87

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock_free
String ID:
API String ID: 3470314060-0
Opcode ID: 14a20b1b0803a558a9402c897eef7ede7600e348182ccd842c063f5f95236d19
Instruction ID: 1dcb6c3682d3445410f73e344590d703bae02133e000cb4efff45a8f937e776f
Opcode Fuzzy Hash: 14a20b1b0803a558a9402c897eef7ede7600e348182ccd842c063f5f95236d19
Instruction Fuzzy Hash: 0601A131A81711EBCF61AB64940A7597760FB0475EF084215EC04A7691DB3499C9CBFA

Function 00D4868C Relevance: 9.0, APIs: 6, Instructions: 43windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 00D486A2
GetDlgItem.USER32(000000FF,00000066), ref: 00D486B5
GetDlgItem.USER32(000000FF,000003EF), ref: 00D486C3
GetDlgItem.USER32(000000FF,0000040A), ref: 00D486D1
GetDlgItem.USER32(000000FF,00000000), ref: 00D486E7
SetFocus.USER32(00000000), ref: 00D486EE

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Item$Focus
String ID:
API String ID: 2803794159-0
Opcode ID: 2f6d1a5589f5fbddd342ee7149fb99fec0196b13270eb2d08b64cb1ebf93e404
Instruction ID: 968e1bcb9572e6c4fc3dc464002914ecf086b23dbf9be0a2120285b75e60fc49
Opcode Fuzzy Hash: 2f6d1a5589f5fbddd342ee7149fb99fec0196b13270eb2d08b64cb1ebf93e404
Instruction Fuzzy Hash: E0F0FF31500304BBDB712B60DC45A6E7A98EB603E1F1A8231F651E15B0DFB29892AA78

Function 00D4DCB7 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 202COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D4DCBE

Part of subcall function 00D4A0E5: GetFileAttributesW.KERNEL32(00D2E067,?,00D2E067,?), ref: 00D4A0F8

__CxxThrowException@8.LIBCMT ref: 00D4DDC2

Strings

Verifying file hash, xrefs: 00D4DD5D
No hash or public key info found., xrefs: 00D4DEFB
Verifying file integrity of %s, xrefs: 00D4DCE6

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: AttributesException@8FileH_prolog3_Throw
String ID: No hash or public key info found.$Verifying file hash$Verifying file integrity of %s
API String ID: 5089079-10929890
Opcode ID: 06d03d9edea51e8768c85c78654c9d91f7b7bc495fc37132657dff18a088e308
Instruction ID: 545267d887a71da4bd4226d73c430212175a0aad7cf0a3e2eea5368d5292993c
Opcode Fuzzy Hash: 06d03d9edea51e8768c85c78654c9d91f7b7bc495fc37132657dff18a088e308
Instruction Fuzzy Hash: F6617E31E00219AFDF10EBD8DC41AEE77B6EF28704F188425E541BB295D7B19A48CB70

Function 00D2D1A4 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 192COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D2D1AE
__CxxThrowException@8.LIBCMT ref: 00D2D227

Strings

Running external check with command '%s' and parameters '%s', xrefs: 00D2D288
Process exited with code %d, xrefs: 00D2D3B3
Running external check, and writing to log file '%s', xrefs: 00D2D346

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Exception@8H_prolog3_Throw
String ID: Process exited with code %d$Running external check with command '%s' and parameters '%s'$Running external check, and writing to log file '%s'
API String ID: 2985221223-1766360806
Opcode ID: ec495bbcd24e06ad8360f935d8b0190093606f3ab7be8421b70bf1a3b2830c75
Instruction ID: ea33c85688a867c1e74d9c43a997518f91484d2259b0ebcb5046c93aa6a74442
Opcode Fuzzy Hash: ec495bbcd24e06ad8360f935d8b0190093606f3ab7be8421b70bf1a3b2830c75
Instruction Fuzzy Hash: 8B710971D00228EFCB10DF98D945AEEBBB9FF29305F50405AE149A7141E770AA84CBB6

Function 00D47AD3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 73windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D2B217: std::_Xinvalid_argument.LIBCPMT ref: 00D2B233

MessageBoxW.USER32(00000000,?,?,00000010), ref: 00D47B82
CloseHandle.KERNEL32(000002D0), ref: 00D47B97
CoUninitialize.OLE32 ref: 00D47BA0

Strings

The following error occurred initializing the bootstrapper: "%s", xrefs: 00D47B3F
, xrefs: 00D47B0D

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: CloseHandleMessageUninitializeXinvalid_argumentstd::_
String ID: $The following error occurred initializing the bootstrapper: "%s"
API String ID: 699698131-886081036
Opcode ID: 6a5a4daa0e170a9ab98740f5404ab9ceba70fe0b8b39b601084eeeebad292590
Instruction ID: d79cdc725afb8713b74ec9c5ffb022f01f223eced9119ca323e3c01dc4c777b3
Opcode Fuzzy Hash: 6a5a4daa0e170a9ab98740f5404ab9ceba70fe0b8b39b601084eeeebad292590
Instruction Fuzzy Hash: 1731F4759002689BDB20DFA8DD85B9DB7B8FB24324F5082DAE159E3291DB705A84CF30

Function 00D357B2 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 68COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D357CB

Part of subcall function 00D62972: std::exception::exception.LIBCMT ref: 00D62987
Part of subcall function 00D62972: __CxxThrowException@8.LIBCMT ref: 00D6299C

std::_Xinvalid_argument.LIBCPMT ref: 00D357E1
_memmove.LIBCMT ref: 00D35822

Strings

string too long, xrefs: 00D357DC
invalid string position, xrefs: 00D357C6

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Exception@8Throw_memmovestd::exception::exception
String ID: invalid string position$string too long
API String ID: 1253240057-4289949731
Opcode ID: 8af3e073b77629bda0e59d7b432fc441f0248354830804f8afde528ed84bf4b6
Instruction ID: a519fac22809e328c6328645fbc69aa86c5f2cb6a39b58298c6f965d6f966a32
Opcode Fuzzy Hash: 8af3e073b77629bda0e59d7b432fc441f0248354830804f8afde528ed84bf4b6
Instruction Fuzzy Hash: B8110471700A00ABDB249E1CEC81A2EB7EAEF95750F184A1DF48287685DB70DC0087B0

Function 00D2C5D3 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D2C5EC

Part of subcall function 00D62972: std::exception::exception.LIBCMT ref: 00D62987
Part of subcall function 00D62972: __CxxThrowException@8.LIBCMT ref: 00D6299C

std::_Xinvalid_argument.LIBCPMT ref: 00D2C60E
_memmove.LIBCMT ref: 00D2C652

Strings

string too long, xrefs: 00D2C609
invalid string position, xrefs: 00D2C5E7

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Exception@8Throw_memmovestd::exception::exception
String ID: invalid string position$string too long
API String ID: 1253240057-4289949731
Opcode ID: d9c0d29a82c9dd1951672279cdc75e3cbbe7f5f40ce7bc9c19e6feb1b814f894
Instruction ID: 37dbb548525fdd783501f05ff9603fa187d1e2b879091464fa0b210fe2346e00
Opcode Fuzzy Hash: d9c0d29a82c9dd1951672279cdc75e3cbbe7f5f40ce7bc9c19e6feb1b814f894
Instruction Fuzzy Hash: F111A5312106249BCB24DE5CE881D5EB3F6FFA4B197241A1DF4568B660EB30ED05CBB4

Function 00D35487 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D354A0

Part of subcall function 00D62972: std::exception::exception.LIBCMT ref: 00D62987
Part of subcall function 00D62972: __CxxThrowException@8.LIBCMT ref: 00D6299C

std::_Xinvalid_argument.LIBCPMT ref: 00D354C2
_memmove.LIBCMT ref: 00D354FF

Strings

string too long, xrefs: 00D354BD
invalid string position, xrefs: 00D3549B

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Exception@8Throw_memmovestd::exception::exception
String ID: invalid string position$string too long
API String ID: 1253240057-4289949731
Opcode ID: eb20661a9e842517a8e8f2123260bb3c1918f95b470d8e106c253462537f68e7
Instruction ID: 2d7434cb34831c68f0dddad0eaf3dd89965766bd302b29f08a90b96429c3f7cd
Opcode Fuzzy Hash: eb20661a9e842517a8e8f2123260bb3c1918f95b470d8e106c253462537f68e7
Instruction Fuzzy Hash: 0C119031300B509FDB28DE5CE881D5AB7E5EB54711F144929F452CB685D7B0EE40CBB0

Function 00D4A02A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D4A053
GetVersionExW.KERNEL32(?), ref: 00D4A06E
GetVersionExW.KERNEL32(?), ref: 00D4A08F
CompareStringW.KERNEL32(00000409,00000001,?,000000FF,Service Pack 6,000000FF), ref: 00D4A0BE

Strings

Service Pack 6, xrefs: 00D4A0A9

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Version$CompareString_memset
String ID: Service Pack 6
API String ID: 3284293846-3350390674
Opcode ID: ca392bfc5f22871e6f50dd954451b549542ab0e2988952167dc350fe92699bf7
Instruction ID: 805b6d359abdcf5ab8309222850a615e14d4bcb7e9f6bb3b2908189644b8fd11
Opcode Fuzzy Hash: ca392bfc5f22871e6f50dd954451b549542ab0e2988952167dc350fe92699bf7
Instruction Fuzzy Hash: 8511C875940218ABDF208F54AC01BDAB7B8AB19710F1402A1E919E32C5E770DE45DFB1

Function 00D2DBFC Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 57COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D2DC03

Part of subcall function 00D2D49E: __EH_prolog3.LIBCMT ref: 00D2D4A5
Part of subcall function 00D2D49E: __CxxThrowException@8.LIBCMT ref: 00D2D4F8

Strings

Arguments, xrefs: 00D2DC85
Log, xrefs: 00D2DC93
PackageFile, xrefs: 00D2DC51
No PackageFile specified for External Check '%s'., xrefs: 00D2DC78

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID: Arguments$Log$No PackageFile specified for External Check '%s'.$PackageFile
API String ID: 2489616738-3336131490
Opcode ID: 16da5d57e7f6ea15b12604ca36280337971bbfed8c9999d0bb7b827f82c6a5a7
Instruction ID: 228b74d538fa061b5bfa45011e8627d38baf3572a8f30342c13e665e33573a69
Opcode Fuzzy Hash: 16da5d57e7f6ea15b12604ca36280337971bbfed8c9999d0bb7b827f82c6a5a7
Instruction Fuzzy Hash: 49119D70904714AFDB18EF69E84195ABBF2FF68704B00847DF4489B262E7B0E604CBB1

Function 00D3FAD6 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 45COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D3FADD

Strings

Force, xrefs: 00D3FB11
Defer, xrefs: 00D3FB2E
None, xrefs: 00D3FB4B
Reboot, xrefs: 00D3FAFF

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_
String ID: Defer$Force$None$Reboot
API String ID: 2427045233-1250134800
Opcode ID: 9aaae796466e97400b86acc94f64d6c549939279756183fd92a48fd38aae5081
Instruction ID: 9bd2e245c8c312630544a619504481cd6f7404a6c069007c965b8a30449f76db
Opcode Fuzzy Hash: 9aaae796466e97400b86acc94f64d6c549939279756183fd92a48fd38aae5081
Instruction Fuzzy Hash: A4019E72D402099BDB04DBB4E866BEEB3B0DF24318F108438F922B6181EBB5954CCB75

Function 00D4E08E Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 14libraryloaderCOMMON

Download Yara Rule

APIs

GetVersion.KERNEL32 ref: 00D4E08E
GetModuleHandleW.KERNEL32(KERNEL32.DLL), ref: 00D4E09D
GetProcAddress.KERNEL32(00000000,SetProcessDEPPolicy), ref: 00D4E0A9

Strings

KERNEL32.DLL, xrefs: 00D4E098
SetProcessDEPPolicy, xrefs: 00D4E0A3

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: AddressHandleModuleProcVersion
String ID: KERNEL32.DLL$SetProcessDEPPolicy
API String ID: 3310240892-1809394400
Opcode ID: 0cf80858a7c72d4fb46a5adb645a147e4d86a07f90c75f10375028877f3fac14
Instruction ID: ae73320fe0fe8c6b341adeb7d3f3becefc8c4664ba081aacf22bcb8d35ec0db7
Opcode Fuzzy Hash: 0cf80858a7c72d4fb46a5adb645a147e4d86a07f90c75f10375028877f3fac14
Instruction Fuzzy Hash: ADD012346803407FCB202BF27D0DBA93656BB70B4AF08C414BA52D25D8DAB2C4868636

Function 00D4263A Relevance: 7.7, APIs: 5, Instructions: 241windowsleepCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D42644
MessageBoxW.USER32(00000000,?,?,00000035), ref: 00D427D7
Sleep.KERNEL32(00000064,?,?,?,0000040F,000000D0), ref: 00D42800
MessageBoxW.USER32(00000000,?,?,00000034), ref: 00D4287E

Part of subcall function 00D2AA24: _memmove.LIBCMT ref: 00D2AA49

__CxxThrowException@8.LIBCMT ref: 00D42957

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Message$Exception@8H_prolog3_SleepThrow_memmove
String ID:
API String ID: 484813404-0
Opcode ID: 90453fb10ed9fa9806ce69ab20f5eff32ff5d46da35ca89db5b5e722f585331b
Instruction ID: 55160c3fcf2609729c80de50c799849ec2ff15c81c220236ab8ec467e97d6e76
Opcode Fuzzy Hash: 90453fb10ed9fa9806ce69ab20f5eff32ff5d46da35ca89db5b5e722f585331b
Instruction Fuzzy Hash: 35911B70A40258AFDF15DBA8CC92BEDB7B9EF14704F40409AF209B7182DB755A85CB72

Function 00D4896E Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,0000040B), ref: 00D489BF
GetWindowRect.USER32(00000000), ref: 00D489CC
GetWindowRect.USER32(?,?), ref: 00D489D5
SetDlgItemTextW.USER32(?,0000040A,?), ref: 00D48A2D
MoveWindow.USER32(?,?,?,?,?,00000001), ref: 00D48A40

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Window$ItemRect$MoveText
String ID:
API String ID: 739774251-0
Opcode ID: ad610344b68932176c5f4b400840e92508f47130f25d57528ce63c232a091b96
Instruction ID: 68dea6cf13c474a0002c14a0fc42d54303fa481afd59353b4a725585f2ec5301
Opcode Fuzzy Hash: ad610344b68932176c5f4b400840e92508f47130f25d57528ce63c232a091b96
Instruction Fuzzy Hash: 4C312A71900349AFCB14DFB9C885AEEBBF5BF48300F14856EE55AE3211C770AA45DB64

Function 00D5DDCA Relevance: 7.6, APIs: 5, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00D5DDD8

Part of subcall function 00D53605: __FF_MSGBANNER.LIBCMT ref: 00D5361E
Part of subcall function 00D53605: __NMSG_WRITE.LIBCMT ref: 00D53625
Part of subcall function 00D53605: RtlAllocateHeap.NTDLL(00000000,00000001,00000001,00000000,00000000,?,00D56B38,00000000,00000001,00000000,?,00D56DCA,00000018,00D6DEB0,0000000C,00D56E5F), ref: 00D5364A

_free.LIBCMT ref: 00D5DDEB

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 8fcad7211c67f11b35cd2805a6d5faf50630e49214c55c3447e46b6062652a72
Instruction ID: 9af8d7a1e26d17f55d466f10c6405ff3f601e269142cde60f3aacf8029f84b0b
Opcode Fuzzy Hash: 8fcad7211c67f11b35cd2805a6d5faf50630e49214c55c3447e46b6062652a72
Instruction Fuzzy Hash: 5E11CA32404712ABCF322BB4BC0665E37A6DF643E3F244426FD88DA250EF34C8998674

Function 00D49D45 Relevance: 7.6, APIs: 5, Instructions: 61COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(?,?,?,00000000,00000001,00000000,?,00D4B500), ref: 00D49D6C
LoadResource.KERNEL32(?,00000000,?,00D4B500), ref: 00D49D7C
SizeofResource.KERNEL32(?,00000000,?,00D4B500), ref: 00D49D8D
LockResource.KERNEL32(00D4B500,?,00D4B500), ref: 00D49DA0
_memmove.LIBCMT ref: 00D49DAF

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Resource$FindLoadLockSizeof_memmove
String ID:
API String ID: 886470670-0
Opcode ID: 541ace0be8583ecace388d1b5cc4100444af59e47efc39b4fe89fc4cfd563e3d
Instruction ID: d81a8df73822c7b673f550d5dd2157c9ada4b02bd7a4238476f3fd092d3c83aa
Opcode Fuzzy Hash: 541ace0be8583ecace388d1b5cc4100444af59e47efc39b4fe89fc4cfd563e3d
Instruction Fuzzy Hash: 2011A57590028AEFCB201F26DD19A6BBBA8EFA4351F180839FD45C6250E730CC91DBB0

Function 00D551B1 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00D551BD

Part of subcall function 00D52EF3: __getptd_noexit.LIBCMT ref: 00D52EF6
Part of subcall function 00D52EF3: __amsg_exit.LIBCMT ref: 00D52F03

__getptd.LIBCMT ref: 00D551D4
__amsg_exit.LIBCMT ref: 00D551E2
__lock.LIBCMT ref: 00D551F2
__updatetlocinfoEx_nolock.LIBCMT ref: 00D55206

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: b57ba2dc3636827368b8a0853fb7f220de892174fe32fa8cd2f509cd888a037b
Instruction ID: f9ea9a7219e042e079122f3d6f72450988257bd23cde7dde74ced8a5ba3cdc9c
Opcode Fuzzy Hash: b57ba2dc3636827368b8a0853fb7f220de892174fe32fa8cd2f509cd888a037b
Instruction Fuzzy Hash: 9DF09632A44F00DBDF2677786803B1D3B90EF01713F144209FC09A72D6CB64594C9AB5

Function 00D42E93 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 276sleepwindowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D42E9D

Part of subcall function 00D42344: __EH_prolog3_GS.LIBCMT ref: 00D4234B

Part of subcall function 00D47F9C: CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,00000001,?,?,00D41DCE,?,?,?,?,?,?,00000020), ref: 00D47FAF
Part of subcall function 00D47F9C: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00D47FC2
Part of subcall function 00D47F9C: CloseHandle.KERNEL32(?,?,00D41DCE,?,?,?,?,?,?,00000020), ref: 00D47FDA

Part of subcall function 00D2AA24: _memmove.LIBCMT ref: 00D2AA49

Sleep.KERNEL32(00000064), ref: 00D430B1
MessageBoxW.USER32(00000000,?,?,00000034), ref: 00D4314C

Strings

Downloading failed with HRESULT=%d, xrefs: 00D42F02

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_$CloseCreateEventHandleMessageMultipleObjectsSleepWait_memmove
String ID: Downloading failed with HRESULT=%d
API String ID: 54450717-1419425134
Opcode ID: 560a0b14028032bd1db7cc3dd6f9a8ebd02678080e1d631b0fec02afbdb99d8d
Instruction ID: ab373b6f8ec4a6d04636c53a2445b9c5d676c5ad27fff1beac24242a009ab37b
Opcode Fuzzy Hash: 560a0b14028032bd1db7cc3dd6f9a8ebd02678080e1d631b0fec02afbdb99d8d
Instruction Fuzzy Hash: 5EA18D70A10218AFDB11EBA8CC82FEDB7B8EF14304F504159F519AB2D2DB745A95CB72

Function 00D41DEF Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 160windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D41DF9

Part of subcall function 00D4DA53: __EH_prolog3_GS.LIBCMT ref: 00D4DA5A
Part of subcall function 00D4DA53: __wcsicoll.LIBCMT ref: 00D4DA96

GetDiskFreeSpaceExW.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00D41E6B

Part of subcall function 00D2AA24: _memmove.LIBCMT ref: 00D2AA49

MessageBoxW.USER32(00000000,?,?,00000031), ref: 00D41FD9

Strings

WindowsVolume, xrefs: 00D41E25

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_$DiskFreeMessageSpace__wcsicoll_memmove
String ID: WindowsVolume
API String ID: 2057594507-3823324423
Opcode ID: 939154f1090b9615c69a169653c43224d2288295a7a72a9a1aef0da44d13ae73
Instruction ID: 6d94dc0a187485495ce6a103e60885c5ef9b71c16d293e274f69bf1b67ea39b3
Opcode Fuzzy Hash: 939154f1090b9615c69a169653c43224d2288295a7a72a9a1aef0da44d13ae73
Instruction Fuzzy Hash: AD610375D002589BEF20DFA8DC81BEDB7B9EF14304F5081AAE509A7251DB709A85CF71

Function 00D366A3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D366AA

Strings

, xrefs: 00D367CA

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_
String ID:
API String ID: 2427045233-3916222277
Opcode ID: 800e6f9a0583d2367cd88818c3bc58d9a2d40bcdbf38e1b71858e83ab5461c20
Instruction ID: 8bd4799aa04bff6827fdb754600d70c347532779ebbe1bdee0d2e5c83da3c47c
Opcode Fuzzy Hash: 800e6f9a0583d2367cd88818c3bc58d9a2d40bcdbf38e1b71858e83ab5461c20
Instruction Fuzzy Hash: 1C5161B5900609ABDF20DFA8C4819EEB7F4EF18744F548829E55267680D774E945CB70

Function 00D369EB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D369F2
_Fputc.LIBCPMT ref: 00D36A4D
_Fputc.LIBCPMT ref: 00D36B20

Strings

, xrefs: 00D36AF7

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Fputc$H_prolog3_
String ID:
API String ID: 2569218679-3916222277
Opcode ID: 95c6361a6c4d4d42fb760db1ca0378ca35f42a8eae48c28bf47afddfe8b3dab1
Instruction ID: d8823e1234022f1ae5765477be96e1cdb805e2cd121cc10f8f7b24c160caa1ca
Opcode Fuzzy Hash: 95c6361a6c4d4d42fb760db1ca0378ca35f42a8eae48c28bf47afddfe8b3dab1
Instruction Fuzzy Hash: D2415D31900609AFCF21DFA8C8819AEBBF5EF59754F24C51AE552B7280DB71E944CB70

Function 00D3A3DF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D3A3E6

Part of subcall function 00D4EE13: _malloc.LIBCMT ref: 00D4EE2D

__CxxThrowException@8.LIBCMT ref: 00D3A4B6

Part of subcall function 00D3A269: __EH_prolog3_GS.LIBCMT ref: 00D3A270
Part of subcall function 00D3A269: __CxxThrowException@8.LIBCMT ref: 00D3A2EF

Strings

ExitCode, xrefs: 00D3A40F
DefaultExitCode, xrefs: 00D3A46D

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Exception@8H_prolog3_Throw$_malloc
String ID: DefaultExitCode$ExitCode
API String ID: 1828507218-3933766663
Opcode ID: 35b350e079b0884845159e59c349968f63f2894edd27e78821e0eada9845c2b5
Instruction ID: df36b2fc61761c0aeae695e0433aa652afc213805696449ef01eabc1dafe87b5
Opcode Fuzzy Hash: 35b350e079b0884845159e59c349968f63f2894edd27e78821e0eada9845c2b5
Instruction Fuzzy Hash: 70315072E002599FCF10EFE894859ADB7F4EF18300F19447EE589B7241DAB45D458B72

Function 00D4CE6C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D4CE76
GetComputerObjectNameW.SECUR32 ref: 00D4CE95

Part of subcall function 00D2D096: _memmove.LIBCMT ref: 00D2D0BF

Part of subcall function 00D2AA24: _memmove.LIBCMT ref: 00D2AA49

Strings

microsoft.com, xrefs: 00D4CF3B
/, xrefs: 00D4CEE2

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: _memmove$ComputerH_prolog3_NameObject
String ID: /$microsoft.com
API String ID: 2359728167-3454454201
Opcode ID: 2eef40c433044369e9dc46050f6112289200af3cc29730eddf98cea5935bc861
Instruction ID: 61ba2bba9552483279b61e0a31c852ee25af17a8b75e58c20d7fefe1ad39771a
Opcode Fuzzy Hash: 2eef40c433044369e9dc46050f6112289200af3cc29730eddf98cea5935bc861
Instruction Fuzzy Hash: 97314D70846268AADB60EB64DC89BEAB378DF14318F1001D5B149AA191DB795FC9CF31

Function 00D42DAF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 74COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D42DB6

Part of subcall function 00D4CD18: __EH_prolog3.LIBCMT ref: 00D4CD1F

EndUpdateResourceW.KERNEL32(?,00000000,?,?,?,?,?,?,00000040), ref: 00D42E61

Strings

true, xrefs: 00D42DEE
false, xrefs: 00D42E03

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3H_prolog3_ResourceUpdate
String ID: false$true
API String ID: 338534718-2658103896
Opcode ID: 2bb7c65de1e9466c413028fa0a60d591c6c1c42e34c2e7fc82edffbbb9acd79e
Instruction ID: 2bf3c9e71df7be621742fb477685189bd914862534938c0e0b5bf1be6a603022
Opcode Fuzzy Hash: 2bb7c65de1e9466c413028fa0a60d591c6c1c42e34c2e7fc82edffbbb9acd79e
Instruction Fuzzy Hash: BC21A474D012189FCB10EFA5DC45EEFBB78EF28744F548029F415A6251EB705A45CBB0

Function 00D4C569 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 74windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D4C573
FormatMessageW.KERNEL32(00000500,?,00000000,00000000,?,00000000,?), ref: 00D4C649
LocalFree.KERNEL32(?,?), ref: 00D4C662

Strings

\r\n, xrefs: 00D4C5FF

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: FormatFreeH_prolog3_LocalMessage
String ID: \r\n
API String ID: 2435402305-1273924927
Opcode ID: 2e6e6a4a01b05d3f3403348b6db885dd80f02431fcd4fbab3c48d92f89823006
Instruction ID: 3603da5f9df9f4050631ac066ec3bdd97eced3b46b965758dfa395ae3bfc05ac
Opcode Fuzzy Hash: 2e6e6a4a01b05d3f3403348b6db885dd80f02431fcd4fbab3c48d92f89823006
Instruction Fuzzy Hash: 14212D719102689FDB20EB609C45AAD76B8FF28704F44C0E5E588A6151DA719F89CFF1

Function 00D4D036 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51networkCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D4D03D
_memset.LIBCMT ref: 00D4D070
InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 00D4D0AD

Strings

<, xrefs: 00D4D087

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: CrackH_prolog3_Internet_memset
String ID: <
API String ID: 509944592-4251816714
Opcode ID: a5fd26d49658bd474a8f12dbaa41a2b90e1c0ddbf0912e6901427d3cf65ee0ba
Instruction ID: 661ce6f83e960105fe03fbfcd2a2b627b6f41e6d662296bca8285245abcdae0f
Opcode Fuzzy Hash: a5fd26d49658bd474a8f12dbaa41a2b90e1c0ddbf0912e6901427d3cf65ee0ba
Instruction Fuzzy Hash: 56115EB1900208DFDF109FA8D841A9DBBB8FF08304F40402EE505EB250D7B95A058BB1

Function 00D4CF99 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51networkCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D4CFA0
_memset.LIBCMT ref: 00D4CFD3
InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 00D4D010

Strings

<, xrefs: 00D4CFEA

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: CrackH_prolog3_Internet_memset
String ID: <
API String ID: 509944592-4251816714
Opcode ID: f8376954fa25542199e6b5df0e8eb2d73b8d599a19c77940d5a2e0d4553ad23d
Instruction ID: 12742a26d5f412b2998300802179612cb63de9c1b3b2791317baa902e812f599
Opcode Fuzzy Hash: f8376954fa25542199e6b5df0e8eb2d73b8d599a19c77940d5a2e0d4553ad23d
Instruction Fuzzy Hash: 191161B1D00208EFDB109FA8E841A5DBBB8FF08304F50802EF515EB250DBB55A058B71

Function 00D2D8FD Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D2D904

Part of subcall function 00D2D49E: __EH_prolog3.LIBCMT ref: 00D2D4A5
Part of subcall function 00D2D49E: __CxxThrowException@8.LIBCMT ref: 00D2D4F8

Strings

No Key value specified for Registry Check '%s'., xrefs: 00D2D965
Value, xrefs: 00D2D972
Key, xrefs: 00D2D941

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID: Key$No Key value specified for Registry Check '%s'.$Value
API String ID: 2489616738-103778900
Opcode ID: 0aa3108bb584bca9f57ad20dc790cbaa0ea47f3e507d21e2d04e933cc788a9d4
Instruction ID: 1028868d217b65fd3a6ec20cd36be15d7b5c33c8a4febe268545c4d893e34f60
Opcode Fuzzy Hash: 0aa3108bb584bca9f57ad20dc790cbaa0ea47f3e507d21e2d04e933cc788a9d4
Instruction Fuzzy Hash: F901D271504314AFDB08DF55E806A5ABBE1FF64704F008069F848AB261D7B0E655CBB9

Function 00D4A76C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 46memoryCOMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D4A77F

Part of subcall function 00D6291B: std::exception::exception.LIBCMT ref: 00D62930
Part of subcall function 00D6291B: __CxxThrowException@8.LIBCMT ref: 00D62945

_Allocate.LIBCPMT ref: 00D4A795
_memmove.LIBCMT ref: 00D4A7A6

Strings

vector<T> too long, xrefs: 00D4A77A

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: AllocateException@8ThrowXinvalid_argument_memmovestd::_std::exception::exception
String ID: vector<T> too long
API String ID: 1114612255-3788999226
Opcode ID: d3e117cc191e5480d7a3ad5497f397802d3c43f0f00357930089fd22ab96548d
Instruction ID: 230bc00b9176fe91805c77a97c369e444165b4cc9b72260114fedc32101f072c
Opcode Fuzzy Hash: d3e117cc191e5480d7a3ad5497f397802d3c43f0f00357930089fd22ab96548d
Instruction Fuzzy Hash: C801AD72200605AFD720AF6DCCC5D26BBE8EF84350B24892DF499C7641DA30EC418BB4

Function 00D2C687 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(mscoree.dll), ref: 00D2C6A1
GetLastError.KERNEL32 ref: 00D2C6AD
InterlockedCompareExchange.KERNEL32(00D71EF0,00000000,00000000), ref: 00D2C6E0

Strings

mscoree.dll, xrefs: 00D2C69C

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: CompareErrorExchangeInterlockedLastLibraryLoad
String ID: mscoree.dll
API String ID: 318279569-1912557249
Opcode ID: d3d3cc6b586965e1932e18280317f2c28adc6eb04214d864b13ea851a6046301
Instruction ID: d513270ed1e7b833242f4c9f58e5a6caef9792edebfa064a60808032bf9c3c27
Opcode Fuzzy Hash: d3d3cc6b586965e1932e18280317f2c28adc6eb04214d864b13ea851a6046301
Instruction Fuzzy Hash: 95018C39510325AED7209B69EC09B993FA9EF70398F144165E808E33A1E7B199458BB1

Function 00D2D49E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D2D4A5

Part of subcall function 00D2B608: __EH_prolog3.LIBCMT ref: 00D2B60F

__CxxThrowException@8.LIBCMT ref: 00D2D4F8

Part of subcall function 00D4EE98: RaiseException.KERNEL32(?,?,00D2A9A0,?,?,?,?,?,00D2A9A0,?,00D6A6A8,00000000), ref: 00D4EEDA

Strings

Property, xrefs: 00D2D4CC
Property not specified for Install Check., xrefs: 00D2D4E0

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3$ExceptionException@8RaiseThrow
String ID: Property$Property not specified for Install Check.
API String ID: 1412866469-1977767295
Opcode ID: 016bcc4bbb69c4b2cc3350466b332eb65a58139237e6bdf2331bc350b1654785
Instruction ID: addda2a83d8c6b8ab5cf83e2d08fa375c9935ade0da99ecf09b2e189fc125e6a
Opcode Fuzzy Hash: 016bcc4bbb69c4b2cc3350466b332eb65a58139237e6bdf2331bc350b1654785
Instruction Fuzzy Hash: 00F0B471940314AFDB00EF90E806F6D77A0FF21708F00486AF540A72A1DBB49A09CB75

Function 00D4D4E6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 21libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4CDA4: _memset.LIBCMT ref: 00D4CDD4
Part of subcall function 00D4CDA4: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 00D4CDE9
Part of subcall function 00D4CDA4: _memset.LIBCMT ref: 00D4CE19
Part of subcall function 00D4CDA4: GetWindowsDirectoryW.KERNEL32(?,00000104), ref: 00D4CE29
Part of subcall function 00D4CDA4: LoadLibraryW.KERNEL32(?), ref: 00D4CE52

GetProcAddress.KERNEL32(00000000,crypt32.dll), ref: 00D4D506
FreeLibrary.KERNEL32(00000000,?,00D4DEA8,00000000,00000000,?), ref: 00D4D516

Strings

crypt32.dll, xrefs: 00D4D4F2
CertFreeCertificateContext, xrefs: 00D4D4FE

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: DirectoryLibrary_memset$AddressFreeLoadProcSystemWindows
String ID: CertFreeCertificateContext$crypt32.dll
API String ID: 286598593-2264772026
Opcode ID: c21347aa0c8cabc0bdf2476995460b91753435b73ca4e20dc36e3e44d0b0c9b8
Instruction ID: a33b6b6a6956429bd84b3e831477d316bf22de2553e7a90ed8030d5925e7e0be
Opcode Fuzzy Hash: c21347aa0c8cabc0bdf2476995460b91753435b73ca4e20dc36e3e44d0b0c9b8
Instruction Fuzzy Hash: E5E0C234801324ABC7213B61EC0DAEE3EA8DFA1398F04C020F90CC2611DF318A52C6B1

Function 00D4C1FD Relevance: 6.2, APIs: 4, Instructions: 155fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D4C204
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 00D4C2B7
ReadFile.KERNEL32(000000FF,?,00004000,?,00000000,00004000), ref: 00D4C2F5
CloseHandle.KERNEL32(000000FF), ref: 00D4C3A4

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: File$CloseCreateH_prolog3_HandleRead
String ID:
API String ID: 3561040463-0
Opcode ID: b56831e2ec28a1ed1b381754d13ec5b9f8fd28d078062edb38e80b246919a2b9
Instruction ID: f07d1e7dc2338548947b496ace3c8450f22892bb529e684361658722ea1d1197
Opcode Fuzzy Hash: b56831e2ec28a1ed1b381754d13ec5b9f8fd28d078062edb38e80b246919a2b9
Instruction Fuzzy Hash: 975123B1D12259AFDF209FE8CC85AEEBB78FF05344F588129E505B62A4D7309942DB70

Function 00D50F1C Relevance: 6.1, APIs: 4, Instructions: 130COMMONLIBRARYCODE

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D50FB7
__flush.LIBCMT ref: 00D50FD5
__write.LIBCMT ref: 00D50FFC
__flsbuf.LIBCMT ref: 00D51027

Part of subcall function 00D55429: __getptd_noexit.LIBCMT ref: 00D55429

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: __flsbuf__flush__getptd_noexit__write_memmove
String ID:
API String ID: 2782032738-0
Opcode ID: a812d0d0a5c6481c98b1a04a781b8e7b7a4a9f9683a8f812520d858c1e4d2253
Instruction ID: f5a18166fa02e56dd6a24308c4e479f232b21a057023951fb4105c1aca6bc73c
Opcode Fuzzy Hash: a812d0d0a5c6481c98b1a04a781b8e7b7a4a9f9683a8f812520d858c1e4d2253
Instruction Fuzzy Hash: 1041F435A00744DBDF358FA9C88169EBBB5EF80322F28856DEC5597180D770DE898B70

Function 00D56FB1 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00D56FE5
__isleadbyte_l.LIBCMT ref: 00D57018
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,00000000,00000000,?,?,?,?,?,00000000), ref: 00D57049
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,00000000,00000000,?,?,?,?,?,00000000), ref: 00D570B7

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 8013ccbc3d4a7d5c954c5ffd84c20243a90fa7d38912324ec75b56381a05e983
Instruction ID: 6850bd993e67bd25584d518ca1af85b563f9ccc75219bdeefd317823f64d6454
Opcode Fuzzy Hash: 8013ccbc3d4a7d5c954c5ffd84c20243a90fa7d38912324ec75b56381a05e983
Instruction Fuzzy Hash: 5531A031904255EFDF20DF68E8909AA7BF5BF01312F688569EC618B2D1D731D948DB70

Function 00D4BE87 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D4BEDE
_memset.LIBCMT ref: 00D4BEEC
_memset.LIBCMT ref: 00D4BEFA
__wsplitpath_s.LIBCMT ref: 00D4BF28

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: _memset$__wsplitpath_s
String ID:
API String ID: 599571650-0
Opcode ID: f813671892c58667d39e7d105d63a28e539b3ec51db76419f1292d2187606a0b
Instruction ID: 44c5a5038c1101c7774d75443344cad2a7b10dda1045fca008c400fc4c0f17a6
Opcode Fuzzy Hash: f813671892c58667d39e7d105d63a28e539b3ec51db76419f1292d2187606a0b
Instruction Fuzzy Hash: 07312DB590021CABCB10DF94CC85EDEB3BEEF98310F1441A6B519E3141D671AE588F74

Function 00D34E9C Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00D34EA3
std::ios_base::getloc.LIBCPMT ref: 00D34EEB
std::ios_base::clear.LIBCPMT ref: 00D34F3D
std::ios_base::clear.LIBCPMT ref: 00D34FC3

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: std::ios_base::clear$H_prolog3_catchstd::ios_base::getloc
String ID:
API String ID: 4272078015-0
Opcode ID: 381955e5070d77d6f3a4c9fdb76ab2c35a4728012fcc17791aab72bdb3333a0d
Instruction ID: ccf06e50b535afccb035f6c5ef633067fc6a60efdac6826a3452b28f9bcfb1ff
Opcode Fuzzy Hash: 381955e5070d77d6f3a4c9fdb76ab2c35a4728012fcc17791aab72bdb3333a0d
Instruction Fuzzy Hash: 07314F746001018FDB24EF58C5A1A79B7A1EF54314F6885ADE18A9B392CB79ED42CB70

Function 00D47CE1 Relevance: 6.1, APIs: 4, Instructions: 84COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00D47D1E
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00D47D40
GetSystemMetrics.USER32(00000000), ref: 00D47D57
GetSystemMetrics.USER32(00000001), ref: 00D47D5E

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: System$Metrics$InfoParametersRectWindow
String ID:
API String ID: 1941969595-0
Opcode ID: aaeebe4c78ee7efc08d1056f63edf2e288118e8d28874631474b96b3645c54a1
Instruction ID: 4054688779cac8a8dad47f58bbc9fa582942411a85a0c2387b0dc45b8bb2c046
Opcode Fuzzy Hash: aaeebe4c78ee7efc08d1056f63edf2e288118e8d28874631474b96b3645c54a1
Instruction Fuzzy Hash: 643190B5E0020ADFCB00CFA9C9859EEBBF8FF58344F54856AE915E7240D730AA018F64

Function 00D49840 Relevance: 6.1, APIs: 4, Instructions: 74windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D49847
GetDlgItem.USER32(?,00000430), ref: 00D49866
SendMessageW.USER32(?,00000461,?,?), ref: 00D498FF
SendMessageA.USER32(?,00000461,?,?), ref: 00D4991C

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: MessageSend$H_prolog3_Item
String ID:
API String ID: 4098331016-0
Opcode ID: 731a09458ca8f9a6aeca07a04129aa68ff837ef07c3101013cabe90d5ee7a7c7
Instruction ID: ee99d6fc7e82e9aebad46aed66b8cc41c9f4b41bfce7e47811158f8a13ee88b2
Opcode Fuzzy Hash: 731a09458ca8f9a6aeca07a04129aa68ff837ef07c3101013cabe90d5ee7a7c7
Instruction Fuzzy Hash: 39318DB0800308EFDF24DFA8D884B9EBBB9FF45300F14851AF552AA2A1CB705545CB71

Function 00D482EA Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00D48308
GetWindowRect.USER32(00000000,?), ref: 00D48327
ScreenToClient.USER32(?,?), ref: 00D48344
MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 00D48368

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Window$ClientItemMoveRectScreen
String ID:
API String ID: 646222375-0
Opcode ID: e579ee27c86d108d970e404b28c199e10d2135348e12d4531bf132425f6e4add
Instruction ID: 5667c9b4615386da40e493447cecba0875c2251fee0a9c4c23be04e37fa52dd4
Opcode Fuzzy Hash: e579ee27c86d108d970e404b28c199e10d2135348e12d4531bf132425f6e4add
Instruction Fuzzy Hash: 7F11C97590020AEFCB10DFA9C9859BFBBB8FF58314B144169F515E3210DB30A945CB64

Function 00D49DDA Relevance: 6.1, APIs: 4, Instructions: 54windowCOMMON

Download Yara Rule

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00D49E0E
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D49E24
TranslateMessage.USER32(?), ref: 00D49E32
DispatchMessageW.USER32(?), ref: 00D49E3C

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Message$DispatchMultipleObjectsPeekTranslateWait
String ID:
API String ID: 2231909638-0
Opcode ID: 933ab9f0bd6bde9aa61ff55527a2aa55b99c045c0bb17782fe560164c6212ab1
Instruction ID: c5943f5b9bdfa534d81c9712f52f97734ce2ea0583d8c50b8b3ace2cbbd22989
Opcode Fuzzy Hash: 933ab9f0bd6bde9aa61ff55527a2aa55b99c045c0bb17782fe560164c6212ab1
Instruction Fuzzy Hash: D3016D72A01218EBCF10DBA59C49DEFBBACEF59714B104125F505E7180DA34DA05C6B4

Function 00D48700 Relevance: 6.0, APIs: 4, Instructions: 50windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D48168: GetDlgItem.USER32(?,00000000), ref: 00D4817E

SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 00D48725
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 00D48736
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 00D48747
SendMessageW.USER32(00000000,000000F4,00000001,00000001), ref: 00D4875E

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: MessageSend$Item
String ID:
API String ID: 3888421826-0
Opcode ID: 576d9ba4e78401231094fb7ca5a695d8b80806eb933a0ee2e210a421ad9cde93
Instruction ID: 32858423402b571b8de7a73fe141d376181bdd7f05aeb142345f033c36a9b2fe
Opcode Fuzzy Hash: 576d9ba4e78401231094fb7ca5a695d8b80806eb933a0ee2e210a421ad9cde93
Instruction Fuzzy Hash: F9F031A1A403187FE620A7A58C8AF6F7A2CDB957A5F14002A7205A61C0C9709D02E670

Function 00D59289 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00D592AF

Part of subcall function 00D590D1: __fltout2.LIBCMT ref: 00D590FC

__cftog_l.LIBCMT ref: 00D592D5
__cftoe_l.LIBCMT ref: 00D59307

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 7885726e51710dfb409d83f47fda806ed7f39660f26e99df1c6e86efa9305941
Instruction ID: 4b69e85a222f2a3f57733939318d0e8d95eea388e90fefbf318965c32a5cf852
Opcode Fuzzy Hash: 7885726e51710dfb409d83f47fda806ed7f39660f26e99df1c6e86efa9305941
Instruction Fuzzy Hash: B811893200014EFBCF166E84CC52CEE7F62BB19352F998414FE2859031D732C9B6ABA1

Function 00D4960F Relevance: 6.0, APIs: 4, Instructions: 40windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D49616
GetDlgItem.USER32(?,0000040B), ref: 00D4962B
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00D49641
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00D4966B

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: MessageSend$H_prolog3Item
String ID:
API String ID: 2559409407-0
Opcode ID: d49be20b0b1881ebd31c88a204897c6d62b6f5b0b13dd5ecdb158501dfdbdcaa
Instruction ID: 2f3d994e28ce0e7d45b7098c2eb321efbbe6277829d3e9e255a7e3d9a99de46a
Opcode Fuzzy Hash: d49be20b0b1881ebd31c88a204897c6d62b6f5b0b13dd5ecdb158501dfdbdcaa
Instruction Fuzzy Hash: 2001D3B5D00219ABDB10DFA5D845DEEBAB9EFA8300F00405AF504B7261CA759A01CA74

Function 00D48384 Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,00000007,?,00000000,00D43CD0,?,?,000000A0), ref: 00D48397
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00D483AA
CloseHandle.KERNEL32(?), ref: 00D483C2

Part of subcall function 00D47EE0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D47F2F

CloseHandle.KERNEL32(?), ref: 00D483CF

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: CloseHandle$CreateEventMessageMultipleObjectsPeekWait
String ID:
API String ID: 1746628939-0
Opcode ID: 18f9cf3022826fb35d203c4b8a7382c25c366de71414f61492a48a503023c227
Instruction ID: f86ee7e956a33029e889b41774f4db163f93f6b3eb5aff4bc262d85070cb96a3
Opcode Fuzzy Hash: 18f9cf3022826fb35d203c4b8a7382c25c366de71414f61492a48a503023c227
Instruction Fuzzy Hash: 58F03639200241ABD7301F259C4CD5BBEB9FBE1BA1B248639B995C52A4CE714805D630

Function 00D47F9C Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

CreateEventW.KERNEL32(00000000,00000000,00000000,00000000,00000001,?,?,00D41DCE,?,?,?,?,?,?,00000020), ref: 00D47FAF
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 00D47FC2
CloseHandle.KERNEL32(?,?,00D41DCE,?,?,?,?,?,?,00000020), ref: 00D47FDA

Part of subcall function 00D47EE0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D47F2F

CloseHandle.KERNEL32(?,?,00D41DCE,?,?,?,?,?,?,00000020), ref: 00D47FE7

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: CloseHandle$CreateEventMessageMultipleObjectsPeekWait
String ID:
API String ID: 1746628939-0
Opcode ID: 5ce1fce32e39c91490d30fc55c9da35898efa21ba4a2d8560352fb53dbe8131d
Instruction ID: d8e73709c5f764706321aace4275d4fc677e000898e8e7e860ac6d5a336b2f0f
Opcode Fuzzy Hash: 5ce1fce32e39c91490d30fc55c9da35898efa21ba4a2d8560352fb53dbe8131d
Instruction Fuzzy Hash: 31F03039204246ABE7301F26DC48D66BEB9FFE2761B248639BA95D62E4CB314805C630

Function 00D481B3 Relevance: 6.0, APIs: 4, Instructions: 37windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(?,000000FF,00000001,00000000,00000000,00008000), ref: 00D481DA
LoadIconW.USER32(00000000,00007F03), ref: 00D481E8
GetDlgItem.USER32(000000FF,00000065), ref: 00D481FE
SendMessageW.USER32(00000000), ref: 00D48205

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Load$IconImageItemMessageSend
String ID:
API String ID: 1259760789-0
Opcode ID: dc7c974f95b5539609e50cf199d1ce1f150a504ae1b498d776c241ade850bf1f
Instruction ID: 58495f551f6da4a3ab4820f7aeb107c2ea191b9d452ad619e8d72258bb7942e7
Opcode Fuzzy Hash: dc7c974f95b5539609e50cf199d1ce1f150a504ae1b498d776c241ade850bf1f
Instruction Fuzzy Hash: 17F0E2B2104749FFE7300B609C8AEBB3A2EFF10791F148525F656D41E0CBB19C4696B8

Function 00D4806C Relevance: 6.0, APIs: 4, Instructions: 32COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000069), ref: 00D4808F
ShowWindow.USER32(00000000), ref: 00D48098
GetDlgItem.USER32(?,00000429), ref: 00D480A6
ShowWindow.USER32(00000000), ref: 00D480A9

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: ItemShowWindow
String ID:
API String ID: 3351165006-0
Opcode ID: 6c9fd4cf2424763bd61a0281c0e8904d8e62e54ec3bee8086b31a64a25fcf803
Instruction ID: 73971e63f8f13c0a8cec09a202d7840745fd373e82cfbd4b142bda6be8a28092
Opcode Fuzzy Hash: 6c9fd4cf2424763bd61a0281c0e8904d8e62e54ec3bee8086b31a64a25fcf803
Instruction Fuzzy Hash: 45E0ED76A00228BAC72097AACC49C8BFFACDF95260B164062F648E3260C571EC01C6F4

Function 00D435D6 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

Part of subcall function 00D3D0AC: __EH_prolog3_GS.LIBCMT ref: 00D3D0B3

CloseHandle.KERNEL32(?), ref: 00D435FF
CloseHandle.KERNEL32(?), ref: 00D43613
CloseHandle.KERNEL32(?), ref: 00D43627

Strings

Failed to wait for parent process to end before creating new setup.exe.This is not a fatal error - however, setup.exe may not be a, xrefs: 00D435DC

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: CloseHandle$H_prolog3_
String ID: Failed to wait for parent process to end before creating new setup.exe.This is not a fatal error - however, setup.exe may not be a
API String ID: 4086437536-596111041
Opcode ID: 2ff9e168391a089f960062668a1584dd7105e94f5150854e022bd307da164f33
Instruction ID: 8da3e75c425b2a046c93dcffeb85bc99e972a6bb909e6a75ca4cece693db49bc
Opcode Fuzzy Hash: 2ff9e168391a089f960062668a1584dd7105e94f5150854e022bd307da164f33
Instruction Fuzzy Hash: D3E0C938805329DBCF726B14EC09658BA32FB11B05F9681E1F549A0274D6330EA1DF75

Function 00D3BB84 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 285COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00D3BB8E

Part of subcall function 00D4C434: GetDateFormatW.KERNEL32(00000400,00000001,00000000,00000000,?,000003FF), ref: 00D4C4D3
Part of subcall function 00D4C434: GetTimeFormatW.KERNEL32(00000400,00000000,00000000,00000000,?,000003FF), ref: 00D4C4E9

Part of subcall function 00D2B217: std::_Xinvalid_argument.LIBCPMT ref: 00D2B233

Part of subcall function 00D2B217: _memmove.LIBCMT ref: 00D2B28E

Strings

(%s) Downloading '%s' from '%s' to '%s', xrefs: 00D3BD2C
Download completed at %s, xrefs: 00D3BE4F

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Format$DateH_prolog3_catch_TimeXinvalid_argument_memmovestd::_
String ID: (%s) Downloading '%s' from '%s' to '%s'$Download completed at %s
API String ID: 655749115-967203076
Opcode ID: 1bfc63b713cb7824fd9e313df7eac85136757b73a4c619d60506a0defbd721bd
Instruction ID: 462c798c063812241449a74ba51c063438776da85fc0bf0934621dea9709330b
Opcode Fuzzy Hash: 1bfc63b713cb7824fd9e313df7eac85136757b73a4c619d60506a0defbd721bd
Instruction Fuzzy Hash: BBC16971900259DFDB24DF68D980BEAB7B5FF14314F10896EE15AA7241EB30AA84CF71

Function 00D2C8E4 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 183COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D2C8EE

Part of subcall function 00D2C84E: __EH_prolog3_GS.LIBCMT ref: 00D2C855
Part of subcall function 00D2C84E: InterlockedCompareExchange.KERNEL32(00D71EF8,?,00000000), ref: 00D2C8A5

Strings

v4.0.0, xrefs: 00D2C9C0
GetRequestedRuntimeInfo, xrefs: 00D2CA65

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_$CompareExchangeInterlocked
String ID: GetRequestedRuntimeInfo$v4.0.0
API String ID: 2107565278-1665928025
Opcode ID: e61068ff833fdf0b75c659e728720aa1e1586ac866454d34ed39613a030813bd
Instruction ID: 678c7657db5bd769c2c39ee1ab5f48432b275e3bd2c04b38fa0278c404fe3fc0
Opcode Fuzzy Hash: e61068ff833fdf0b75c659e728720aa1e1586ac866454d34ed39613a030813bd
Instruction Fuzzy Hash: 7971E7B19116389FCF60DF54DC85ADDB7B6EBA8314F1401EAE509A3210DA329EE4CF60

Function 00D38DDA Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D38DE4
__CxxThrowException@8.LIBCMT ref: 00D38E22

Part of subcall function 00D2B217: std::_Xinvalid_argument.LIBCPMT ref: 00D2B233

Part of subcall function 00D38AFD: __EH_prolog3_catch.LIBCMT ref: 00D38B04

Part of subcall function 00D2AA24: _memmove.LIBCMT ref: 00D2AA49

Part of subcall function 00D2AD7D: __EH_prolog3_GS.LIBCMT ref: 00D2AD84

Strings

Reached the end of the file., xrefs: 00D38E0A

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_$Exception@8H_prolog3_catchThrowXinvalid_argument_memmovestd::_
String ID: Reached the end of the file.
API String ID: 1775207536-1700886240
Opcode ID: d299e70e318635884dd342fa80d6dda20528593c5ea9039182f2c3dc5ba613be
Instruction ID: b0d0dda104ec5c988746125a5ac2cabd9201dfdbbc6f60b883bd16e9fe6b38b0
Opcode Fuzzy Hash: d299e70e318635884dd342fa80d6dda20528593c5ea9039182f2c3dc5ba613be
Instruction Fuzzy Hash: EC513D71900248DFCB10DFA8D891EDEB7B9EF18314F14846AF15AE7281DB74AA48DB71

Function 00D304C6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D304CD
__fassign.LIBCMT ref: 00D30566

Part of subcall function 00D30486: __EH_prolog3.LIBCMT ref: 00D3048D

Strings

true, xrefs: 00D30543

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3H_prolog3___fassign
String ID: true
API String ID: 4285383889-4261170317
Opcode ID: b9a24ddbd52d71707c0022f2e78fd8a46fd74f3c7bbebfb3b1b1ca52956657b5
Instruction ID: baba227462e476409b0ec3fcd78e721a599e58e08463b1a0f8e8ef403ad5f16e
Opcode Fuzzy Hash: b9a24ddbd52d71707c0022f2e78fd8a46fd74f3c7bbebfb3b1b1ca52956657b5
Instruction Fuzzy Hash: FD216070C04208ABCB14EFA9D8619DEBBB8EF64714F50851DF066A32A2DF749A04CB71

Function 00D3062F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D30636

Part of subcall function 00D304C6: __EH_prolog3_GS.LIBCMT ref: 00D304CD

__wcsicoll.LIBCMT ref: 00D306E7

Part of subcall function 00D2A9C9: WriteFile.KERNEL32(?,?,?,00000000,00000000), ref: 00D2AA09

Strings

Invalid comparison type, xrefs: 00D30684

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_$FileWrite__wcsicoll
String ID: Invalid comparison type
API String ID: 1110922125-70441815
Opcode ID: 6c308fb52b5c8562582200b3c8e015652e0013654ce6c2c334d45a92a28f83fd
Instruction ID: b39b1fe03a11b4ff4d2946d4bed2ecaaa5f49e5252a03534a5dcdb88ae305e39
Opcode Fuzzy Hash: 6c308fb52b5c8562582200b3c8e015652e0013654ce6c2c334d45a92a28f83fd
Instruction Fuzzy Hash: 8321D471A442189FCF18EFA8D4629EDBBB5FFA4304F54001DE042A7290CB74AE45CB70

Function 00D2CCD2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D2CD1B
_memmove.LIBCMT ref: 00D2CD4F

Strings

string too long, xrefs: 00D2CD16

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 256744135-2556327735
Opcode ID: 647e5d73adc14ca6f0058b87f97e80b78713d538aee7b147f48c0ff8d23e4855
Instruction ID: 3a03066b4139977599a20e33f7ec210e555f7014a4216ae356902e97f620ab0c
Opcode Fuzzy Hash: 647e5d73adc14ca6f0058b87f97e80b78713d538aee7b147f48c0ff8d23e4855
Instruction Fuzzy Hash: 2B11B431210720ABCB309E5DF84495EBBF9EFA5B18710092EF8868B251DB71ED08C7B5

Function 00D35859 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D35875

Part of subcall function 00D62972: std::exception::exception.LIBCMT ref: 00D62987
Part of subcall function 00D62972: __CxxThrowException@8.LIBCMT ref: 00D6299C

Part of subcall function 00D35061: std::_Xinvalid_argument.LIBCPMT ref: 00D35074

_memmove.LIBCMT ref: 00D358D0

Strings

invalid string position, xrefs: 00D35870

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Exception@8Throw_memmovestd::exception::exception
String ID: invalid string position
API String ID: 1253240057-1799206989
Opcode ID: 9874417bfad93f34e3936e10391739eacfea256cb30442b84eb83aeeb90e1d81
Instruction ID: 114392575263ac68abe8a60124eb26e7c8356577e205292af1da80229c294bdb
Opcode Fuzzy Hash: 9874417bfad93f34e3936e10391739eacfea256cb30442b84eb83aeeb90e1d81
Instruction Fuzzy Hash: 4311E331704A10ABDF289E1CEC41A6AB7B9EB94720F14092EF8528B385DBB1DD00D7F1

Function 00D2B217 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D2B233

Part of subcall function 00D62972: std::exception::exception.LIBCMT ref: 00D62987
Part of subcall function 00D62972: __CxxThrowException@8.LIBCMT ref: 00D6299C

Part of subcall function 00D2ADED: std::_Xinvalid_argument.LIBCPMT ref: 00D2AE03

_memmove.LIBCMT ref: 00D2B28E

Strings

invalid string position, xrefs: 00D2B22E

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Xinvalid_argumentstd::_$Exception@8Throw_memmovestd::exception::exception
String ID: invalid string position
API String ID: 1253240057-1799206989
Opcode ID: 397486aa419c61a5781f0b733d3d4f8252935bea6a864be2e336c03970c98327
Instruction ID: f61f080ea70f6749a8304f5a007edd88fabfd136e2081210e4f68d16ccc0620d
Opcode Fuzzy Hash: 397486aa419c61a5781f0b733d3d4f8252935bea6a864be2e336c03970c98327
Instruction Fuzzy Hash: 74116331604324EBCB109E5CE88196EB7A9FFA576DB10065AF8514B241E7B0E914C7B9

Function 00D36364 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D363AB
_memmove.LIBCMT ref: 00D363DB

Strings

string too long, xrefs: 00D363A6

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Xinvalid_argument_memmovestd::_
String ID: string too long
API String ID: 256744135-2556327735
Opcode ID: 4fd9c9da08e3fc428a6732dc00d2b2e2b52d0d65302565d5da26d1ef71f18f94
Instruction ID: 2dd97818aaba003e42bcd23cc82ae360c84a2b9ba2c65a10a3f16560519f8c3e
Opcode Fuzzy Hash: 4fd9c9da08e3fc428a6732dc00d2b2e2b52d0d65302565d5da26d1ef71f18f94
Instruction Fuzzy Hash: A211E732300650BBDB349E6D994196FB7F9EF41750F18492DF4828B241CBB2E90487B4

Function 00D3074B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D30752

Part of subcall function 00D304C6: __EH_prolog3_GS.LIBCMT ref: 00D304CD

__wcsicoll.LIBCMT ref: 00D307F8

Part of subcall function 00D2A9C9: WriteFile.KERNEL32(?,?,?,00000000,00000000), ref: 00D2AA09

Strings

Unrecognized comparison type, xrefs: 00D3079D

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_$FileWrite__wcsicoll
String ID: Unrecognized comparison type
API String ID: 1110922125-3874077786
Opcode ID: 66db039c26286be6c279530517589321a142e9362416aa89aa58fafddf641f4f
Instruction ID: bd53dd4b4349feabaea310638de91c413a4052952c2ba20199ac5db2abae49f6
Opcode Fuzzy Hash: 66db039c26286be6c279530517589321a142e9362416aa89aa58fafddf641f4f
Instruction Fuzzy Hash: 83217271A012149FDB18DF98D451D9EBBB5FF68304F54041EE006A7291DB74A945CF70

Function 00D3080B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D30812

Part of subcall function 00D304C6: __EH_prolog3_GS.LIBCMT ref: 00D304CD

__wcsicoll.LIBCMT ref: 00D308B8

Part of subcall function 00D2A9C9: WriteFile.KERNEL32(?,?,?,00000000,00000000), ref: 00D2AA09

Strings

Invalid comparison type, xrefs: 00D3085D

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_$FileWrite__wcsicoll
String ID: Invalid comparison type
API String ID: 1110922125-70441815
Opcode ID: 486c8aeeb7e12dd371d0b834a442097638863e053dd271a2e53988aeaa701004
Instruction ID: 565fd69811505fc98169f8d126d8185f285c804ef88ceb687f8684a8465e1b5d
Opcode Fuzzy Hash: 486c8aeeb7e12dd371d0b834a442097638863e053dd271a2e53988aeaa701004
Instruction Fuzzy Hash: F911B471A00218DFDF08EF98D85199EBBB4FF64304F10041EE046E7291DB34AA45CBB0

Function 00D38B4A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00D38B51
std::_Xinvalid_argument.LIBCPMT ref: 00D38B68

Part of subcall function 00D6291B: std::exception::exception.LIBCMT ref: 00D62930
Part of subcall function 00D6291B: __CxxThrowException@8.LIBCMT ref: 00D62945

Strings

vector<T> too long, xrefs: 00D38B63

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Exception@8H_prolog3_catchThrowXinvalid_argumentstd::_std::exception::exception
String ID: vector<T> too long
API String ID: 1905828624-3788999226
Opcode ID: 96801e8e741e68ae81d96702b8ce573f3d0aef093942d69346fbb0d281ff1582
Instruction ID: ef641b9b1be90dcb2100e53bfdcfe36871c100db9434880e7e8f1e5102fe8ce9
Opcode Fuzzy Hash: 96801e8e741e68ae81d96702b8ce573f3d0aef093942d69346fbb0d281ff1582
Instruction Fuzzy Hash: 7A1102B6600705AFDB24EF68C882E1AFBE5EF54700F15882DF5898B651DA71E940DB70

Function 00D2F49B Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D2F4A2

Strings

BypassIf, xrefs: 00D2F4D6
FailIf, xrefs: 00D2F4E4

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3
String ID: BypassIf$FailIf
API String ID: 431132790-582475531
Opcode ID: aeb56f0f1804e9a6184942c8920b039870ea966cd3dc23316475e058e9c2166e
Instruction ID: 37fb2d1ca521ea9386c164baa98546a1dbc168a21e77a28c6b0260d2eed04457
Opcode Fuzzy Hash: aeb56f0f1804e9a6184942c8920b039870ea966cd3dc23316475e058e9c2166e
Instruction Fuzzy Hash: AC110A7190022A9FDB10EFA4E9819EEB7F0FF28308F544879E545A7251EB74AA04CB71

Function 00D2AA74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D2AA8C

Part of subcall function 00D62972: std::exception::exception.LIBCMT ref: 00D62987
Part of subcall function 00D62972: __CxxThrowException@8.LIBCMT ref: 00D6299C

_memmove.LIBCMT ref: 00D2AACA

Strings

invalid string position, xrefs: 00D2AA87

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argument_memmovestd::_std::exception::exception
String ID: invalid string position
API String ID: 22950630-1799206989
Opcode ID: 088048c42ee0f5419a0ffb51082ba7819ab670780443e98e591c1a218008b8a9
Instruction ID: dc9f55ce227e46f419958eb7f2ebb0443a90c9a21786262f017370bb07009bcf
Opcode Fuzzy Hash: 088048c42ee0f5419a0ffb51082ba7819ab670780443e98e591c1a218008b8a9
Instruction Fuzzy Hash: D51144323046259BC725CE6CEA8486BB3FAFFE4758324492AD096CB605DA30ED45C7B5

Function 00D338E3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMONLIBRARYCODE

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D338FB

Part of subcall function 00D62972: std::exception::exception.LIBCMT ref: 00D62987
Part of subcall function 00D62972: __CxxThrowException@8.LIBCMT ref: 00D6299C

_memmove.LIBCMT ref: 00D33934

Strings

invalid string position, xrefs: 00D338F6

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Exception@8ThrowXinvalid_argument_memmovestd::_std::exception::exception
String ID: invalid string position
API String ID: 22950630-1799206989
Opcode ID: 1f3594661b649c5b3f9b1d99f23efc1a0d189e66df1ad22e7777560d913d8858
Instruction ID: 9177552b0724992923719bd08eded2a860918fd015515c71815f9c881251ec85
Opcode Fuzzy Hash: 1f3594661b649c5b3f9b1d99f23efc1a0d189e66df1ad22e7777560d913d8858
Instruction Fuzzy Hash: E801F131300755DBD7248E6CDA84A2AB7EAEBC0710B24493DE4D2CB601CBB0EE458BB0

Function 00D4A189 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.ADVAPI32(?,IsInCorpnetHook,00000000,?,?,?), ref: 00D4A1DE

Strings

Software\Microsoft\VisualStudio\Setup, xrefs: 00D4A1A5
IsInCorpnetHook, xrefs: 00D4A1C9

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: QueryValue
String ID: IsInCorpnetHook$Software\Microsoft\VisualStudio\Setup
API String ID: 3660427363-2117743171
Opcode ID: 488105adb4d42b0c6ecf9d5c26bb057b4ef63a75573203819a17efcdd5529205
Instruction ID: aef11d7e9e941423f554c65daf14e2a271e0b3813226eeb7b7098776f2972040
Opcode Fuzzy Hash: 488105adb4d42b0c6ecf9d5c26bb057b4ef63a75573203819a17efcdd5529205
Instruction Fuzzy Hash: 5C111B75A40309AFDF10DF99CC85DEEBBB8EB14304F10416AE906A2240E7719A888B71

Function 00D4A5EC Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D4A5F3

Strings

true, xrefs: 00D4A62B
false, xrefs: 00D4A63E

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3_
String ID: false$true
API String ID: 2427045233-2658103896
Opcode ID: 25f134e25fd8e2525e8f4cc54a48923fc4022c2b483bfe4a7d8f2eb0def0773c
Instruction ID: e6d264caf0a8347a09f87b6a172dce837dcb7a8e7127dbb1eef2502844f4041d
Opcode Fuzzy Hash: 25f134e25fd8e2525e8f4cc54a48923fc4022c2b483bfe4a7d8f2eb0def0773c
Instruction Fuzzy Hash: FF017570D402089FDF10DFA8D851AEEB3B4EF68708F498028F55167281E7759A08CB72

Function 00D419C8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00D419CF

Part of subcall function 00D4B43D: __EH_prolog3.LIBCMT ref: 00D4B444
Part of subcall function 00D4B43D: FindResourceW.KERNEL32(00000000,?,?,00000024,00D4C5D7,0000002B,00000000,?,Files,?), ref: 00D4B47C
Part of subcall function 00D4B43D: LoadResource.KERNEL32(?,00000000,?,Files,?), ref: 00D4B490
Part of subcall function 00D4B43D: SizeofResource.KERNEL32(?,00000000,?,Files,?), ref: 00D4B4A1

Part of subcall function 00D4CD18: __EH_prolog3.LIBCMT ref: 00D4CD1F

Strings

HOMESITE, xrefs: 00D419F2
false, xrefs: 00D41A31

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: Resource$H_prolog3$FindH_prolog3_LoadSizeof
String ID: HOMESITE$false
API String ID: 2490267952-2800361685
Opcode ID: 82a599103403ad27129a7905123bd408bb9851022c59051f8a283c65580f67f9
Instruction ID: e6e17a324d70574ccca68d05f8a4c9b715cdae3d2716adfdc73aba7715a9df5e
Opcode Fuzzy Hash: 82a599103403ad27129a7905123bd408bb9851022c59051f8a283c65580f67f9
Instruction Fuzzy Hash: FF018B35E812489BDB00DFA4E4127EEB7B4DF24314F149429E480A7282DB799289CBB1

Function 00D53E39 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D4F2C1: __getptd.LIBCMT ref: 00D4F2C7
Part of subcall function 00D4F2C1: __getptd.LIBCMT ref: 00D4F2D7

__getptd.LIBCMT ref: 00D53E48

Part of subcall function 00D52EF3: __getptd_noexit.LIBCMT ref: 00D52EF6
Part of subcall function 00D52EF3: __amsg_exit.LIBCMT ref: 00D52F03

__getptd.LIBCMT ref: 00D53E56

Strings

csm, xrefs: 00D53E64

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: __getptd$__amsg_exit__getptd_noexit
String ID: csm
API String ID: 803148776-1018135373
Opcode ID: f765c13f2024c244edcbd7894a507c0d896ffb8dca77b20a828ea37c089f6d47
Instruction ID: 441417ca491245145a1f4b888fe7f1d33971d17cd454d8a7fa9039705e14ad61
Opcode Fuzzy Hash: f765c13f2024c244edcbd7894a507c0d896ffb8dca77b20a828ea37c089f6d47
Instruction Fuzzy Hash: 5E0128758002858BCF389F65C48ABADB7F6AF50352F18452EFC40A6661CB718A89DA71

Function 00D2C719 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00D2C687: LoadLibraryW.KERNEL32(mscoree.dll), ref: 00D2C6A1
Part of subcall function 00D2C687: GetLastError.KERNEL32 ref: 00D2C6AD

GetProcAddress.KERNEL32(00000000,CLRCreateInstance), ref: 00D2C745
GetLastError.KERNEL32 ref: 00D2C74F

Strings

CLRCreateInstance, xrefs: 00D2C73D

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: ErrorLast$AddressLibraryLoadProc
String ID: CLRCreateInstance
API String ID: 1866314245-2576948145
Opcode ID: f166e8666646a1d8b271ef85d078d7339cac7f51c47d7537f17fbff17fdd9a58
Instruction ID: c6eb89822b16adea1fd881194db0dbb628c3f9390e5a5f339279939a5707bf8c
Opcode Fuzzy Hash: f166e8666646a1d8b271ef85d078d7339cac7f51c47d7537f17fbff17fdd9a58
Instruction Fuzzy Hash: 3AF0E23266022ABBDB109BA6ED45A9E77ACEFB0B6AF204025F611E3150D335DE004B70

Function 00D2DB25 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00D2DB2C

Part of subcall function 00D2D49E: __EH_prolog3.LIBCMT ref: 00D2D4A5
Part of subcall function 00D2D49E: __CxxThrowException@8.LIBCMT ref: 00D2D4F8

Strings

Product, xrefs: 00D2DB69
Feature, xrefs: 00D2DB7B

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID: Feature$Product
API String ID: 2489616738-1411323232
Opcode ID: 4459ef91de267c7dc0d9a192cc0813df75c9d7f7eec6c879f1d8da8f8d570118
Instruction ID: b66207f84503f5ae5a3c1a460a74ca91aa727f7d735e6bd23a1820b00622893a
Opcode Fuzzy Hash: 4459ef91de267c7dc0d9a192cc0813df75c9d7f7eec6c879f1d8da8f8d570118
Instruction Fuzzy Hash: E4F0DC71909210EBCB08EF69D80195ABBA1FF48300F00803AF40897661DBB0960087B5

Function 00D2C095 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D2C0C0
_Allocate.LIBCPMT ref: 00D2C0C7

Strings

vector<T> too long, xrefs: 00D2C0BB

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: AllocateXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 2387514879-3788999226
Opcode ID: 5ff1464335f6082c07cc92f4c914475a1efe4aadd4fe18760c3d19a6914c9532
Instruction ID: f1f020a4bd2eee3312a29e2624c87c28b62b2347e30d19be4f82888c8e87655a
Opcode Fuzzy Hash: 5ff1464335f6082c07cc92f4c914475a1efe4aadd4fe18760c3d19a6914c9532
Instruction Fuzzy Hash: 64F0A7725043159F87209F2DF54146BB7E9DBA9724321843FF4ADC3250EE3098419BB0

Function 00D42579 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00D425A1
_Allocate.LIBCPMT ref: 00D425A8

Strings

vector<T> too long, xrefs: 00D4259C

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: AllocateXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 2387514879-3788999226
Opcode ID: 266ebd81166d4c026314b9ff77b76662880004f94b26923169eb69624ed07e6d
Instruction ID: 3a4767d50d14491dc20f6abad3d0aebc694b4757d520b03e9a3478dbb3436b2b
Opcode Fuzzy Hash: 266ebd81166d4c026314b9ff77b76662880004f94b26923169eb69624ed07e6d
Instruction Fuzzy Hash: E3F0E5B65047006F83209F3EE80157ABBE8EAD9730324883FF4A8C3380E53094828770

Function 00D63F76 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(00D63FBE,00D63FD3), ref: 00D63F76
GetEnvironmentVariableA.KERNEL32(VSD_FORCE_ANSI,00000000,00000000), ref: 00D63F89

Strings

VSD_FORCE_ANSI, xrefs: 00D63F84

Memory Dump Source

Source File: 00000002.00000002.3342575243.0000000000D21000.00000020.00000001.01000000.00000005.sdmp, Offset: 00D20000, based on PE: true

Associated: 00000002.00000002.3342541015.0000000000D20000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342641793.0000000000D70000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000002.00000002.3342677834.0000000000D75000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_d20000_setup.jbxd

Similarity

API ID: EnvironmentVariableVersion
String ID: VSD_FORCE_ANSI
API String ID: 2186837676-2962394276
Opcode ID: 522aff597e15c081988692fb580bae5ef68b448c3ff84ceb04f0b15040092d54
Instruction ID: 29a3e78fa9c847a70aefd9b9e4b900b94b655862f7aa1aea9b625e5aa8d8a3c7
Opcode Fuzzy Hash: 522aff597e15c081988692fb580bae5ef68b448c3ff84ceb04f0b15040092d54
Instruction Fuzzy Hash: 11D052343483C08AF3314732AC0CB50BEA20B30B0AF084094EA88C83E1EAF1E1C48335

Analysis Process: StchCtrl.exePID: 3360, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.7%
Total number of Nodes:	1486
Total number of Limit Nodes:	56

Executed Functions

Function 00F865FF Relevance: 103.8, APIs: 48, Strings: 11, Instructions: 557
libraryloaderstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00F86609

Part of subcall function 00F7E887: __EH_prolog3.LIBCMT ref: 00F7E88E
Part of subcall function 00F7E887: GetWindowDC.USER32(00000000,00000004,00F86129,00000000,?,?,0109A46C), ref: 00F7E8BA

GetDeviceCaps.GDI32(?,00000058), ref: 00F8662F
DeleteObject.GDI32(00000000), ref: 00F86690
DeleteObject.GDI32(00000000), ref: 00F866AD
DeleteObject.GDI32(00000000), ref: 00F866CA
DeleteObject.GDI32(00000000), ref: 00F866E1
DeleteObject.GDI32(00000000), ref: 00F866FE
DeleteObject.GDI32(00000000), ref: 00F86715
DeleteObject.GDI32(00000000), ref: 00F8672C
DeleteObject.GDI32(00000000), ref: 00F86743
DeleteObject.GDI32(00000000), ref: 00F86760
DeleteObject.GDI32(00000000), ref: 00F86777
_memset.LIBCMT ref: 00F8678E
GetTextCharsetInfo.GDI32(?,00000000,00000000), ref: 00F8679E
lstrcpyA.KERNEL32(?,?), ref: 00F867ED
EnumFontFamiliesA.GDI32(?,00000000,Function_000265B6), ref: 00F86814
lstrcpyA.KERNEL32(?), ref: 00F86824
EnumFontFamiliesA.GDI32(?,00000000,Function_000265B6), ref: 00F8683F
lstrcpyA.KERNEL32(?), ref: 00F86857
CreateFontIndirectA.GDI32(?), ref: 00F86863
CreateFontIndirectA.GDI32(?), ref: 00F868B3
CreateFontIndirectA.GDI32(?), ref: 00F868EE
CreateFontIndirectA.GDI32(?), ref: 00F86916
CreateFontIndirectA.GDI32(?), ref: 00F86933
GetSystemMetrics.USER32(00000048), ref: 00F8694E
lstrcpyA.KERNEL32(?), ref: 00F86962
CreateFontIndirectA.GDI32(?), ref: 00F86968
GetStockObject.GDI32(00000011), ref: 00F86996
GetObjectA.GDI32(?,0000003C,?), ref: 00F869B8
lstrcpyA.KERNEL32(?), ref: 00F869F1
CreateFontIndirectA.GDI32(?), ref: 00F869FB
CreateFontIndirectA.GDI32(?), ref: 00F86A1A
GetStockObject.GDI32(00000011), ref: 00F86A30
GetObjectA.GDI32(?,0000003C,?), ref: 00F86A41
CreateFontIndirectA.GDI32(?), ref: 00F86A4B
CreateFontIndirectA.GDI32(?), ref: 00F86A6E
__EH_prolog3_GS.LIBCMT ref: 00F86AF9
GetVersionExA.KERNEL32(?,0000009C,00000000), ref: 00F86C4F
GetSystemMetrics.USER32(00001000), ref: 00F86C5A
GetProcAddress.KERNEL32(00000000,DrawThemeParentBackground), ref: 00F86CDF
GetProcAddress.KERNEL32(?,DrawThemeTextEx), ref: 00F86CF2
GetProcAddress.KERNEL32(?,BufferedPaintInit), ref: 00F86D05
GetProcAddress.KERNEL32(?,BufferedPaintUnInit), ref: 00F86D18
GetProcAddress.KERNEL32(?,BeginBufferedPaint), ref: 00F86D2B
GetProcAddress.KERNEL32(?,EndBufferedPaint), ref: 00F86D3E
GetProcAddress.KERNEL32(00000000,DwmExtendFrameIntoClientArea), ref: 00F86D87
GetProcAddress.KERNEL32(?,DwmDefWindowProc), ref: 00F86D9A
GetProcAddress.KERNEL32(?,DwmIsCompositionEnabled), ref: 00F86DAD

Strings

DwmExtendFrameIntoClientArea, xrefs: 00F86D81
dwmapi.dll, xrefs: 00F86D6C
UxTheme.dll, xrefs: 00F86CBE
EndBufferedPaint, xrefs: 00F86D2D
DrawThemeTextEx, xrefs: 00F86CE1
BufferedPaintInit, xrefs: 00F86CF4
BufferedPaintUnInit, xrefs: 00F86D07
DwmIsCompositionEnabled, xrefs: 00F86D9C
DwmDefWindowProc, xrefs: 00F86D89
BeginBufferedPaint, xrefs: 00F86D1A
DrawThemeParentBackground, xrefs: 00F86CD9

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Object$Font$CreateDeleteIndirect$AddressProc$lstrcpy$EnumFamiliesH_prolog3_MetricsStockSystem$CapsCharsetDeviceH_prolog3InfoTextVersionWindow_memset
String ID: BeginBufferedPaint$BufferedPaintInit$BufferedPaintUnInit$DrawThemeParentBackground$DrawThemeTextEx$DwmDefWindowProc$DwmExtendFrameIntoClientArea$DwmIsCompositionEnabled$EndBufferedPaint$UxTheme.dll$dwmapi.dll
API String ID: 3153784359-1174303547
Opcode ID: 1f49fb0c4a951cb318cef69df2432c55b73f16cdd23a51d7f52a9e2268b526b4
Instruction ID: a5b934af091ae0625fceda15859a127a3b2eed2eb4adba61e14f1a17164740a9
Opcode Fuzzy Hash: 1f49fb0c4a951cb318cef69df2432c55b73f16cdd23a51d7f52a9e2268b526b4
Instruction Fuzzy Hash: EA3236B0D017199BCB21AF65C844BDEFBF8BF18700F1088AEE5AAA6251DB746640DF51

Function 73F712A0 Relevance: 4.5, APIs: 3, Instructions: 23COMMON

Download Yara Rule

APIs

Part of subcall function 73F71210: GetTickCount.KERNEL32 ref: 73F71210

SetWindowsHookExA.USER32(00000002,?KeyboardProc@@YGJHIJ@Z,?,00000000), ref: 73F712CD
SetWindowsHookExA.USER32(00000007,?MouseProc@@YGJHIJ@Z,?,00000000), ref: 73F712E4

Memory Dump Source

Source File: 0000000B.00000002.3343131863.0000000073F71000.00000020.00000001.01000000.00000009.sdmp, Offset: 73F70000, based on PE: true

Associated: 0000000B.00000002.3343115432.0000000073F70000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3343154705.0000000073F76000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3343170802.0000000073F79000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 0000000B.00000002.3343186259.0000000073F7C000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_73f70000_StchCtrl.jbxd

Similarity

API ID: HookWindows$CountTick
String ID:
API String ID: 3839273497-0
Opcode ID: 1534090b4dd0b796817850b5a0171cf31061137a2fa911c021de5ec1757de4c2
Instruction ID: eb41b65e0a93dda63d57fbd8d3b4462dd6bb8535b6304c0b8d32876631f971b3
Opcode Fuzzy Hash: 1534090b4dd0b796817850b5a0171cf31061137a2fa911c021de5ec1757de4c2
Instruction Fuzzy Hash: 45E01232958614EEE620AAA5DC15B6436A8B3163D0FA0410BE21B971E4D7B06C48CB58

Function 00F860CD Relevance: 64.8, APIs: 43, Instructions: 304
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00F860D4
GetSysColor.USER32(00000016), ref: 00F860E3
GetSysColor.USER32(0000000F), ref: 00F860F0
GetSysColor.USER32(00000015), ref: 00F86103
GetSysColor.USER32(0000000F), ref: 00F8610B
GetDeviceCaps.GDI32(?,0000000C), ref: 00F86131
GetSysColor.USER32(0000000F), ref: 00F8613F
GetSysColor.USER32(00000010), ref: 00F86149
GetSysColor.USER32(00000015), ref: 00F86153
GetSysColor.USER32(00000016), ref: 00F8615D
GetSysColor.USER32(00000014), ref: 00F86167
GetSysColor.USER32(00000012), ref: 00F86171
GetSysColor.USER32(00000011), ref: 00F8617B
GetSysColor.USER32(00000006), ref: 00F86182
GetSysColor.USER32(0000000D), ref: 00F86189
GetSysColor.USER32(0000000E), ref: 00F86190
GetSysColor.USER32(00000005), ref: 00F86197
GetSysColor.USER32(00000008), ref: 00F861A1
GetSysColor.USER32(00000009), ref: 00F861A8
GetSysColor.USER32(00000007), ref: 00F861AF
GetSysColor.USER32(00000002), ref: 00F861B6
GetSysColor.USER32(00000003), ref: 00F861BD
GetSysColor.USER32(0000001B), ref: 00F861C4
GetSysColor.USER32(0000001C), ref: 00F861CE
GetSysColor.USER32(0000000A), ref: 00F861D8
GetSysColor.USER32(0000000B), ref: 00F861E2
GetSysColor.USER32(00000013), ref: 00F861EC
GetSysColor.USER32(0000001A), ref: 00F86206
GetSysColorBrush.USER32(00000010), ref: 00F86221
GetSysColorBrush.USER32(00000014), ref: 00F86238
GetSysColorBrush.USER32(00000005), ref: 00F8624A
CreateSolidBrush.GDI32(?), ref: 00F8626E
CreateSolidBrush.GDI32(?), ref: 00F8628A
CreateSolidBrush.GDI32(?), ref: 00F862A6
CreateSolidBrush.GDI32(?), ref: 00F862C2
CreateSolidBrush.GDI32(?), ref: 00F862DE
CreateSolidBrush.GDI32(?), ref: 00F862FA
CreateSolidBrush.GDI32(?), ref: 00F86316
CreatePen.GDI32(00000000,00000001,00000000), ref: 00F8633F
CreatePen.GDI32(00000000,00000001,00000000), ref: 00F86362
CreatePen.GDI32(00000000,00000001,00000000), ref: 00F86385
CreateSolidBrush.GDI32(?), ref: 00F86409
CreatePatternBrush.GDI32(00000000), ref: 00F8644A

Part of subcall function 00F7EA8C: DeleteObject.GDI32(00000000), ref: 00F7EA9B

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Color$BrushCreate$Solid$CapsDeleteDeviceH_prolog3ObjectPattern
String ID:
API String ID: 3754413814-0
Opcode ID: d1bfac3c89c871289236614cddb2ebc8b341239aa9b3b80ca5215d0040418b94
Instruction ID: 5435e741f8cb582b69a3b3e0633422f78bfec0f00826394dae8308ea282ec110
Opcode Fuzzy Hash: d1bfac3c89c871289236614cddb2ebc8b341239aa9b3b80ca5215d0040418b94
Instruction Fuzzy Hash: 6EB17A70900B449ADB31FF75CC46BABBBE0BF44700F00896EE19B86591EE79A544EF21

Function 00FF2627 Relevance: 42.4, APIs: 22, Strings: 2, Instructions: 421
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3.LIBCMT ref: 00FF2631
LoadImageW.USER32(00000000,?,00000000,00000000,00000000,00002000), ref: 00FF27F3
GetObjectA.GDI32(00000082,00000018,?), ref: 00FF2805
CreateCompatibleDC.GDI32(00000000), ref: 00FF2857
GetObjectA.GDI32(00000082,00000018,?), ref: 00FF2872
SelectObject.GDI32(?,00000082), ref: 00FF2886
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00FF28AA
SelectObject.GDI32(?,00000000), ref: 00FF28BD
CreateCompatibleDC.GDI32(?), ref: 00FF28D3
SelectObject.GDI32(?,?), ref: 00FF28E8
SelectObject.GDI32(?,00000000), ref: 00FF28F7
DeleteObject.GDI32(?), ref: 00FF28FC
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00FF291C
GetPixel.GDI32(?,?,?), ref: 00FF293B
SetPixel.GDI32(?,?,?,00000000), ref: 00FF2971
SelectObject.GDI32(?,?), ref: 00FF2993
SelectObject.GDI32(?,00000000), ref: 00FF299B
DeleteObject.GDI32(00000082), ref: 00FF29A0
DeleteObject.GDI32(00000082), ref: 00FF29D2
__EH_prolog3.LIBCMT ref: 00FF2A06
CreateCompatibleDC.GDI32(00000000), ref: 00FF2AD1
CreateCompatibleDC.GDI32(00000000), ref: 00FF2ADD

Strings

@Ls Fs, xrefs: 00FF2857, 00FF28D3, 00FF2AD1, 00FF2ADD
, xrefs: 00FF280B

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Object$Select$CompatibleCreate$Delete$H_prolog3Pixel$BitmapImageLoad
String ID: $@Ls Fs
API String ID: 1197801157-1242102843
Opcode ID: 6522f86eac2e5615d894c97b8d24de98809618bea3e1fb92b473154a02926717
Instruction ID: 59a6caafe286fe1eaee5a0ed794d3c05f286d8821c88a46d837e131bf620c168
Opcode Fuzzy Hash: 6522f86eac2e5615d894c97b8d24de98809618bea3e1fb92b473154a02926717
Instruction Fuzzy Hash: F8027B71D00219DFCF65DFA8C880AADBBB5FF08710F10816AF945AB26AC7754941EFA1

Function 00F77638 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 176
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00F77642

Part of subcall function 00F84CAE: __EH_prolog3.LIBCMT ref: 00F84CB5

CallNextHookEx.USER32(?,?,?,?), ref: 00F77686

Part of subcall function 00F72127: __CxxThrowException@8.LIBCMT ref: 00F7213D
Part of subcall function 00F72127: __EH_prolog3.LIBCMT ref: 00F7214A

GetClassLongA.USER32(?,000000E6), ref: 00F776CA
GlobalGetAtomNameA.KERNEL32 ref: 00F776F4
SetWindowLongA.USER32(?,000000FC,Function_00016233), ref: 00F77749
_memset.LIBCMT ref: 00F77787

Part of subcall function 00F740CA: ActivateActCtx.KERNEL32(?,?,010BAE40,00000010), ref: 00F740EA

GetClassLongA.USER32(?,000000E0), ref: 00F777B7
GetClassNameA.USER32(?,?,00000100), ref: 00F777D8
GetWindowLongA.USER32(?,000000FC), ref: 00F777FC
GetPropA.USER32(?,AfxOldWndProc423), ref: 00F77816
SetPropA.USER32(?,AfxOldWndProc423,?), ref: 00F77821
GetPropA.USER32(?,AfxOldWndProc423), ref: 00F77829
GlobalAddAtomA.KERNEL32(AfxOldWndProc423), ref: 00F77831
SetWindowLongA.USER32(?,000000FC,Function_000174D1), ref: 00F7783F
CallNextHookEx.USER32(?,00000003,?,?), ref: 00F77857
UnhookWindowsHookEx.USER32(?), ref: 00F7786B

Strings

#32768, xrefs: 00F77799, 00F7779E, 00F777E8
AfxOldWndProc423, xrefs: 00F7780F, 00F77814, 00F7781F, 00F77827, 00F77830
ime, xrefs: 00F776FD

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Long$ClassHookPropWindow$AtomCallGlobalH_prolog3NameNext$ActivateException@8H_prolog3_ThrowUnhookWindows_memset
String ID: #32768$AfxOldWndProc423$ime
API String ID: 2595272471-4034971020
Opcode ID: 99e314e8958444186bbf5fb64815fdfe691968ac4b7da815a86f22738d13569d
Instruction ID: 4ea5566bdfcffd125dab0c29c3d0c0980d927061a7e700c065e6c53598164f58
Opcode Fuzzy Hash: 99e314e8958444186bbf5fb64815fdfe691968ac4b7da815a86f22738d13569d
Instruction Fuzzy Hash: D951F831918316DBDB25AF25CC48BEE7B78BF08360F204156F98DA6185DB38DD41DBA2

Function 00F64F60 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 343
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00F8051E: _free.LIBCMT ref: 00F80529
Part of subcall function 00F8051E: __strdup.LIBCMT ref: 00F80531
Part of subcall function 00F8051E: _free.LIBCMT ref: 00F8053C
Part of subcall function 00F8051E: __strdup.LIBCMT ref: 00F80544

GetCommandLineA.KERNEL32(Shelter Publications,16B3F121), ref: 00F64F94
PostMessageA.USER32(00000000,00000012,00000000,00000000), ref: 00F65029
CreateCompatibleDC.GDI32(00000000), ref: 00F650E9
GetDeviceCaps.GDI32(?,0000000C), ref: 00F65102
LoadIconW.USER32(?,00000002), ref: 00F65194
LoadCursorA.USER32(?,00007F00), ref: 00F651AB

Part of subcall function 00F63360: GetModuleHandleA.KERNEL32(00000000,?,00000104,16B3F121), ref: 00F6339C
Part of subcall function 00F63360: GetModuleFileNameA.KERNEL32(00000000), ref: 00F633A3
Part of subcall function 00F63360: RegCreateKeyExA.ADVAPI32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 00F633CA
Part of subcall function 00F63360: RegSetValueExA.ADVAPI32(?,StretchWare StchCtrl,00000000,00000001,?,?), ref: 00F63403
Part of subcall function 00F63360: GetLastError.KERNEL32 ref: 00F6340D
Part of subcall function 00F63360: RegCloseKey.ADVAPI32(?), ref: 00F6341C
Part of subcall function 00F63360: FormatMessageA.KERNEL32(00001000,00000000,00000000,00000000,?,00000104,00000000), ref: 00F63448

Part of subcall function 00F79743: ShowWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F7C535), ref: 00F79754

UpdateWindow.USER32(?), ref: 00F6522F

Part of subcall function 00F6DBD1: _malloc.LIBCMT ref: 00F6DBEF

Strings

@Ls Fs, xrefs: 00F650E9
LastStretchTopic, xrefs: 00F65072
Shelter Publications, xrefs: 00F64F8A
-REMOVE, xrefs: 00F64FE7
StretchWare, xrefs: 00F65077
-INSTALL, xrefs: 00F64FBC, 00F6531B

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: CreateLoadMessageModuleWindow__strdup_free$CapsCloseCommandCompatibleCursorDeviceErrorFileFormatHandleIconLastLineNamePostShowUpdateValue_malloc
String ID: -INSTALL$-REMOVE$@Ls Fs$LastStretchTopic$Shelter Publications$StretchWare
API String ID: 630048173-134122987
Opcode ID: ceeac63e01d8015374d20e2384886fb8d2bff283b960ca02f883ff3869010260
Instruction ID: 6a0ef95314e3db5fc0218b1ad0140f699b89760a8ce8039e9850b8615ffb95f4
Opcode Fuzzy Hash: ceeac63e01d8015374d20e2384886fb8d2bff283b960ca02f883ff3869010260
Instruction Fuzzy Hash: 2EC1D271A006059FCB14EFB8CC92AAEB7B5BF44720F14462EE016E72C1EF399901DB91

Function 00F61240 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 109
registryclipboardtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterClipboardFormatA.USER32(01087DA8), ref: 00F6128B
GetLastError.KERNEL32(?,00000400,?,?,?), ref: 00F61296
RegisterClipboardFormatA.USER32(01087D94), ref: 00F612A5
GetLastError.KERNEL32(?,00000400,?,?,?), ref: 00F612B0
RegisterClipboardFormatA.USER32(01087D7C), ref: 00F612BF
GetLastError.KERNEL32(?,00000400,?,?,?), ref: 00F612CA
?EnableHotKey@@YGXH@Z.STRETCHHOOK(00000001,?,00000400,?,?,?), ref: 00F61332
?SetHotKey@@YGHHHHH@Z.STRETCHHOOK(00000000,00000000,00000000,00000000,?,00000400,?,?,?), ref: 00F61349
SetTimer.USER32(?,000004D2,00000064,00000000), ref: 00F6135C

Strings

HotKey Modifiers, xrefs: 00F6131B
HotKey Enable, xrefs: 00F612F0
Preferences, xrefs: 00F612F5, 00F6130E, 00F61325
HotKey Keycode, xrefs: 00F61309

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: ClipboardErrorFormatLastRegister$Key@@$EnableTimer
String ID: HotKey Enable$HotKey Keycode$HotKey Modifiers$Preferences
API String ID: 3990847425-1568940631
Opcode ID: 8e99ea68c8c15750f94410fb56df5b5b9cb541f4cd30a5872da2bf97dbf87624
Instruction ID: fa9a38cf3fb2aa542326f7435ebdf63548f11510bd98f2c71c3df17c685b11d9
Opcode Fuzzy Hash: 8e99ea68c8c15750f94410fb56df5b5b9cb541f4cd30a5872da2bf97dbf87624
Instruction Fuzzy Hash: B3310871710600ABD720EFB9DC51F5A77E8FB58764F20812AF694D7284DB76D800DB94

Function 00F8AD6E Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 00F8ADAB
PathFindExtensionA.KERNELBASE(?), ref: 00F8ADC5
__strdup.LIBCMT ref: 00F8AE0D
__strdup.LIBCMT ref: 00F8AE4B
__strdup.LIBCMT ref: 00F8AE7F
_strcpy_s.LIBCMT ref: 00F8AEC5
__strdup.LIBCMT ref: 00F8AEDA
_strcat_s.LIBCMT ref: 00F8AF07
__strdup.LIBCMT ref: 00F8AF19

Strings

.CHM, xrefs: 00F8AEB2
.HLP, xrefs: 00F8AEB9
.INI, xrefs: 00F8AEFA

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: __strdup$ExtensionFileFindModuleNamePath_strcat_s_strcpy_s
String ID: .CHM$.HLP$.INI
API String ID: 3308358609-4017452060
Opcode ID: 40215842c3c6ff34514654adb7c6845e7a3648cc5118408f16b1372675a61afa
Instruction ID: 9dab677ba47fa490db7278e96674beafeb0ff0e8ba8edae07bd8fd447f4c1f8c
Opcode Fuzzy Hash: 40215842c3c6ff34514654adb7c6845e7a3648cc5118408f16b1372675a61afa
Instruction Fuzzy Hash: 2C516AB19007199AEB31FB65CC44BDAB7ECEB04314F0048ABE585D7141EBB4E984DB62

Function 00F63C00 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 104
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(StretchRes,?,?,00000000,?,?,00F64335), ref: 00F63C11
FindResourceA.KERNEL32(00000000,000000C8,Stsq), ref: 00F63C24
SizeofResource.KERNEL32(00000000,00000000,?,00F64335), ref: 00F63C36
LoadResource.KERNEL32(00000000,00000000,?,00F64335), ref: 00F63C40
LockResource.KERNEL32(00000000,?,00F64335), ref: 00F63C47
_memmove.LIBCMT ref: 00F63C94
_strnlen.LIBCMT ref: 00F63CAE

Strings

Sequence Index, xrefs: 00F63D1A
Sequence, xrefs: 00F63CFD
StretchRes, xrefs: 00F63C09
Preferences, xrefs: 00F63D02, 00F63D1F
Stsq, xrefs: 00F63C17

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Resource$FindHandleLoadLockModuleSizeof_memmove_strnlen
String ID: Preferences$Sequence$Sequence Index$StretchRes$Stsq
API String ID: 924897836-2695636484
Opcode ID: e54fa638843107551d7c3c474af4ae10ff857ff7c58cd04b63dd9e5c60992c05
Instruction ID: 9889dd127759c55ca4a1f12ec473f0b68cedf34a271cfe1dda812552d3560c7e
Opcode Fuzzy Hash: e54fa638843107551d7c3c474af4ae10ff857ff7c58cd04b63dd9e5c60992c05
Instruction Fuzzy Hash: C3311031B016019FD310EB68CC88E2EBBE9FF88360F248169F5959B341DB74AD119BD0

Function 00F62FC0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 91
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software,00000000,0002001F,?), ref: 00F62FF9
RegCreateKeyExA.ADVAPI32(?,Shelter Publications,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 00F63023
RegCreateKeyExA.ADVAPI32(?,Stretch,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 00F63043
RegCreateKeyExA.ADVAPI32(?,StretchWare,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 00F63063
RegCloseKey.ADVAPI32(?), ref: 00F63073
RegCloseKey.ADVAPI32(?), ref: 00F6307D
RegCloseKey.ADVAPI32(?), ref: 00F63087

Strings

Stretch, xrefs: 00F6303D
Shelter Publications, xrefs: 00F6301D
Software, xrefs: 00F62FE3
StretchWare, xrefs: 00F6305D

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: CloseCreate$Open
String ID: Shelter Publications$Software$Stretch$StretchWare
API String ID: 1740278721-25447048
Opcode ID: dae87b6c479a26aeae6957873a7f82a76f509e002b47e20c62d5c984812cbca3
Instruction ID: 01ffe817f352833d53970a720cd58102a54de3bdde7c7a1bae42694b77943d59
Opcode Fuzzy Hash: dae87b6c479a26aeae6957873a7f82a76f509e002b47e20c62d5c984812cbca3
Instruction Fuzzy Hash: 55216076E00219BADB20DB9ACC88DAFBBBCEBC5B04B10405EF544E710AD6705A04DB70

Function 00F848C7 Relevance: 16.6, APIs: 11, Instructions: 106
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(010D3144,?,?,?,010D3128,010D3128,?,00F84D02,00000004,00F72A96,00F72143,00F72ABF,00F7B84A,00F632F6,?,00F6163B), ref: 00F848DA
GlobalAlloc.KERNELBASE(00000002,00000000,?,?,?,010D3128,010D3128,?,00F84D02,00000004,00F72A96,00F72143,00F72ABF,00F7B84A,00F632F6), ref: 00F84930
GlobalHandle.KERNEL32(008A2688), ref: 00F84939
GlobalUnlock.KERNEL32(00000000,?,?,?,010D3128,010D3128,?,00F84D02,00000004,00F72A96,00F72143,00F72ABF,00F7B84A,00F632F6,?,00F6163B), ref: 00F84943
GlobalReAlloc.KERNEL32(?,00000000,00002002), ref: 00F8495C
GlobalHandle.KERNEL32(008A2688), ref: 00F8496E
GlobalLock.KERNEL32(00000000,?,?,?,010D3128,010D3128,?,00F84D02,00000004,00F72A96,00F72143,00F72ABF,00F7B84A,00F632F6,?,00F6163B), ref: 00F84975
LeaveCriticalSection.KERNEL32(?,?,?,?,010D3128,010D3128,?,00F84D02,00000004,00F72A96,00F72143,00F72ABF,00F7B84A,00F632F6,?,00F6163B), ref: 00F8497E
GlobalLock.KERNEL32(00000000,?,?,?,010D3128,010D3128,?,00F84D02,00000004,00F72A96,00F72143,00F72ABF,00F7B84A,00F632F6,?,00F6163B), ref: 00F8498A
_memset.LIBCMT ref: 00F849A4
LeaveCriticalSection.KERNEL32(?), ref: 00F849D2

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Global$CriticalSection$AllocHandleLeaveLock$EnterUnlock_memset
String ID:
API String ID: 496899490-0
Opcode ID: d7fb938f7bd4600192eabd3320284542e9249b867cb546482a433e0c169a037c
Instruction ID: d920d49056a20fad900cce10807a0d042ac51596a25c997226f73497b1e79ecc
Opcode Fuzzy Hash: d7fb938f7bd4600192eabd3320284542e9249b867cb546482a433e0c169a037c
Instruction Fuzzy Hash: 7931CD72A04705AFD731AF68DC89A9FBBF8EF44310B118929E5C6D3644DB39F8408B60

Function 00F774D1 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00F774D8
GetPropA.USER32(?,AfxOldWndProc423), ref: 00F774F0
CallWindowProcA.USER32(?,?,00000110,?,?), ref: 00F7755C

Part of subcall function 00F7608D: GetWindowRect.USER32(?,?), ref: 00F760D0
Part of subcall function 00F7608D: GetWindow.USER32(?,00000004), ref: 00F760ED

SetWindowLongA.USER32(?,000000FC,?), ref: 00F77583
RemovePropA.USER32(?,AfxOldWndProc423), ref: 00F7758B
GlobalFindAtomA.KERNEL32(AfxOldWndProc423), ref: 00F77592
GlobalDeleteAtom.KERNEL32(?), ref: 00F7759C

Part of subcall function 00F744D3: GetWindowRect.USER32(?,?), ref: 00F744E2

CallWindowProcA.USER32(?,?,?,?,?), ref: 00F775EF

Strings

AfxOldWndProc423, xrefs: 00F774E3, 00F774E8, 00F77589, 00F77591

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$AtomCallGlobalProcPropRect$DeleteFindH_prolog3_catch_LongRemove
String ID: AfxOldWndProc423
API String ID: 3351853316-1060338832
Opcode ID: ffaacdb6334dab1d3e50db55f77db1caf13054dcfdafefba969c206dd97ec504
Instruction ID: f5cb4692d8876ae97b6cce905113607d920a06a81f68ee1cbc5d8a3e5d667f31
Opcode Fuzzy Hash: ffaacdb6334dab1d3e50db55f77db1caf13054dcfdafefba969c206dd97ec504
Instruction Fuzzy Hash: 0B316F71C14219ABCB15AFB8DC48DEEBEB8FF08310F14811AF95AB2255C7398910EB65

Function 00F634E0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000100), ref: 00F63501
GetModuleFileNameA.KERNEL32(00000000), ref: 00F63508
__wsplitpath.LIBCMT ref: 00F63527

Part of subcall function 01061234: __splitpath_helper.LIBCMT ref: 01061276

CreateFileA.KERNELBASE(?,00000000,00000000,00000000,00000003,00000000,00000000), ref: 00F635B6
GetLastError.KERNEL32 ref: 00F635BE
CloseHandle.KERNEL32(00000000), ref: 00F635D3

Strings

stretch.exe, xrefs: 00F63589

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: FileHandleModule$CloseCreateErrorLastName__splitpath_helper__wsplitpath
String ID: stretch.exe
API String ID: 3286411828-1584523231
Opcode ID: fee31cc7af37bf0ba2bccb0876e0a9fd3022aa1b04f7a7b468b39d23e99d9783
Instruction ID: f8bc2839d6ef060658822b2ff348e4bfc30372a0cd9384c3aa9a8e2643707a40
Opcode Fuzzy Hash: fee31cc7af37bf0ba2bccb0876e0a9fd3022aa1b04f7a7b468b39d23e99d9783
Instruction Fuzzy Hash: E3314975A002095BC724DB689C54BEE77E4EB98310F1481E9EAD6D7284EF719E44CB90

Function 00F84E81 Relevance: 12.0, APIs: 8, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserCallbackDispatcher.NTDLL(0000000B), ref: 00F84E90
GetSystemMetrics.USER32(0000000C), ref: 00F84E97
GetSystemMetrics.USER32(00000002), ref: 00F84E9E
GetSystemMetrics.USER32(00000003), ref: 00F84EA8
GetDC.USER32(00000000), ref: 00F84EB2
GetDeviceCaps.GDI32(00000000,00000058), ref: 00F84EC3
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F84ECB
ReleaseDC.USER32(00000000,00000000), ref: 00F84ED3

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: MetricsSystem$CapsDevice$CallbackDispatcherReleaseUser
String ID:
API String ID: 1031845853-0
Opcode ID: cb4685dcdf6d0fa350b696926250ff2c20b7a5ed675966978609763a931d87ff
Instruction ID: 6e6fb4cc832ce3bd0c3eb53f78b1500e8dc4ca4323e0afe228c2b9d1c9f2b769
Opcode Fuzzy Hash: cb4685dcdf6d0fa350b696926250ff2c20b7a5ed675966978609763a931d87ff
Instruction Fuzzy Hash: 20F062B1E44714AAE7205B719C49B1B7F64FB40761F104426E6858B184CBBA9801CFD0

Function 00F80995 Relevance: 10.7, APIs: 7, Instructions: 243registryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F8099C
RegQueryValueExA.ADVAPI32(00000000,?,00000000,?,00000000,?,00000010), ref: 00F809F3
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00F80A1A

Part of subcall function 00F6DBD1: _malloc.LIBCMT ref: 00F6DBEF

RegQueryValueExA.KERNELBASE(?,?,00000000,?,00000000,?,00000000,16B3F121,?,00000000,?,00000000,0107AC7A,000000FF,?,80070057), ref: 00F80B97
RegQueryValueExA.KERNELBASE(?,?,00000000,?,00000000,?,?,?,80070057), ref: 00F80BD0
RegCloseKey.KERNELBASE(?,?,80070057), ref: 00F80BEB
GetPrivateProfileStringA.KERNEL32(?,?,?,?,00001000,?), ref: 00F80C54

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: QueryValue$CloseH_prolog3PrivateProfileString_malloc
String ID:
API String ID: 900355960-0
Opcode ID: 49c82b906e63423240f9cfea7f9fcc8fbfee3505a0803685d52e2315e9b21b19
Instruction ID: e6a1cc12966a4cfc9d598733450796d987bcfb7749a83c9262c0d325c5501317
Opcode Fuzzy Hash: 49c82b906e63423240f9cfea7f9fcc8fbfee3505a0803685d52e2315e9b21b19
Instruction Fuzzy Hash: 72919171D00269AFCB25EF24CC449EEBBB8FF08310F50459AF45997251DB789A84EFA0

Function 00F80643 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 78registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000001,software,00000000,0002001F,?), ref: 00F8067E
RegCreateKeyExA.KERNELBASE(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 00F806A9
RegCreateKeyExA.KERNELBASE(?,?,00000000,00000000,00000000,0002001F,00000000,?,?), ref: 00F806D4
RegCloseKey.KERNELBASE(?), ref: 00F806E8
RegCloseKey.ADVAPI32(?), ref: 00F806F2

Part of subcall function 00F80568: GetModuleHandleA.KERNEL32(Advapi32.dll), ref: 00F8057A
Part of subcall function 00F80568: GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedA), ref: 00F8058A

Strings

software, xrefs: 00F80660

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: CloseCreate$AddressHandleModuleOpenProc
String ID: software
API String ID: 550756860-2010147023
Opcode ID: 4acf2e6f23e106dc9ffae0dc8eb94eaa9f8ed5d3a9470b87f2b80f5d58a075ad
Instruction ID: e7674a1618b4ce4bea334091f7197f7d3598d7b187faf3166256a01437e03f14
Opcode Fuzzy Hash: 4acf2e6f23e106dc9ffae0dc8eb94eaa9f8ed5d3a9470b87f2b80f5d58a075ad
Instruction Fuzzy Hash: 41214C32D04008FB8B61AA85CC88CEFBFBEEFC5710B64006AF545A6015EA315E58EF60

Function 00F7221F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 00F72252
SetLastError.KERNEL32(0000006F), ref: 00F72269
CreateActCtxWWorker.KERNEL32(?), ref: 00F722B1
CreateActCtxWWorker.KERNEL32(00000020), ref: 00F722CF
CreateActCtxWWorker.KERNEL32(00000020), ref: 00F722F1

Strings

, xrefs: 00F72293

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: CreateWorker$ErrorFileLastModuleName
String ID:
API String ID: 3218422885-3916222277
Opcode ID: 8df1be45d90b052085b69edece9c3bba42493425d0bb7231c50aac561fbc3e5f
Instruction ID: 7944791d526b5a6be6f1fac40852260af6d673dc789dd7397ca77e814b381959
Opcode Fuzzy Hash: 8df1be45d90b052085b69edece9c3bba42493425d0bb7231c50aac561fbc3e5f
Instruction Fuzzy Hash: 7D214C708002189EDB60DF75D8487EEB7F8BF58324F10869AD0A9D2190DB785A85DF61

Function 01006413 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 39COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0100641A

Part of subcall function 00F890B9: EnterCriticalSection.KERNEL32(010D35D8,?,?,?,?,00F847F0,00000010,00000008,00F72AB5,00F72A4C,00F72143,00F72ABF,00F7B84A,00F632F6,?,00F6163B), ref: 00F890F3
Part of subcall function 00F890B9: InitializeCriticalSection.KERNEL32(?,?,?,?,?,00F847F0,00000010,00000008,00F72AB5,00F72A4C,00F72143,00F72ABF,00F7B84A,00F632F6,?,00F6163B), ref: 00F89105
Part of subcall function 00F890B9: LeaveCriticalSection.KERNEL32(010D35D8,?,?,?,?,00F847F0,00000010,00000008,00F72AB5,00F72A4C,00F72143,00F72ABF,00F7B84A,00F632F6,?,00F6163B), ref: 00F89112
Part of subcall function 00F890B9: EnterCriticalSection.KERNEL32(?,?,?,?,?,00F847F0,00000010,00000008,00F72AB5,00F72A4C,00F72143,00F72ABF,00F7B84A,00F632F6,?,00F6163B), ref: 00F89122

GetProfileIntA.KERNEL32(windows,DragMinDist,00000002), ref: 01006472
GetProfileIntA.KERNEL32(windows,DragDelay,000000C8), ref: 01006484

Strings

DragMinDist, xrefs: 01006467
DragDelay, xrefs: 01006479
windows, xrefs: 0100646C, 01006471, 0100647E

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: CriticalSection$EnterProfile$H_prolog3InitializeLeave
String ID: DragDelay$DragMinDist$windows
API String ID: 3965097884-2101198082
Opcode ID: 728f0f5a312bdb9b3f48ce406a68e035c40b7734784bc7cdc5b79375c6b74777
Instruction ID: b6ded618bbec66fad331eafe0ccaf873d1dd082df0450eb356f5bb716f7e6913
Opcode Fuzzy Hash: 728f0f5a312bdb9b3f48ce406a68e035c40b7734784bc7cdc5b79375c6b74777
Instruction Fuzzy Hash: A6017CB0985B408BE721AF2A8D9160AFBE9BFA4700F90490EE5C59B655DBF961018B05

Function 00F80850 Relevance: 9.1, APIs: 6, Instructions: 62registryCOMMON

Download Yara Rule

APIs

RegDeleteKeyA.ADVAPI32(00000000,?), ref: 00F80878
RegDeleteValueA.ADVAPI32(00000000,?), ref: 00F80897
RegCloseKey.ADVAPI32(00000000), ref: 00F808C1

Part of subcall function 00F80643: RegCloseKey.KERNELBASE(?), ref: 00F806E8
Part of subcall function 00F80643: RegCloseKey.ADVAPI32(?), ref: 00F806F2

WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 00F808DC

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Close$Delete$PrivateProfileStringValueWrite
String ID:
API String ID: 1330817964-0
Opcode ID: dd118bcdb4013ee70eac75e206468d331ded3da1941cf92aa7687ddc8643270b
Instruction ID: 52e4a7f0f2cdb8ec737fc2674b4760c4a514163e3719aef1b08d2a498be30003
Opcode Fuzzy Hash: dd118bcdb4013ee70eac75e206468d331ded3da1941cf92aa7687ddc8643270b
Instruction Fuzzy Hash: C8115E37804155FFCF613FA0CC889EE3B69EF05361B608438FA5555014CB368D96BB90

Function 00FF29FF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 119COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FF2A06
CreateCompatibleDC.GDI32(00000000), ref: 00FF2AD1
CreateCompatibleDC.GDI32(00000000), ref: 00FF2ADD

Strings

@Ls Fs, xrefs: 00FF2857, 00FF28D3, 00FF2AD1, 00FF2ADD

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: CompatibleCreate$H_prolog3
String ID: @Ls Fs
API String ID: 2193723985-1589975592
Opcode ID: 44fb8ca718762b625ef103dca4317f6cd78ed1301b2d328e294594af17736e0f
Instruction ID: f4f3e318b3d8863230470b40c4dd67969fac1d4dfb9bb0f680bb064c3c26a301
Opcode Fuzzy Hash: 44fb8ca718762b625ef103dca4317f6cd78ed1301b2d328e294594af17736e0f
Instruction Fuzzy Hash: 0D51BFB0911365CFCB58DF69C8812997BB8BF09B00F1481ABED49DF25ADBB88540DF91

Function 00F626B0 Relevance: 6.1, APIs: 4, Instructions: 126timewindowCOMMON

Download Yara Rule

APIs

?GetLastMouseTime@@YGJXZ.STRETCHHOOK(?,?,?,00F6173C), ref: 00F626B5
?GetLastKeystrokeTime@@YGJXZ.STRETCHHOOK(?,?,?,00F6173C), ref: 00F626BD
MessageBeep.USER32(00000030), ref: 00F62737
MessageBeep.USER32(00000030), ref: 00F627C3

Part of subcall function 00F62050: FindWindowA.USER32(StretchWareAppClass,00000000), ref: 00F62057

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: BeepLastMessageTime@@$FindKeystrokeMouseWindow
String ID:
API String ID: 260692530-0
Opcode ID: fbc73143d27c44e0ca08a85697af7eb0f6f3a0e435cd05f5f2f81362ff759c44
Instruction ID: c349b9f2c013bcb7f29f86bd0dbf8091822506bfad93f5785be4f015a1fe6a0b
Opcode Fuzzy Hash: fbc73143d27c44e0ca08a85697af7eb0f6f3a0e435cd05f5f2f81362ff759c44
Instruction Fuzzy Hash: 3D410831D05F054BE7F09F28EC467697254EB5033AF180125FC9AA61DEEF2E8480E761

Function 00F67040 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNELBASE(00000000,00000000,16B3F121,010883F0,00000000,16B3F121), ref: 00F670A5
WaitForSingleObject.KERNEL32(00000000,00000001), ref: 00F670B1

Strings

SingleApplicationMutex, xrefs: 00F67084

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: CreateMutexObjectSingleWait
String ID: SingleApplicationMutex
API String ID: 3113225513-1050641058
Opcode ID: fd1dd565e52030c1eea6d4bb673df630b222e5f5a379c4bca11af29374d637cb
Instruction ID: bb260e3bc9a12da82fd173857bf79b5d4ff1537afa392a6edb8da226c70ca594
Opcode Fuzzy Hash: fd1dd565e52030c1eea6d4bb673df630b222e5f5a379c4bca11af29374d637cb
Instruction Fuzzy Hash: 86218EB1A08705AFE720DF58CC46B5ABBE8EB44724F10861EF569CB291D7B5A940CB90

Function 00F61BF0 Relevance: 4.6, APIs: 3, Instructions: 83COMMON

Download Yara Rule

APIs

FindResourceW.KERNEL32(00F64C06,0108877A,00000006,0108877A,?,?,?,00F649FE,00000000,?,?,?,00F64C06), ref: 00F61C0B

Part of subcall function 00F61020: LoadResource.KERNEL32(00F7B459,?,?,00000000,?,00F7B459,?,00F7B459,00000000), ref: 00F6102D

WideCharToMultiByte.KERNELBASE(00000003,00000000,00000002,00000000,00000000,00000000,00000000,00000000,?,00F64C06), ref: 00F61C46
WideCharToMultiByte.KERNEL32(00000003,00000000,?,?,?,00000000,00000000,00000000,?,00F64C06), ref: 00F61C8B

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: ByteCharMultiResourceWide$FindLoad
String ID:
API String ID: 861045882-0
Opcode ID: 3daae7fb0bd9e4a9bb0d74de06240543cb2652516e2a4fa39fd99984edf61450
Instruction ID: a0a58b13efcfe7028a716c53230b60a09b640026929a218321ae2dd3b6e0f813
Opcode Fuzzy Hash: 3daae7fb0bd9e4a9bb0d74de06240543cb2652516e2a4fa39fd99984edf61450
Instruction Fuzzy Hash: 4821A132741220BFE7209A18DC99FBBB798FB45760F14401AF944EF3C4D6B5AC4197A0

Function 00F7F259 Relevance: 4.6, APIs: 3, Instructions: 70registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNELBASE(80000001,010CBEF4,00000000,00000001,?), ref: 00F7F29E
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,00000004), ref: 00F7F2BE
RegCloseKey.ADVAPI32(?), ref: 00F7F302

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: e6ed33b3580134a541ea27b17cb0cf2651bd554f0b393d7fade57fd00dd32de2
Instruction ID: 5e7fc57f3a3141c79122ea8e7b1b1840de116edfef9e47923ea709950a5a4e15
Opcode Fuzzy Hash: e6ed33b3580134a541ea27b17cb0cf2651bd554f0b393d7fade57fd00dd32de2
Instruction Fuzzy Hash: 3C214C75D00208EFDB15CF95D889AAEBBB8EF80710F3080AFE44AA6145D7715E48DF12

Function 00F807C5 Relevance: 4.6, APIs: 3, Instructions: 57registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNELBASE(00000000,?,00000000,00000004,?,00000004), ref: 00F80802
RegCloseKey.ADVAPI32(00000000), ref: 00F8080B
WritePrivateProfileStringA.KERNEL32(?,?,?,?), ref: 00F80839

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: ClosePrivateProfileStringValueWrite
String ID:
API String ID: 219906979-0
Opcode ID: 96b58400b602e7f997fbbe0de53408ca5417679ba09ba140323bdc093923f5ae
Instruction ID: 35d9509ccc042aaecee44d387baf53c39068720ba36e590ab4ccdb9c432f3dca
Opcode Fuzzy Hash: 96b58400b602e7f997fbbe0de53408ca5417679ba09ba140323bdc093923f5ae
Instruction Fuzzy Hash: 1C010432900209BBD720AF648C41FBF73ACEF48714F140429F541A7184DF75ED0497A0

Function 00F80758 Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNELBASE(00000000,?,00000000,?,?,?), ref: 00F80795
RegCloseKey.ADVAPI32(00000000), ref: 00F8079E
GetPrivateProfileIntA.KERNEL32(?,?,?,?), ref: 00F807BA

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: ClosePrivateProfileQueryValue
String ID:
API String ID: 1423431592-0
Opcode ID: d0de047d31f71d72fc8fccec1cf38bab93a52c835870f1551046f75470628bdf
Instruction ID: 5b4480a0988eb84f1a892cd643bdfd33dc95d8b91cc15c706cf743180bb6de64
Opcode Fuzzy Hash: d0de047d31f71d72fc8fccec1cf38bab93a52c835870f1551046f75470628bdf
Instruction Fuzzy Hash: 3D014B76500118FFDB22AF90CC84FDE7B6DEB04764F604015FA059A054EB75EA59AF90

Function 00F7BC99 Relevance: 4.5, APIs: 3, Instructions: 37windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(00000030,00000000,00000000,00000000), ref: 00F7BC67
TranslateMessage.USER32(00000030), ref: 00F7BC86
DispatchMessageA.USER32(00000030), ref: 00F7BC8D

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Message$DispatchTranslate
String ID:
API String ID: 1706434739-0
Opcode ID: 48810279a89abcb7e50814986efa76fdf30ffc167ec0c5122c078d694755fccb
Instruction ID: c5e2cf0a54a27ad14b861888de57bc500aa21f15910e337a10e6b012cfb49e32
Opcode Fuzzy Hash: 48810279a89abcb7e50814986efa76fdf30ffc167ec0c5122c078d694755fccb
Instruction Fuzzy Hash: 22F05E32614502AFA3266A30AD48F7F37ACEFC2721315C06EF44AD6405DF29DC02EB62

Function 00F65AD0 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(StretchRes.dll,?,00000004,00000064,Function_00001B80,Function_00001B00,?,00F64A8A,00000000,16B3F121), ref: 00F65AF2

Strings

StretchRes.dll, xrefs: 00F65AED

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: LibraryLoad
String ID: StretchRes.dll
API String ID: 1029625771-1347602766
Opcode ID: c09a6119ad901402a54edc9a049a6cc95b6e4c1dc66c9edc4b8d2bfe866e7982
Instruction ID: 1664c2f18a3bc4a6fa04af510536bcd024cc7bb847293956de2879fb6298b3cf
Opcode Fuzzy Hash: c09a6119ad901402a54edc9a049a6cc95b6e4c1dc66c9edc4b8d2bfe866e7982
Instruction Fuzzy Hash: CEE012B1A457109FC3A0EF799C05FC67AE8EB84B61F40492AB2DDD7140E7B5A440CB65

Function 00F706AB Relevance: 3.1, APIs: 2, Instructions: 88windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F706B2

Part of subcall function 00F61BF0: FindResourceW.KERNEL32(00F64C06,0108877A,00000006,0108877A,?,?,?,00F649FE,00000000,?,?,?,00F64C06), ref: 00F61C0B

GetMenu.USER32(?), ref: 00F7077F

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: FindH_prolog3MenuResource
String ID:
API String ID: 1047964904-0
Opcode ID: 9e02c6c090bea708207ad48ba9b7e01309b46867da2023d6ac374ccd4b6e32dd
Instruction ID: d22dc9f6a0e5e238b10c0746b3b30effb930bdd718d102278ccdec8d6315b4ef
Opcode Fuzzy Hash: 9e02c6c090bea708207ad48ba9b7e01309b46867da2023d6ac374ccd4b6e32dd
Instruction Fuzzy Hash: FB31E031A00209EBDB25AF30CC41FAF7AA8FF44750F00841AF95AA7291DB75A901EB51

Function 00F707F1 Relevance: 3.1, APIs: 2, Instructions: 70windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(?,?), ref: 00F70811
DestroyMenu.USER32(?,?,?,?,?,?,?,?,?), ref: 00F7088C

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Menu$DestroyLoad
String ID:
API String ID: 588275208-0
Opcode ID: 6f2a6e242a171da46c754ec87035ae28b2791d87ac33baddb6a92804e421c385
Instruction ID: f4f1fab4b8562ba59d7fed097adf642b75fc5780fd29d2af0eb58e01ab177945
Opcode Fuzzy Hash: 6f2a6e242a171da46c754ec87035ae28b2791d87ac33baddb6a92804e421c385
Instruction Fuzzy Hash: 64212C75500109EFCF11DF64C848CAE7BB5FF88360B148066F85997211DA35DD21EF91

Function 00F62C00 Relevance: 3.1, APIs: 2, Instructions: 66COMMONLIBRARYCODE

Download Yara Rule

APIs

_memmove_s.LIBCMT ref: 00F62C72

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: _memmove_s
String ID:
API String ID: 800865076-0
Opcode ID: 0d2e4c0e4e7b1fa12090d1e028ec0bce9e235b54f3cfb2b6176c53ad4bd2838d
Instruction ID: 647c1675ecfda590ffb9cb58308d90bb491bc72fa2b2b77badcb014a13fbf7aa
Opcode Fuzzy Hash: 0d2e4c0e4e7b1fa12090d1e028ec0bce9e235b54f3cfb2b6176c53ad4bd2838d
Instruction Fuzzy Hash: 3711C132601915AFDB04EF58DD98E6EF7A9EF94370B00815AF8049F328DA35AC40ABD0

Function 00F7B92D Relevance: 3.1, APIs: 2, Instructions: 65windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 00F7B95E
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 00F7B9AD

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: MessagePeek
String ID:
API String ID: 2222842502-0
Opcode ID: ce55cf0f1a502ab7815876540d66926290fa54673e9136a0ce7103821575b558
Instruction ID: 0d95a02dd1478b54694bc6101488feb9bdbae49d5103ff2b492fdd368cc1f940
Opcode Fuzzy Hash: ce55cf0f1a502ab7815876540d66926290fa54673e9136a0ce7103821575b558
Instruction Fuzzy Hash: DC114230E00214EBDB219F66CC48F5FBFBCEFD5755B10809AE65593201D7358900DB61

Function 00F65460 Relevance: 3.1, APIs: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

_strncpy.LIBCMT ref: 00F654B2
Shell_NotifyIconA.SHELL32(00000002,00000150,00000130,?,?,00F656D1,00000000,00000000,00000000,?,?,00F65775,0000008E), ref: 00F654D9

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: IconNotifyShell__strncpy
String ID:
API String ID: 286316210-0
Opcode ID: 280af667a9840d04c5ce075f8b99ca1d6ae91b3f9da87fb307941edca64256fd
Instruction ID: 49bb680a3d3470968837bed149b9e0d2540b7c993386b2034f73986e49bb8b8a
Opcode Fuzzy Hash: 280af667a9840d04c5ce075f8b99ca1d6ae91b3f9da87fb307941edca64256fd
Instruction Fuzzy Hash: 2311C272901B008FE774CA19D1447A7B7E8BB50B22F04556ED4C796980DBB4F8C9DF10

Function 00F61400 Relevance: 3.0, APIs: 2, Instructions: 50windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000111,00000002,00000000), ref: 00F61482
GetTickCount.KERNEL32 ref: 00F61488

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: CountMessageSendTick
String ID:
API String ID: 3168085573-0
Opcode ID: 293eb0ba2e51261c39d624172ba6d58168e79c3e92dd1a679a0bfe4aad14bb0d
Instruction ID: 4676ad6a7523a38ceb94ce59df4cac091cea94bf48952333ebf7d8b5da9a07a5
Opcode Fuzzy Hash: 293eb0ba2e51261c39d624172ba6d58168e79c3e92dd1a679a0bfe4aad14bb0d
Instruction Fuzzy Hash: 0801D6712006048BD728EB24EC86BEA77D4BF01B54F488469EA8A5B196CE799850E7A1

Function 00F806FE Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00F80643: RegCloseKey.KERNELBASE(?), ref: 00F806E8
Part of subcall function 00F80643: RegCloseKey.ADVAPI32(?), ref: 00F806F2

RegCloseKey.ADVAPI32(00000000), ref: 00F80749

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: e36992c144660fa793eea3dacf1a6dc2229fe7c1e63a8b121d0aabbc9f2b6587
Instruction ID: 7af6a0a3043ef159b2712f5f1eb82456ce4d0dbac9b92781cf97475c2e7859f0
Opcode Fuzzy Hash: e36992c144660fa793eea3dacf1a6dc2229fe7c1e63a8b121d0aabbc9f2b6587
Instruction Fuzzy Hash: A0F09037901028FB8B62AB51CC49CEF7FACEF8A7B0B504015F50986001DA74AA06EFB0

Function 00F8AF3B Relevance: 3.0, APIs: 2, Instructions: 36COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(00000000), ref: 00F8AF49
SetErrorMode.KERNELBASE(00000000), ref: 00F8AF51

Part of subcall function 00F7221F: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 00F72252
Part of subcall function 00F7221F: SetLastError.KERNEL32(0000006F), ref: 00F72269

Part of subcall function 00F8AD6E: GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 00F8ADAB
Part of subcall function 00F8AD6E: PathFindExtensionA.KERNELBASE(?), ref: 00F8ADC5
Part of subcall function 00F8AD6E: __strdup.LIBCMT ref: 00F8AE0D
Part of subcall function 00F8AD6E: __strdup.LIBCMT ref: 00F8AE4B
Part of subcall function 00F8AD6E: __strdup.LIBCMT ref: 00F8AE7F

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Error__strdup$FileModeModuleName$ExtensionFindLastPath
String ID:
API String ID: 3517913719-0
Opcode ID: 5b73d451014da4bd1c4270efdd26213546b007615d3aa83abed50c96b59c943b
Instruction ID: d9e2650feedd86cd869d24a2db39eb4d294fdf289f4f23a9d75238db2db79c7f
Opcode Fuzzy Hash: 5b73d451014da4bd1c4270efdd26213546b007615d3aa83abed50c96b59c943b
Instruction Fuzzy Hash: 62F049B5A102555FEBA1BF649805E9D3B98EF44320B06805BF6488B252DA38D840DBA3

Function 00F74156 Relevance: 3.0, APIs: 2, Instructions: 35COMMON

Download Yara Rule

APIs

ActivateActCtx.KERNEL32(?,?,010BAE60,00000010), ref: 00F74176
CreateWindowExA.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00F741AE

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: ActivateCreateWindow
String ID:
API String ID: 2169890993-0
Opcode ID: d5fec1f02560671dda5edac94879e847f42dfd23b04e24aed2aeca34331d60b8
Instruction ID: a28aa27b9489c99b5f66fb9b6e540e92ae0291d67e09c67b7404f72fd11f17e1
Opcode Fuzzy Hash: d5fec1f02560671dda5edac94879e847f42dfd23b04e24aed2aeca34331d60b8
Instruction Fuzzy Hash: 0401C07280021AEBCF12AFA4CD049DD7B76BF1C710F508615FAA8A2120C77A99A1EF40

Function 00F7787F Relevance: 3.0, APIs: 2, Instructions: 32threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00F84CAE: __EH_prolog3.LIBCMT ref: 00F84CB5

GetCurrentThreadId.KERNEL32 ref: 00F778AE
SetWindowsHookExA.USER32(00000005,00F77638,00000000,00000000), ref: 00F778BE

Part of subcall function 00F72127: __CxxThrowException@8.LIBCMT ref: 00F7213D
Part of subcall function 00F72127: __EH_prolog3.LIBCMT ref: 00F7214A

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: H_prolog3$CurrentException@8HookThreadThrowWindows
String ID:
API String ID: 1415497866-0
Opcode ID: a77fbb4c172d89826243bdd14df3faed40e7126a8ba4a69462f53174dfd18394
Instruction ID: e0926d2af53c57cf404c571be19b363605a712429143ea67f9c3e4d55bcb0949
Opcode Fuzzy Hash: a77fbb4c172d89826243bdd14df3faed40e7126a8ba4a69462f53174dfd18394
Instruction Fuzzy Hash: 0FF0E231A5970097C2303A95DC09B1B7698EB84B71F60813BF64D46544EA74E844D7B3

Function 00F731F6 Relevance: 3.0, APIs: 2, Instructions: 28COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,?,?,?), ref: 00F7321F
CallWindowProcA.USER32(?,?,?,?,?), ref: 00F73234

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: ProcWindow$Call
String ID:
API String ID: 2316559721-0
Opcode ID: 319ab6edad9b6e1c3db72592c4499e78cb8b4f7ee733dea364e8e799969cccea
Instruction ID: 47eb341d321d42faad51555c951b34991921e6a6f25a8c26e6853c6375dd84ac
Opcode Fuzzy Hash: 319ab6edad9b6e1c3db72592c4499e78cb8b4f7ee733dea364e8e799969cccea
Instruction Fuzzy Hash: A4F01C36104209FFCF215F99DC04DAA7BBAFF1C361B148469F99986525D732D920FB50

Function 00F74312 Relevance: 3.0, APIs: 2, Instructions: 24libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

ActivateActCtx.KERNEL32(?,00000000,010BAEC0,00000010,00FA33A9,UxTheme.dll,751E6BA0,?,00FA346A,00000004,00F8E32D,00000000,00000004,00FEE906), ref: 00F74332
LoadLibraryW.KERNELBASE(00000020,?,00FA346A,00000004,00F8E32D,00000000,00000004,00FEE906,?,?,0109A46C), ref: 00F74349

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: ActivateLibraryLoad
String ID:
API String ID: 389599620-0
Opcode ID: 42258dc8e89f9693a14e04f11427bb629ef6beb023a34d4255f828fe652ce7f5
Instruction ID: dab9901d6d12f2ad4508d96537181c2aa555813a1d68636703bfd3b3257b32cd
Opcode Fuzzy Hash: 42258dc8e89f9693a14e04f11427bb629ef6beb023a34d4255f828fe652ce7f5
Instruction Fuzzy Hash: 84F03071D0021AEBCF61AFA4CC049DDBAB5BF08B50F508526E499E7154C7789611EF91

Function 010697F6 Relevance: 3.0, APIs: 2, Instructions: 18COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0106980E

Part of subcall function 0106EE41: __mtinitlocknum.LIBCMT ref: 0106EE57
Part of subcall function 0106EE41: __amsg_exit.LIBCMT ref: 0106EE63
Part of subcall function 0106EE41: EnterCriticalSection.KERNEL32(00F7B459,00F7B459,?,0106880F,0000000D), ref: 0106EE6B

__tzset_nolock.LIBCMT ref: 0106981F

Part of subcall function 01069115: __lock.LIBCMT ref: 01069137
Part of subcall function 01069115: ____lc_codepage_func.LIBCMT ref: 0106917E
Part of subcall function 01069115: __getenv_helper_nolock.LIBCMT ref: 010691A0
Part of subcall function 01069115: _free.LIBCMT ref: 010691D7
Part of subcall function 01069115: _strlen.LIBCMT ref: 010691DE
Part of subcall function 01069115: __malloc_crt.LIBCMT ref: 010691E5
Part of subcall function 01069115: _strlen.LIBCMT ref: 010691FB
Part of subcall function 01069115: _strcpy_s.LIBCMT ref: 01069209
Part of subcall function 01069115: __invoke_watson.LIBCMT ref: 0106921E
Part of subcall function 01069115: _free.LIBCMT ref: 0106922D

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: __lock_free_strlen$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__invoke_watson__malloc_crt__mtinitlocknum__tzset_nolock_strcpy_s
String ID:
API String ID: 1828324828-0
Opcode ID: 2bc924988ca43160e3cafd5ca19bd079ee3a8f3db2fefb45520ebe92a117159c
Instruction ID: 4df853c8588d4e7225cd643d593906c551fae387688ab9df4c3cc03ce922e6c5
Opcode Fuzzy Hash: 2bc924988ca43160e3cafd5ca19bd079ee3a8f3db2fefb45520ebe92a117159c
Instruction Fuzzy Hash: A4E05B30893B11DECB73BBE4954118C72B86B28F25F9001AED9C4156C5CA760552CB91

Function 00F7BE4A Relevance: 3.0, APIs: 2, Instructions: 15threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00F7BE5D
SetWindowsHookExA.USER32(000000FF,Function_0001BCAF,00000000,00000000), ref: 00F7BE6D

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: CurrentHookThreadWindows
String ID:
API String ID: 1904029216-0
Opcode ID: 12fa6dab1c5bf2e16e7b00f590d6ce8f0862c15bca87181d6308816ab0c91661
Instruction ID: 53bbb1dc33ac45745f3b8af6569514b602e149627400be60357f962c7cacdebc
Opcode Fuzzy Hash: 12fa6dab1c5bf2e16e7b00f590d6ce8f0862c15bca87181d6308816ab0c91661
Instruction Fuzzy Hash: CCD0A7718082106EE7716BB0BC09B5D3A445B06330F158357F4A4922C9C73C844057A3

Function 00F77A36 Relevance: 1.8, APIs: 1, Instructions: 285COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F77A40

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: H_prolog3
String ID:
API String ID: 431132790-0
Opcode ID: 7b8ce52b8d5c62f4f397672c2573b9579601de3206c17659cd6b8ae3d9848238
Instruction ID: 8ebdc39c2134fe50aa315eb78f37741d4933e90cc64fc118297114d491954869
Opcode Fuzzy Hash: 7b8ce52b8d5c62f4f397672c2573b9579601de3206c17659cd6b8ae3d9848238
Instruction Fuzzy Hash: 38B15D70A14306DFDF15EF64CD80BAE7BB4AF08314F14846AE81997291DB75DA40EB62

Function 00F64A40 Relevance: 1.6, APIs: 1, Instructions: 110COMMON

Download Yara Rule

APIs

Part of subcall function 00F7FC66: __EH_prolog3.LIBCMT ref: 00F7FC6D
Part of subcall function 00F7FC66: __strdup.LIBCMT ref: 00F7FC8F
Part of subcall function 00F7FC66: GetCurrentThread.KERNEL32 ref: 00F7FCBC
Part of subcall function 00F7FC66: GetCurrentThreadId.KERNEL32 ref: 00F7FCC5

Part of subcall function 00F65AD0: LoadLibraryA.KERNELBASE(StretchRes.dll,?,00000004,00000064,Function_00001B80,Function_00001B00,?,00F64A8A,00000000,16B3F121), ref: 00F65AF2

Part of subcall function 00F622F0: ?InstallHooks@@YAXXZ.STRETCHHOOK ref: 00F622F3

Part of subcall function 00F67040: CreateMutexA.KERNELBASE(00000000,00000000,16B3F121,010883F0,00000000,16B3F121), ref: 00F670A5
Part of subcall function 00F67040: WaitForSingleObject.KERNEL32(00000000,00000001), ref: 00F670B1

GetTickCount.KERNEL32 ref: 00F64B7B

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: CurrentThread$CountCreateH_prolog3Hooks@@InstallLibraryLoadMutexObjectSingleTickWait__strdup
String ID:
API String ID: 222554213-0
Opcode ID: c461b9bf6d7d18ac017d01a184f730672b8b03418e64b4120ca39f35228219e6
Instruction ID: 244f57027edf9377c942c7c5bac959d044dba4add9682460bcdc63995f74478c
Opcode Fuzzy Hash: c461b9bf6d7d18ac017d01a184f730672b8b03418e64b4120ca39f35228219e6
Instruction Fuzzy Hash: 5541AF30604646DFDB48EBB8C851BAEB7E4FF05320F14866DE45AD7281DF78A900AB91

Function 00F7612E Relevance: 1.6, APIs: 1, Instructions: 77COMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00F76135

Part of subcall function 00F84CAE: __EH_prolog3.LIBCMT ref: 00F84CB5

Part of subcall function 00F72127: __CxxThrowException@8.LIBCMT ref: 00F7213D
Part of subcall function 00F72127: __EH_prolog3.LIBCMT ref: 00F7214A

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: H_prolog3$Exception@8H_prolog3_catch_Throw
String ID:
API String ID: 2285297229-0
Opcode ID: e04aede0a5d025def13ae5e69852a12b44efae601a3fcd13be8a2c8ef75cb788
Instruction ID: 7417c5dcfe84e0142992bf9b46882323f2d8597b0517fa7b84762b417779c7a0
Opcode Fuzzy Hash: e04aede0a5d025def13ae5e69852a12b44efae601a3fcd13be8a2c8ef75cb788
Instruction Fuzzy Hash: 9C311C75E00609DFCF04DFA4C8819DEBBF6BF88310F14846AE909AB255D774A941DFA1

Function 00F618A0 Relevance: 1.6, APIs: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

_memcpy_s.LIBCMT ref: 00F618EB

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: _memcpy_s
String ID:
API String ID: 2001391462-0
Opcode ID: 3b864859ec39ba8dd36761953ac527a0829503925e1f7a687fb352feb50cfc70
Instruction ID: 7ff73d7b5a7b293c76f01acaeb6824d24d6a7d52a34818bc63e5d5771df032e6
Opcode Fuzzy Hash: 3b864859ec39ba8dd36761953ac527a0829503925e1f7a687fb352feb50cfc70
Instruction Fuzzy Hash: 3F115E76600A05AFD708DF6CC880CAAB3B9FF89320714865DE5598B350EB31ED01CBD0

Function 00F84CAE Relevance: 1.5, APIs: 1, Instructions: 43COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F84CB5

Part of subcall function 00F72127: __CxxThrowException@8.LIBCMT ref: 00F7213D
Part of subcall function 00F72127: __EH_prolog3.LIBCMT ref: 00F7214A

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: H_prolog3$Exception@8Throw
String ID:
API String ID: 2489616738-0
Opcode ID: 2c3f29bff74a39575716152ec5a2befbf5db5f91a195caaf25e6e10f0cfbbacc
Instruction ID: cdec1299d57571993808c9577d709cd318119639cdcc7ea0370c5e268fc69702
Opcode Fuzzy Hash: 2c3f29bff74a39575716152ec5a2befbf5db5f91a195caaf25e6e10f0cfbbacc
Instruction Fuzzy Hash: 26015E79A012039BDB24BF74C9026AE76F5BB55321B104529E8C18B280DF389940E715

Function 00F76233 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 768bdc8ae88739f0aa34baaf4b0e2b7597c5aca113e3fa1ae2b2d972ba85c5a6
Instruction ID: 29f361166d19a968443af3398071214c581878b5675ea7a431d6b8e3b02e7f94
Opcode Fuzzy Hash: 768bdc8ae88739f0aa34baaf4b0e2b7597c5aca113e3fa1ae2b2d972ba85c5a6
Instruction Fuzzy Hash: 3FF0F832404919BB8F52AFA09D04DAB3B6ABF09362B04C412FA5991412C776C920FBA6

Function 00F6E77F Relevance: 1.5, APIs: 1, Instructions: 30windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(?,00000362,0000E001,00000000), ref: 00F6E7B9

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 1c615e2ea257ec40a1925cb7f1e293dedf996c2a9021ebf98590bed981ebd3f8
Instruction ID: d9625ff8bf3dd14e0e4663f1ecafb8c2f3010335d659a8a04ae7222b47b525e1
Opcode Fuzzy Hash: 1c615e2ea257ec40a1925cb7f1e293dedf996c2a9021ebf98590bed981ebd3f8
Instruction Fuzzy Hash: 2BF0EC31350600ABDB305F74CC44F997BA5BF04B30F214726F9B9D61D1CBB2D850AA41

Function 00F65690 Relevance: 1.5, APIs: 1, Instructions: 29windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(?), ref: 00F656C1

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: IconLoad
String ID:
API String ID: 2457776203-0
Opcode ID: a33ebab106d07fa64e21fc74179dafada7063db82b92c8b1757f6eae36d07249
Instruction ID: eab95780eb6623d4814b5efc223dd6ee9d1e651d2ceae24eaf62e2bf6dde5e95
Opcode Fuzzy Hash: a33ebab106d07fa64e21fc74179dafada7063db82b92c8b1757f6eae36d07249
Instruction Fuzzy Hash: B5E09AB22105146AE251B2A9DC02FBEB39CEF45B20F448027BA08DB141CA68A850A3B6

Function 00F7B358 Relevance: 1.5, APIs: 1, Instructions: 27COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00F7B377

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: _malloc
String ID:
API String ID: 1579825452-0
Opcode ID: a5c72593a8d61a17476d515242c04f2ddc45060e9de58d9061ebb4c143770b53
Instruction ID: 035bdd7c52ec84e1815795881ab2dfc8b1ddf85c7bb477fdb570694cb83cb851
Opcode Fuzzy Hash: a5c72593a8d61a17476d515242c04f2ddc45060e9de58d9061ebb4c143770b53
Instruction Fuzzy Hash: F7E09233500616AFD7408F4AD404B86FBDDEFA2375F16C427D908CB261C772E8448BA0

Function 00F62310 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00F62314

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: CountTick
String ID:
API String ID: 536389180-0
Opcode ID: c894017b54327d5a5ecd4346fe9293647654bab74307ba906bdf9adaeb25ac3c
Instruction ID: 8a38c53b2c9e8671f9b8db13317cd583a34f2f13074a93458b662c13cd8fd5f1
Opcode Fuzzy Hash: c894017b54327d5a5ecd4346fe9293647654bab74307ba906bdf9adaeb25ac3c
Instruction Fuzzy Hash: 21E0E5705013088BC77CDB18A5822187BADF780204F509559EC4A4666CDE3B5910DB81

Function 00F8548C Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

Part of subcall function 00F88839: GetProcAddress.KERNEL32(00000000,DllGetVersion), ref: 00F8886C
Part of subcall function 00F88839: _memset.LIBCMT ref: 00F88885

SystemParametersInfoA.USER32(00000029,-00000158,?,00000000), ref: 00F854B0

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: AddressInfoParametersProcSystem_memset
String ID:
API String ID: 831922234-0
Opcode ID: 52b2b2c7fddbad4430fa06e1a91741ca931b65528a7cd64efe3d699ac24d86a6
Instruction ID: 6b781b63fd458ea7582c216c8cc7c72a644c9a5fb57470fe73751194a49c13b8
Opcode Fuzzy Hash: 52b2b2c7fddbad4430fa06e1a91741ca931b65528a7cd64efe3d699ac24d86a6
Instruction Fuzzy Hash: 3FD0A7B3590644AFE3001B71EC0AFBA3609D7A0721F940621B514CA1C0DBBADC418310

Function 00F79743 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00F7C535), ref: 00F79754

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: b6ec8842220680ef380c7e2b816741d54d43075cb993dd56181c4ebec5a26059
Instruction ID: 28206a3aba1bb474b2888ba9cf6fbe9dd2f24249cfd49b05ee4666003d56be8c
Opcode Fuzzy Hash: b6ec8842220680ef380c7e2b816741d54d43075cb993dd56181c4ebec5a26059
Instruction Fuzzy Hash: 6CD05E72104208DFC7509F00D408B603BA5FF44329F6080A9E5480A521C7339823DF40

Function 00F63330 Relevance: 1.5, APIs: 1, Instructions: 12windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(0000FFFF,0000C1D2,?,?), ref: 00F63347

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: ddcbcc9f3d08f54bd970a76c4fafbec3ccbcfb04c4a5179ad3231687c631b1bb
Instruction ID: afb95cdb30b09bf76cbf4f9afd2a6eb0c8e6e04580c855d7a66cdeabcbd7b610
Opcode Fuzzy Hash: ddcbcc9f3d08f54bd970a76c4fafbec3ccbcfb04c4a5179ad3231687c631b1bb
Instruction Fuzzy Hash: D7C01271154208AFA354DE54D845C76736CFB88710B108115BD9547248C671BC40C760

Function 00F7EA8C Relevance: 1.5, APIs: 1, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00F7EA9B

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: DeleteObject
String ID:
API String ID: 1531683806-0
Opcode ID: cfa84aed529175dae675b6acd96421e7ba1304aece4b2c2994afd84a9b1543d0
Instruction ID: bd81ea281e17e15e19f48860101223a11b6e37a1c2450ae62be729868467c89d
Opcode Fuzzy Hash: cfa84aed529175dae675b6acd96421e7ba1304aece4b2c2994afd84a9b1543d0
Instruction Fuzzy Hash: EBB092B4A15106AAEE20A6308A0931A3B556B4531AF10C8E6F049D9049EA3E8042AA12

Non-executed Functions

Function 00FC0035 Relevance: 27.4, APIs: 18, Instructions: 386windowkeyboardCOMMON

Download Yara Rule

APIs

MessageBeep.USER32 ref: 00FC005C
SendMessageA.USER32(?,000000B0,?,?), ref: 00FC00A1
SendMessageA.USER32(?,000000B0,?,?), ref: 00FC014E
SendMessageA.USER32(?,000000B0,?,?), ref: 00FC02E8
GetKeyState.USER32(00000010), ref: 00FC031D
SendMessageA.USER32(?,000000B0,?,?), ref: 00FC0333
GetKeyState.USER32(00000011), ref: 00FC035F
SendMessageA.USER32(?,000000B0,?,?), ref: 00FC0375
SendMessageA.USER32(?,000000B0,?,?), ref: 00FC03BD

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Message$Send$State$Beep
String ID:
API String ID: 4138746095-0
Opcode ID: 489cae8d6dc3e2de7256d2611a79978d4dc6e84f62b866203d79b64ab81a8653
Instruction ID: 809199079a7a886996080c3fec5bf499792801f548c66f281e94b899ab38c64b
Opcode Fuzzy Hash: 489cae8d6dc3e2de7256d2611a79978d4dc6e84f62b866203d79b64ab81a8653
Instruction Fuzzy Hash: 39D13B7250060AFBDF15DF54CD86FEE37A9FB04720F10851AF966C6180DB30EA52AB61

Function 00FCE541 Relevance: 16.7, APIs: 11, Instructions: 220windowkeyboardCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00FCE56F
GetFocus.USER32 ref: 00FCE57D
IsChild.USER32(?,?), ref: 00FCE5B1
SendMessageA.USER32(?,00000010,00000000,00000000), ref: 00FCE5E5
IsChild.USER32(?,?), ref: 00FCE601
SendMessageA.USER32(?,00000100,?,00000000), ref: 00FCE630
IsIconic.USER32(?), ref: 00FCE671
GetAsyncKeyState.USER32(00000011), ref: 00FCE6F7
GetAsyncKeyState.USER32(00000012), ref: 00FCE709
GetAsyncKeyState.USER32(00000010), ref: 00FCE716
IsWindowVisible.USER32(?), ref: 00FCE777

Part of subcall function 00FDB249: RedrawWindow.USER32(?,00000000,00000000,00000105,00000000), ref: 00FDB276

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: AsyncStateWindow$ChildMessageSend$FocusIconicRedrawVisible
String ID:
API String ID: 763474574-0
Opcode ID: 17ab1a6231cecf32ee3bc8fc32a340352c1d59eb945be2c57f1aa90513ed8e43
Instruction ID: d3954726a2476a5edf26c1cda3b7493184f28b8bd2b72d10e2b767e893a74ce1
Opcode Fuzzy Hash: 17ab1a6231cecf32ee3bc8fc32a340352c1d59eb945be2c57f1aa90513ed8e43
Instruction Fuzzy Hash: 7171D236A10206DFDB20AFA4CA86FA97BA5BF14314F18047DF996DB250EB359C40FB10

Function 00F7A00F Relevance: 13.6, APIs: 9, Instructions: 79windowCOMMON

Download Yara Rule

APIs

GetPropA.USER32(?), ref: 00F7A036
GlobalLock.KERNEL32(00000000,?,?,?), ref: 00F7A03F
SendMessageA.USER32(?,00000476,00000000,00000000), ref: 00F7A060
GlobalUnlock.KERNEL32(00000000,?,?,?), ref: 00F7A067
RemovePropA.USER32(?), ref: 00F7A076
GlobalFree.KERNEL32(00000000), ref: 00F7A081

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Global$Prop$FreeLockMessageRemoveSendUnlock
String ID:
API String ID: 2391254433-0
Opcode ID: 29d3a80ed8e2fef1ff493e6f35aa36efb93ec21459ff1bb9a1be6c00133f8ac0
Instruction ID: bb00b37b55d626a83035c6108974bf46d08b4fdc8dcf2c7829317a5b07bf721f
Opcode Fuzzy Hash: 29d3a80ed8e2fef1ff493e6f35aa36efb93ec21459ff1bb9a1be6c00133f8ac0
Instruction Fuzzy Hash: 0B216532644600ABDB312F34DC48B2E7A69FB88751F258826F5CAD6154DB36DC40FB23

Function 00FD6205 Relevance: 4.5, APIs: 3, Instructions: 43windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00FD6222

Part of subcall function 00F72127: __CxxThrowException@8.LIBCMT ref: 00F7213D
Part of subcall function 00F72127: __EH_prolog3.LIBCMT ref: 00F7214A

IsIconic.USER32(?), ref: 00FD624B
GetParent.USER32(?), ref: 00FD6258

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Parent$Exception@8H_prolog3IconicThrow
String ID:
API String ID: 144390861-0
Opcode ID: d424fcdecc5b8eccdad9ca8eaeb0ee4ba9661356ec527fa83f032c804446f499
Instruction ID: eadc00f41ca4c171dedc1b1c61505d00c73e06b058927a3e8a4215cfb7ba0e87
Opcode Fuzzy Hash: d424fcdecc5b8eccdad9ca8eaeb0ee4ba9661356ec527fa83f032c804446f499
Instruction Fuzzy Hash: 3AF0A432704615778F127A728C0462A7A9AEBA0372B144127F549D2711EA39DC51A790

Function 00FD0420 Relevance: 3.1, APIs: 2, Instructions: 57windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00FD0474
PostMessageA.USER32(?,00000112,0000F060,00000000), ref: 00FD04C4

Part of subcall function 00F795EC: GetWindowLongA.USER32(?,000000F0), ref: 00F795F7

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: IconicLongMessagePostWindow
String ID:
API String ID: 1855654840-0
Opcode ID: 8c26c27b86ebd8220876c6968591d39df8c8edb4cb4b490224da73d78bcb6674
Instruction ID: ecf537cd7dfde1636c8415e400d63c9dfdcfbeeb2b728e16ef154a1e7bf9f87e
Opcode Fuzzy Hash: 8c26c27b86ebd8220876c6968591d39df8c8edb4cb4b490224da73d78bcb6674
Instruction Fuzzy Hash: 9D110473A107029BD734DA38DD45FAAB6D3FB46320F1C063BE245C23D5CA68DC00AA40

Function 00FB235A Relevance: 3.0, APIs: 2, Instructions: 41keyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00F795EC: GetWindowLongA.USER32(?,000000F0), ref: 00F795F7

GetKeyState.USER32(00000073), ref: 00FB2386
GetKeyState.USER32(00000012), ref: 00FB238F

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: State$LongWindow
String ID:
API String ID: 3716621309-0
Opcode ID: 520595f56d7dcb1f52c9a4959056ccea073c61fda6a6e32cfd0dea8e22f149fb
Instruction ID: a3fa0185d2c108b7bc3088165a6559e2b3d6013d35dc518390434c18c7472409
Opcode Fuzzy Hash: 520595f56d7dcb1f52c9a4959056ccea073c61fda6a6e32cfd0dea8e22f149fb
Instruction Fuzzy Hash: ECF0963630021A6AEF213957CC41EEE7A59DF917A0F084036FD489A199DA7BDD11BA50

Function 00FF211A Relevance: 52.8, APIs: 28, Strings: 2, Instructions: 323fileCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FF2124
GetModuleFileNameA.KERNEL32(00000000,?,00000104,0108D480,00000000,01092C30,00000000,0108D534,00000000,?,?,00000584,00FF26E4,?,00000000,00000084), ref: 00FF21D3
__splitpath_s.LIBCMT ref: 00FF2202
__splitpath_s.LIBCMT ref: 00FF2221
__makepath_s.LIBCMT ref: 00FF2251
_strlen.LIBCMT ref: 00FF225D
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,0108D534,00000000,?,?,00000584,00FF26E4,?,00000000,00000084), ref: 00FF2295

Strings

@Ls Fs, xrefs: 00FF23AB, 00FF246C
, xrefs: 00FF25D7

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: File__splitpath_s$CreateH_prolog3_ModuleName__makepath_s_strlen
String ID: $@Ls Fs
API String ID: 114649838-1242102843
Opcode ID: 5f32e8b5d39c29183f6190bb0003a79f805fadf6878d0335b954b2d5d04263b4
Instruction ID: 1f4da3c4977576eb5f44cf74c469d035772e7e28b5e4ec35fe51b1bf250e7bb4
Opcode Fuzzy Hash: 5f32e8b5d39c29183f6190bb0003a79f805fadf6878d0335b954b2d5d04263b4
Instruction Fuzzy Hash: B4D12A71800A2CAFDF609F64CC94AEEBB79AF08356F1041E5F649A2161DB355EC4EF10

Function 00F9A2BA Relevance: 41.0, APIs: 27, Instructions: 457keyboardCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F9A2C1
GetParent.USER32(?), ref: 00F9A31C
GetParent.USER32(?), ref: 00F9A338
UpdateWindow.USER32(?), ref: 00F9A380
SetCursor.USER32 ref: 00F9A3A5
GetAsyncKeyState.USER32(00000012), ref: 00F9A407
UpdateWindow.USER32(?), ref: 00F9A50D
InflateRect.USER32(?,00000002,00000002), ref: 00F9A56D
SetCapture.USER32(?), ref: 00F9A576
SetCursor.USER32(00000000), ref: 00F9A58E
IsWindow.USER32(?), ref: 00F9A62C
GetCursorPos.USER32(?), ref: 00F9A66B
ScreenToClient.USER32(?,?), ref: 00F9A678
PtInRect.USER32(?,?,?), ref: 00F9A694
RedrawWindow.USER32(?,00000000,00000000,00000505), ref: 00F9A708
GetParent.USER32(?), ref: 00F9A723
GetParent.USER32(?), ref: 00F9A737
RedrawWindow.USER32(?,00000000,00000000,00000505,00000000), ref: 00F9A749
RedrawWindow.USER32(?,00000000,00000000,00000505), ref: 00F9A76B
GetParent.USER32(?), ref: 00F9A774
GetParent.USER32(?), ref: 00F9A78F
GetParent.USER32(?), ref: 00F9A79A
InvalidateRect.USER32(?,?,00000001), ref: 00F9A7D2
RedrawWindow.USER32(?,00000000,00000000,00000505,00000000,?,00000000), ref: 00F9A90A

Part of subcall function 00F97AE0: InvalidateRect.USER32(?,?,00000001,?), ref: 00F97B55
Part of subcall function 00F97AE0: InflateRect.USER32(?,?,?), ref: 00F97B9B
Part of subcall function 00F97AE0: RedrawWindow.USER32(?,?,00000000,00000401,?,?), ref: 00F97BAE

UpdateWindow.USER32(?), ref: 00F9A86A
UpdateWindow.USER32(?), ref: 00F9A8C9
SetCapture.USER32(?,?,00000000), ref: 00F9A8D4

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$Parent$RectRedraw$Update$Cursor$CaptureInflateInvalidate$AsyncClientH_prolog3_ScreenState
String ID:
API String ID: 991125134-0
Opcode ID: 6306bdd1c228cf70b1598fbe52b471a6cff5e50d43092591d030db5bdbe23f11
Instruction ID: 54a6148e4ff9098b71821c6e7c27a3d8925f53c84bf8c6939bdeaabcbb33eae4
Opcode Fuzzy Hash: 6306bdd1c228cf70b1598fbe52b471a6cff5e50d43092591d030db5bdbe23f11
Instruction Fuzzy Hash: 54028170A00610DFDF25AF64C889A9D7BB5FF08720F244179F8499F269DB359844EF92

Function 00FEA519 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 283windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FEA523
EnterCriticalSection.KERNEL32(010D4FDC,0000008C), ref: 00FEA539
GetUpdateRect.USER32(?,?,00000000), ref: 00FEA562
GetClientRect.USER32(?,?), ref: 00FEA587
GetWindowRect.USER32(?,?), ref: 00FEA59F
OffsetRect.USER32(?,?,?), ref: 00FEA5BB
OffsetRect.USER32(?,?,?), ref: 00FEA5CD
CreateCompatibleDC.GDI32(?), ref: 00FEA5FD
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00FEA627
IsRectEmpty.USER32(?), ref: 00FEA67F
GetWindowRect.USER32(?,?), ref: 00FEA70A

Part of subcall function 00F7E593: ScreenToClient.USER32(00000407,?), ref: 00F7E5A4
Part of subcall function 00F7E593: ScreenToClient.USER32(00000407,?), ref: 00F7E5B1

OffsetRect.USER32(?,?,?), ref: 00FEA72B
InflateRect.USER32(?,00000000,000000FF), ref: 00FEA738
BitBlt.GDI32(?,?,?,?,?,?,?,?,00CC0020), ref: 00FEA7AD
CreateRectRgnIndirect.GDI32(?), ref: 00FEA68A

Part of subcall function 00F7E508: SelectClipRgn.GDI32(?,00000000), ref: 00F7E52E
Part of subcall function 00F7E508: SelectClipRgn.GDI32(?,?), ref: 00F7E544

Part of subcall function 00F7DFAD: IntersectClipRect.GDI32(?,?,?,?,?), ref: 00F7DFD6
Part of subcall function 00F7DFAD: IntersectClipRect.GDI32(?,?,?,?,?), ref: 00F7DFEB

Part of subcall function 00F8E2EF: __EH_prolog3.LIBCMT ref: 00F8E2F6

LeaveCriticalSection.KERNEL32(010D4FDC), ref: 00FEA861

Strings

@Ls Fs, xrefs: 00FEA5FD

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Rect$Clip$ClientCreateOffset$CompatibleCriticalIntersectScreenSectionSelectWindow$BitmapEmptyEnterH_prolog3H_prolog3_IndirectInflateLeaveUpdate
String ID: @Ls Fs
API String ID: 1337057690-1589975592
Opcode ID: e90bb35bdb1d859dff8cec9bba3c96cf379c43ccbd01e6446879587e92aad052
Instruction ID: adf8e5d42dda951319a6eafbf03338c280374cd7abb26c2ad2c36321002a65b5
Opcode Fuzzy Hash: e90bb35bdb1d859dff8cec9bba3c96cf379c43ccbd01e6446879587e92aad052
Instruction Fuzzy Hash: 3DC11471D00219DFCF11EFA4CC84AEEBBB9BF08300F1441AAE946AB255DB356A45DF61

Function 00FEE6A5 Relevance: 30.0, APIs: 15, Strings: 2, Instructions: 237windowCOMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FEE6AF
CreateCompatibleDC.GDI32(00000000), ref: 00FEE716
GetObjectA.GDI32(?,00000018,000000FF), ref: 00FEE734
SelectObject.GDI32(?,?), ref: 00FEE772
CreateCompatibleDC.GDI32(?), ref: 00FEE790
CreateDIBSection.GDI32(?,?,00000000,?,00000000,00000000), ref: 00FEE7E6
SelectObject.GDI32(?,?), ref: 00FEE7FB
SelectObject.GDI32(?,00000000), ref: 00FEE811
SelectObject.GDI32(?,?), ref: 00FEE820
DeleteObject.GDI32(?), ref: 00FEE827
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 00FEE879
GetPixel.GDI32(?,?,00000000), ref: 00FEE941
SetPixel.GDI32(?,?,00000000,?), ref: 00FEE956
SelectObject.GDI32(?,?), ref: 00FEE973
SelectObject.GDI32(?,?), ref: 00FEE97B

Strings

@Ls Fs, xrefs: 00FEE716, 00FEE790
(, xrefs: 00FEE7C6

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Object$Select$Create$CompatiblePixel$DeleteH_prolog3_Section
String ID: ($@Ls Fs
API String ID: 1942225872-2035409421
Opcode ID: b7ce6db114f40f47ff761f6b78678846e512a18b2864053acc6e3856b286e496
Instruction ID: b2e8b05b1fc01eba53a4177d82adce4955915b60145643c2a5a5a866fcd5b113
Opcode Fuzzy Hash: b7ce6db114f40f47ff761f6b78678846e512a18b2864053acc6e3856b286e496
Instruction Fuzzy Hash: FBA10275C00258DFCF21EFA5D8809ADBBB5FF18310F20412AE566A7251DB316E46EF11

Function 00F7A23B Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 186COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00003020), ref: 00F7A263
GetDlgItem.USER32(?,00003020), ref: 00F7A296
GetWindowRect.USER32(00000000,?), ref: 00F7A2B0
MapDialogRect.USER32(?,?), ref: 00F7A2D4
SetWindowPos.USER32(?,00000000,00000000,00000000,?,00000020,00000016), ref: 00F7A301
GetDlgItem.USER32(?,?), ref: 00F7A316
GetWindowRect.USER32(00000000,?), ref: 00F7A328
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000015,?), ref: 00F7A347
GetWindowRect.USER32(?,?), ref: 00F7A35E
GetWindowRect.USER32(?,?), ref: 00F7A3B3
GetDlgItem.USER32(?,00000001), ref: 00F7A3C6
GetWindowRect.USER32(00000000,?), ref: 00F7A3D5
GetDlgItem.USER32(?,?), ref: 00F7A400
ShowWindow.USER32(00000000,00000000), ref: 00F7A40E
EnableWindow.USER32(00000000,00000000), ref: 00F7A416

Strings

, xrefs: 00F7A2CD

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$Rect$Item$DialogEnableShow
String ID:
API String ID: 763981185-3916222277
Opcode ID: 43596e752a03501761c3cc7bb9521d15c5f6ff5d0c0e56531105b694b0cf2bba
Instruction ID: 02de802383c8f7dff4b0b86b964134dba327544f3f5efcf5306dbd50f2d1c452
Opcode Fuzzy Hash: 43596e752a03501761c3cc7bb9521d15c5f6ff5d0c0e56531105b694b0cf2bba
Instruction Fuzzy Hash: 58610371D00209AFDB21DFA9CD88DAFFBF9FF88710F10451AE145A2164DB769A40DB26

Function 00FCA58A Relevance: 24.8, APIs: 12, Strings: 2, Instructions: 335windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FCA594
GetClientRect.USER32(?,?), ref: 00FCA5B6
CreateCompatibleDC.GDI32(?), ref: 00FCA5F2
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00FCA63A
CreateDIBSection.GDI32 ref: 00FCA6B7
CreateDIBSection.GDI32(?,00000028,00000000,?,00000000,00000000), ref: 00FCA6EA
CreateDIBSection.GDI32(?,00000028,00000000,?,00000000,00000000), ref: 00FCA71D
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 00FCA781
_memmove.LIBCMT ref: 00FCA79A
GetWindowRect.USER32(?,?), ref: 00FCA7E9
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 00FCA902
BitBlt.GDI32(?,?,?,?,?,?,00000000,00000000,00CC0020), ref: 00FCA978

Strings

@Ls Fs, xrefs: 00FCA5F2
(, xrefs: 00FCA69D

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Create$Section$CompatibleRect$BitmapClientH_prolog3_Window_memmove
String ID: ($@Ls Fs
API String ID: 498668396-2035409421
Opcode ID: b37b49b740b1356e625de4e1360de983ddb1e03410a72e84c51b6cc359a690a0
Instruction ID: 191ae7c03f54dc783d848207ea55d1dbb5d5ed41d266ab1585a11876b4dd8822
Opcode Fuzzy Hash: b37b49b740b1356e625de4e1360de983ddb1e03410a72e84c51b6cc359a690a0
Instruction Fuzzy Hash: 9CD12571D0060ADFCB21DFA4C985EAEBBB9FF48304F24856EE55AA7211D731A841EF11

Function 00FB8231 Relevance: 24.2, APIs: 16, Instructions: 184windowstringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FB823B
SendMessageA.USER32(?,0000110A,00000000,00000000), ref: 00FB826F
SendMessageA.USER32(?,0000000B,00000000,00000000), ref: 00FB8280
SendMessageA.USER32(?,0000110A,00000004,00000000), ref: 00FB836B
SendMessageA.USER32(?,00001102,00000002,00000000), ref: 00FB8381
SendMessageA.USER32(?,0000110A,00000004,00000000), ref: 00FB8396
SHGetFileInfoA.SHELL32(?,00000000,?,00000160,00000208), ref: 00FB83D2
SHGetFileInfoA.SHELL32(?,00000000,?,00000160,00000208), ref: 00FB83F5
lstrcmpA.KERNEL32(?,?), ref: 00FB840D

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: MessageSend$FileInfo$H_prolog3_lstrcmp
String ID:
API String ID: 597947708-0
Opcode ID: 4d57b645564b5441924dabca24813763f3fbdce940702cca29e60d167769c903
Instruction ID: aa21938d42b1a59efbb07c72c82449574d41b52a57f6110f5c306b5068e789a0
Opcode Fuzzy Hash: 4d57b645564b5441924dabca24813763f3fbdce940702cca29e60d167769c903
Instruction Fuzzy Hash: DB813B70A4022AEFDF35DF21CD49BDDBAB9BB08750F1001E6A548B61A0DBB19E91DF04

Function 00FD84AC Relevance: 24.2, APIs: 16, Instructions: 182windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000201,00000201,00000001), ref: 00FD8545
SendMessageA.USER32(00000000,00000084,00000000,?), ref: 00FD8562
ReleaseCapture.USER32 ref: 00FD859D
GetMessageA.USER32(?,00000000,000000A1,000000A1), ref: 00FD85AC
PeekMessageA.USER32(?,00000000,?,?,00000001), ref: 00FD85C0
DispatchMessageA.USER32(?), ref: 00FD85C7
DispatchMessageA.USER32(?), ref: 00FD8672
GetCursorPos.USER32(?), ref: 00FD867C
PeekMessageA.USER32(?,00000000,?,?,00000001), ref: 00FD869D

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Message$Peek$Dispatch$CaptureCursorReleaseSend
String ID:
API String ID: 597789953-0
Opcode ID: 2ac74286de53d13c23560d091b6ebe94a59268dea9bb62f5ad31a7e3e6f34f99
Instruction ID: ab59d6d7a77c6791b904b8a70f5ee696f751cbda28f4f6519060f646dd6dfcac
Opcode Fuzzy Hash: 2ac74286de53d13c23560d091b6ebe94a59268dea9bb62f5ad31a7e3e6f34f99
Instruction Fuzzy Hash: DE519F71600200BBEB306B55DC88FBF77AEEB457A1F280416F582D2244DA79DD42EB66

Function 00FD2372 Relevance: 22.8, APIs: 15, Instructions: 259COMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00FD2389
LoadCursorA.USER32(00000000,00007F00), ref: 00FD23F7
SetCursor.USER32(00000000), ref: 00FD23FE
SetRectEmpty.USER32(?), ref: 00FD2417

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Cursor$CaptureEmptyLoadRect
String ID:
API String ID: 2438408-0
Opcode ID: 8fb2d089efbbc74b4a0f5fb018ed6de50d9ca736f80be0a318271a3532b02a5f
Instruction ID: 2fb25a9aa19f76fa0788c6da3768700af7c4f61861833ec0a34b356656832442
Opcode Fuzzy Hash: 8fb2d089efbbc74b4a0f5fb018ed6de50d9ca736f80be0a318271a3532b02a5f
Instruction Fuzzy Hash: 2EA15E71E002199FCF15DFE8C9889AEBBB6FF58310F18406AF845EB209DB759905DB90

Function 00FC669F Relevance: 21.4, APIs: 14, Instructions: 355COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC66A6
PathRemoveFileSpecW.SHLWAPI(?), ref: 00FC6757
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,?,00000000,00000000), ref: 00FC6794
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,?,00000000,00000000), ref: 00FC67BD
_strlen.LIBCMT ref: 00FC67D8
CoTaskMemFree.OLE32(?), ref: 00FC67E8
PathRemoveFileSpecW.SHLWAPI(?), ref: 00FC68B7
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,?,00000000,00000000), ref: 00FC68D2
CoTaskMemFree.OLE32(?), ref: 00FC68DD
PathRemoveFileSpecW.SHLWAPI(?), ref: 00FC691F
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,?,?,00000000,00000000), ref: 00FC695E
CoTaskMemFree.OLE32(?), ref: 00FC6969
PathFindFileNameA.SHLWAPI(?,00000000,?), ref: 00FC6A30
PathFindExtensionA.SHLWAPI(?,00000000), ref: 00FC6A58

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Path$ByteCharFileMultiWide$FreeRemoveSpecTask$Find$ExtensionH_prolog3Name_strlen
String ID:
API String ID: 2911475250-0
Opcode ID: 46a60ef872373fe7dfc99a58b962ed9111ff56c2e5817510db8053cf2a3c7e55
Instruction ID: e64aedf36f1191f40427efb1a7a56bc5ec0d0270d4df86bb060b9ec2fd82ebfe
Opcode Fuzzy Hash: 46a60ef872373fe7dfc99a58b962ed9111ff56c2e5817510db8053cf2a3c7e55
Instruction Fuzzy Hash: 02E15B7090010AEFCB04DFA4C989EAEB7B9FF48314B20455DF556EB2A1CB35AD06DB20

Function 00F6A090 Relevance: 21.1, APIs: 3, Strings: 9, Instructions: 111windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00F6A1C1
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00F6A1D2
PostMessageA.USER32(0000FFFF,0000C1D0,0000000E,00000001), ref: 00F6A20E

Strings

Notification Sound Volume, xrefs: 00F6A111
Notification Use System Volume, xrefs: 00F6A134
Notification Dialog ON, xrefs: 00F6A19D
Notification Flash Icon ON, xrefs: 00F6A157
Notification Flash Interval, xrefs: 00F6A17A
SoundPath, xrefs: 00F6A1E7
Notification Sound ON, xrefs: 00F6A0BF
Preferences, xrefs: 00F6A0C4, 00F6A0F3, 00F6A116, 00F6A139, 00F6A15C, 00F6A17F, 00F6A1A2, 00F6A1EC
Notification Sound, xrefs: 00F6A0EE

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Message$Send$Post
String ID: Notification Dialog ON$Notification Flash Icon ON$Notification Flash Interval$Notification Sound$Notification Sound ON$Notification Sound Volume$Notification Use System Volume$Preferences$SoundPath
API String ID: 3628032766-3242384156
Opcode ID: b657e35eb6852e739b13ef6553a138006b58c226b2790add4dcefab4cd32e93e
Instruction ID: 7b374cf5b99afca0a7ef24458fa915f875bc2641dcffa000d3b41db05deb6c3e
Opcode Fuzzy Hash: b657e35eb6852e739b13ef6553a138006b58c226b2790add4dcefab4cd32e93e
Instruction Fuzzy Hash: 92413471345601AFD794EB64CC91FAAB3E5BB88740F64861EF2D9DB340CB74A9428B90

Function 00FA66E9 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 154COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FA66F3
_memset.LIBCMT ref: 00FA6713
_memset.LIBCMT ref: 00FA672A

Part of subcall function 00F7199D: __EH_prolog3.LIBCMT ref: 00F719A4

__splitpath_s.LIBCMT ref: 00FA67A1
_strlen.LIBCMT ref: 00FA67AD

Strings

homestead, xrefs: 00FA6882
Luna, xrefs: 00FA67C8
metallic, xrefs: 00FA689B
royale, xrefs: 00FA68D5
Aero, xrefs: 00FA67DC
normalcolor, xrefs: 00FA6869

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: _memset$H_prolog3H_prolog3___splitpath_s_strlen
String ID: Aero$Luna$homestead$metallic$normalcolor$royale
API String ID: 3363187346-2881773410
Opcode ID: 0c2ae2c3e8c22f1e9b2fb7b81d5f2ce06eac3901e83807a7024c5083996a1e86
Instruction ID: 861ea1d56177029cdae23fdd9806ebd7bfc2a6e22b0a1f7211391dc6a77c730e
Opcode Fuzzy Hash: 0c2ae2c3e8c22f1e9b2fb7b81d5f2ce06eac3901e83807a7024c5083996a1e86
Instruction Fuzzy Hash: D6519F71E0052DAACB25D765CC51BEFB77CAF15321F080299B119E21C1EBB49B84EEA1

Function 0100A5D3 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0100A5DA
GetObjectA.GDI32(00000018,00000018,0109A46C), ref: 0100A5F6
_memmove.LIBCMT ref: 0100A654

Strings

, xrefs: 0100A640

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: H_prolog3Object_memmove
String ID:
API String ID: 107514201-3916222277
Opcode ID: d7effb3e25a1e7a9bc8f6826e8f9624e83db47c1c60258bd240592cb4d98edc9
Instruction ID: ef1106ef48e60cfbe0d764becaded8591faab22ea076e9de2ab8db638b5f882c
Opcode Fuzzy Hash: d7effb3e25a1e7a9bc8f6826e8f9624e83db47c1c60258bd240592cb4d98edc9
Instruction Fuzzy Hash: 49414C71D00219EFEF16DFA8CC809EEBBB5FF48350F10816AE556A7290DB355A05DB90

Function 00F902A2 Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 111windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F902A9

Part of subcall function 00F8E228: GetObjectA.GDI32(?,00000054,?), ref: 00F8E247

Part of subcall function 00F7E7F8: __EH_prolog3.LIBCMT ref: 00F7E7FF
Part of subcall function 00F7E7F8: GetDC.USER32(00000000), ref: 00F7E82B

CreateCompatibleDC.GDI32(?), ref: 00F902F9
SelectObject.GDI32(?,?), ref: 00F90314
GdipCreateBitmapFromHBITMAP.GDIPLUS(?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000074), ref: 00F90343
GdipDisposeImage.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000,00000074), ref: 00F90356
GdipCreateFromHDC.GDIPLUS(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,00000000), ref: 00F90365
GdipSetInterpolationMode.GDIPLUS(?,00000007,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 00F90376
GdipDeleteGraphics.GDIPLUS(?,?,00000007,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F903B0
GdipDisposeImage.GDIPLUS(?,?,?,00000007,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00F903B8
SelectObject.GDI32(?,?), ref: 00F903C8

Strings

@Ls Fs, xrefs: 00F902F9

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Gdip$CreateObject$DisposeFromH_prolog3ImageSelect$BitmapCompatibleDeleteGraphicsInterpolationMode
String ID: @Ls Fs
API String ID: 3579439469-1589975592
Opcode ID: b3503288d1f7d894b0ae1697e82f69eddc2c559afaba2afa58e82d1c37443806
Instruction ID: 7b51d380c65e5fefcf0fd8a5802c92408d30328573c4c7b015a34357db38e24b
Opcode Fuzzy Hash: b3503288d1f7d894b0ae1697e82f69eddc2c559afaba2afa58e82d1c37443806
Instruction Fuzzy Hash: F2417772C00219EFDF14EFA4CC849EEBBB8BF18310F14816AE945A7211DB749A44EB91

Function 00FD86AC Relevance: 18.2, APIs: 12, Instructions: 150windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FD8334: LoadCursorA.USER32(00000000,00007F8B), ref: 00FD834E
Part of subcall function 00FD8334: LoadCursorW.USER32(?,00007901), ref: 00FD836B

PeekMessageA.USER32(?,?,00000367,00000367,00000003), ref: 00FD86E4
PostMessageA.USER32(?,00000111,0000E145,00000000), ref: 00FD8747
SendMessageA.USER32(?,00000362,0000E002,00000000), ref: 00FD8769
GetCursorPos.USER32(?), ref: 00FD8784
PeekMessageA.USER32(?,00000000,00000000,00000000,00000000), ref: 00FD87B0
ReleaseCapture.USER32 ref: 00FD87FD
SetCapture.USER32(?), ref: 00FD8802
ReleaseCapture.USER32 ref: 00FD880E
SendMessageA.USER32(?,00000362,?,00000000), ref: 00FD8822
SendMessageA.USER32(?,00000111,0000E147,00000000), ref: 00FD884D
PostMessageA.USER32(?,0000036A,00000000,00000000), ref: 00FD886B

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Message$CaptureCursorSend$LoadPeekPostRelease
String ID:
API String ID: 291007519-0
Opcode ID: 3c06fbc87bfa26b5e3cf848ad539ca6b5bff30f6f486e39452ea4d4e4f13b8df
Instruction ID: cb462083b626c068674f1084864a5c42ed8218ae2626728f7e7ac9e3e37ee7ea
Opcode Fuzzy Hash: 3c06fbc87bfa26b5e3cf848ad539ca6b5bff30f6f486e39452ea4d4e4f13b8df
Instruction Fuzzy Hash: C3519471A00208EFDB21AF60CC84EAEBBBEFF44394F64446AF19696251DB759D41EF10

Function 00F903F7 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 242COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F90401
GetWindowRect.USER32(?,?), ref: 00F90450
OffsetRect.USER32(?,?,?), ref: 00F90466

Part of subcall function 00F7E7F8: __EH_prolog3.LIBCMT ref: 00F7E7FF
Part of subcall function 00F7E7F8: GetDC.USER32(00000000), ref: 00F7E82B

CreateCompatibleDC.GDI32(?), ref: 00F904D7
SelectObject.GDI32(?,?), ref: 00F904F7
SelectObject.GDI32(?,?), ref: 00F90539
CreateCompatibleDC.GDI32(?), ref: 00F90652
SelectObject.GDI32(?,?), ref: 00F90672
SelectObject.GDI32(?,00000000), ref: 00F906A2

Strings

@Ls Fs, xrefs: 00F904D7, 00F90652

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: ObjectSelect$CompatibleCreateRect$H_prolog3H_prolog3_OffsetWindow
String ID: @Ls Fs
API String ID: 2818906880-1589975592
Opcode ID: ef78fef61fb7aa1ff9cd6c256d22d386db67ec96875ff6fdc89bf60fdfa8fe03
Instruction ID: d8300585e000966a7d64906356aa44d5bfc331d14fcc772929a5b73fda459944
Opcode Fuzzy Hash: ef78fef61fb7aa1ff9cd6c256d22d386db67ec96875ff6fdc89bf60fdfa8fe03
Instruction Fuzzy Hash: 18A11172D0021AEFDF14EFA4C984AEEBBB5BF48300F1441AAE919B7251DB345A45DF60

Function 00F6A240 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 196windowCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(StretchRes), ref: 00F6A2CD
FindResourceA.KERNEL32(00000000,soundlist,0000000A), ref: 00F6A2DD
SizeofResource.KERNEL32(00000000,00000000), ref: 00F6A2F0
LoadResource.KERNEL32(00000000,?), ref: 00F6A2FE
LockResource.KERNEL32(00000000), ref: 00F6A30D
SendMessageA.USER32(?,00000143,00000000,?), ref: 00F6A398
SendMessageA.USER32(?,00000151,00000000,000000FF), ref: 00F6A3B0
SendMessageA.USER32(?,00000146,00000000,00000000), ref: 00F6A412

Strings

StretchRes, xrefs: 00F6A2C4
soundlist, xrefs: 00F6A2D7

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Resource$MessageSend$FindHandleLoadLockModuleSizeof
String ID: StretchRes$soundlist
API String ID: 2030522427-4121383072
Opcode ID: 31458f374c59bebdd49ff398e51e2928d63c5d5f15bc8ad40f8460b908736405
Instruction ID: 4d5fef766acd87cad2f590cc810921497a9b44f176275e2c5a74ddcc251ab25c
Opcode Fuzzy Hash: 31458f374c59bebdd49ff398e51e2928d63c5d5f15bc8ad40f8460b908736405
Instruction Fuzzy Hash: A361D371A006069FCB14DF68CC55BAFB7B8FF45320F148258E852AB395DB35A905CB91

Function 00FCA0B2 Relevance: 16.9, APIs: 11, Instructions: 442windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FCA0B9
GetClientRect.USER32(?,?), ref: 00FCA0DB
SetRectEmpty.USER32(?), ref: 00FCA12B
MapWindowPoints.USER32(?,?,?), ref: 00FCA173
MapWindowPoints.USER32(?,?,?,00000002), ref: 00FCA1EB
GetWindowRect.USER32(?,?), ref: 00FCA21E
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 00FCA248
OffsetRect.USER32(?,?,00000000), ref: 00FCA2ED
InflateRect.USER32(?,00000000,00000000), ref: 00FCA324
IsRectEmpty.USER32(?), ref: 00FCA408

Part of subcall function 00F79606: GetWindowLongA.USER32(00000407,000000EC), ref: 00F79611

IsRectEmpty.USER32(?), ref: 00FCA534

Part of subcall function 0100ADB3: __EH_prolog3_GS.LIBCMT ref: 0100ADBA
Part of subcall function 0100ADB3: UnionRect.USER32(?,?,?), ref: 0100AE12
Part of subcall function 0100ADB3: EqualRect.USER32(?,?), ref: 0100AE20
Part of subcall function 0100ADB3: CreateCompatibleDC.GDI32(?), ref: 0100AE57
Part of subcall function 0100ADB3: CreateCompatibleBitmap.GDI32(?,?,?), ref: 0100AE87
Part of subcall function 0100ADB3: SelectObject.GDI32(?,00000000), ref: 0100AEE7

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Rect$Window$Empty$CompatibleCreateH_prolog3_Points$BitmapClientEqualInflateLongObjectOffsetSelectUnion
String ID:
API String ID: 3848083076-0
Opcode ID: 40a64bc5f804fbb43d4bd259c060f7b1573b5b74e97cca0712c1d651e77df55b
Instruction ID: a8db903fc3d67fcf20b19c4eb993b26deddeee3f6dab24c61ee77ab650fd3e0c
Opcode Fuzzy Hash: 40a64bc5f804fbb43d4bd259c060f7b1573b5b74e97cca0712c1d651e77df55b
Instruction Fuzzy Hash: 37F18831D0026ADFCF11DFA4C989AEEBBB6FF09304F140169E802AF249DB756945DB91

Function 00FBC485 Relevance: 16.9, APIs: 11, Instructions: 392COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FBC48C
IsRectEmpty.USER32(?), ref: 00FBC4A3
FillRect.USER32(?,?,?), ref: 00FBC56C

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Rect$EmptyFillH_prolog3_
String ID:
API String ID: 3863378599-0
Opcode ID: 0e89669757e24445937889fc28922b141538c983f0180fa30191745537e03737
Instruction ID: 6bf9946eeccfddaa8fdf608bb59743a42fda6f2cbb0b14b371a222ded4fed637
Opcode Fuzzy Hash: 0e89669757e24445937889fc28922b141538c983f0180fa30191745537e03737
Instruction Fuzzy Hash: 56F16731D0060ACFCF15DFA4C884AEEB7B6BF08311F244169E846BB255DB75A946DF90

Function 00FCC058 Relevance: 16.7, APIs: 11, Instructions: 192timeCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00FCC08B
ScreenToClient.USER32(?,?), ref: 00FCC098
PtInRect.USER32(?,?,?), ref: 00FCC0C6
PtInRect.USER32(?,?,?), ref: 00FCC0EB
KillTimer.USER32(?,00000002), ref: 00FCC11B
InvalidateRect.USER32(?,?,00000001), ref: 00FCC139
InvalidateRect.USER32(?,?,00000001), ref: 00FCC147
_clock.LIBCMT ref: 00FCC15C
KillTimer.USER32(?,00000001), ref: 00FCC261
ValidateRect.USER32(?,00000000), ref: 00FCC27D
RedrawWindow.USER32(?,00000000,00000000,00000185,00000000), ref: 00FCC2BB

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Rect$InvalidateKillTimer$ClientCursorRedrawScreenValidateWindow_clock
String ID:
API String ID: 3482734790-0
Opcode ID: c059b84b5acefde27d4282ace518449b01df0d36d64099a6678e9807b47dca5f
Instruction ID: f8afc1f9267c4344dbe2e6244e600f6b3d7310972c8ef85812dc832d49834c74
Opcode Fuzzy Hash: c059b84b5acefde27d4282ace518449b01df0d36d64099a6678e9807b47dca5f
Instruction Fuzzy Hash: FC716E31600A06DFCB31DF64CA85FAABBF5FF48350F14082EE49BD6155DA75A941EB80

Function 00FF042C Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 240windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00FED6F6: GdipGetImagePixelFormat.GDIPLUS(?,010D52DC,00000000,00000000,?,00FF0456,00000000,00000000,010D52DC), ref: 00FED706

_free.LIBCMT ref: 00FF055F
_free.LIBCMT ref: 00FF05AB
GdipBitmapLockBits.GDIPLUS(?,00000000,00000001,00000000,?,00000000,?,?,00000000,00000000,00000000,00000000,00000000,010D52DC), ref: 00FF0674
_free.LIBCMT ref: 00FF06A4

Part of subcall function 00FED718: GdipGetImagePaletteSize.GDIPLUS(?,00000000,00000000,00000000,?,00FF0510,00000000,?,?,00000000,00000000,00000000,00000000,00000000), ref: 00FED72C

GdipBitmapUnlockBits.GDIPLUS(00000005,?,?,00000000,00000001,00000000,?,00000000,?,?,00000000,00000000,00000000,00000000,00000000,010D52DC), ref: 00FF0720
_free.LIBCMT ref: 00FF079B

Strings

&, xrefs: 00FF04AC

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Gdip_free$BitmapBitsImage$FormatLockPalettePixelSizeUnlock
String ID: &
API String ID: 4092590016-3042966939
Opcode ID: b33a6c91a948fdabd7a791125c850077e6a285db640795f4f5aaa686b25a364e
Instruction ID: 3a616a2460e699dea740184b031dd47ce0fd86940d9480ea436c22dfbae7960b
Opcode Fuzzy Hash: b33a6c91a948fdabd7a791125c850077e6a285db640795f4f5aaa686b25a364e
Instruction Fuzzy Hash: 3FA15AB2D0022D9BCB309F14CD80BA9B7B5AF44314F1480E9E749A7262CB74AEC5DF58

Function 00FE2128 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 113stringCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FE2132
GetSystemMetrics.USER32(00000003), ref: 00FE2149
GetObjectA.GDI32(0000003C,?), ref: 00FE2172
_memset.LIBCMT ref: 00FE217F
lstrcpyA.KERNEL32 ref: 00FE21A3

Part of subcall function 00F7E7F8: __EH_prolog3.LIBCMT ref: 00F7E7FF
Part of subcall function 00F7E7F8: GetDC.USER32(00000000), ref: 00F7E82B

CreateFontIndirectA.GDI32(?), ref: 00FE21CF

Part of subcall function 00F7EB1F: SelectObject.GDI32(?,00000000), ref: 00F7EB45
Part of subcall function 00F7EB1F: SelectObject.GDI32(?,?), ref: 00F7EB5B

GetTextMetricsA.GDI32(?,?), ref: 00FE2209
CreateFontIndirectA.GDI32(?), ref: 00FE2266

Strings

Arial, xrefs: 00FE2196

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Object$CreateFontIndirectMetricsSelect$H_prolog3H_prolog3_SystemText_memsetlstrcpy
String ID: Arial
API String ID: 1699662471-493054409
Opcode ID: 36a2c54b721fafdbf931ff8f4f7d7b1c56876c8f2068a9fa25f57ff3ad0d757b
Instruction ID: e4ea0c63491a0aa6562394700959a2e2fd17f82e6ff424e03d25eb42a71636f9
Opcode Fuzzy Hash: 36a2c54b721fafdbf931ff8f4f7d7b1c56876c8f2068a9fa25f57ff3ad0d757b
Instruction Fuzzy Hash: FB419231900245DFEB64DBB4CC45BEDB7B8BF44300F5481AAE65AE3181EB386A45EF11

Function 00FD8391 Relevance: 15.1, APIs: 10, Instructions: 98threadCOMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00FD83AF
WindowFromPoint.USER32(?,?,?,00000001,?,00000000), ref: 00FD83BE
GetActiveWindow.USER32 ref: 00FD83E0
GetCurrentThreadId.KERNEL32 ref: 00FD83F8
GetWindowThreadProcessId.USER32(?,00000000), ref: 00FD8407
GetDesktopWindow.USER32 ref: 00FD8413

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$Thread$ActiveCaptureCurrentDesktopFromPointProcess
String ID:
API String ID: 1298419125-0
Opcode ID: d0ae071adab060d5e3efbab9cfdf22a8b713e1a05619bd93a14fb270269481f0
Instruction ID: 1e902a5b6fe0d3333dcd165a819b4e305a04026b2fd9e4370c2e0326722423c0
Opcode Fuzzy Hash: d0ae071adab060d5e3efbab9cfdf22a8b713e1a05619bd93a14fb270269481f0
Instruction Fuzzy Hash: 15317071D00216DFCF21EFA4D8488AEBBB6FB45361B284066E485A7304DF398D42EB51

Function 00FC21B0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 244windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FC21BA
SendMessageA.USER32(?,000000B9,00000001,00000000), ref: 00FC228D

Part of subcall function 00F76D32: GetWindowTextLengthA.USER32(?), ref: 00F76D43
Part of subcall function 00F76D32: GetWindowTextA.USER32(?,00000000,00000001), ref: 00F76D5A

__splitpath_s.LIBCMT ref: 00FC22FA

Part of subcall function 00F85CBE: __mbsinc.LIBCMT ref: 00F85CE8

SendMessageA.USER32(?,000000B9,00000001,00000000), ref: 00FC24C9
GetParent.USER32(?), ref: 00FC24E2
GetParent.USER32(?), ref: 00FC24F1
RedrawWindow.USER32(?,00000000,00000000,00000481,00000000), ref: 00FC2503

Strings

*?<>|, xrefs: 00FC2344

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$MessageParentSendText$H_prolog3_LengthRedraw__mbsinc__splitpath_s
String ID: *?<>|
API String ID: 744279128-3491500753
Opcode ID: 9a307932788e5ddd5305f99a6272db42c68f398ebeaf026644dfcefd79824dd7
Instruction ID: 93ef2b374420c52ea4b35928ee7bde7f965e82c80e00e673f3e42abb31b70f19
Opcode Fuzzy Hash: 9a307932788e5ddd5305f99a6272db42c68f398ebeaf026644dfcefd79824dd7
Instruction Fuzzy Hash: 8C9191719001599BCB2AEB64CD96FEEB7BCEF18314F0442DCB14AA6191DB741F84EB11

Function 00F8A4FE Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetStockObject.GDI32(00000011), ref: 00F8A526
GetStockObject.GDI32(0000000D), ref: 00F8A52E
GetObjectA.GDI32(00000000,0000003C,?), ref: 00F8A53B
GetDC.USER32(00000000), ref: 00F8A54A
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00F8A55E
MulDiv.KERNEL32(00000000,00000048,00000000), ref: 00F8A56A
ReleaseDC.USER32(00000000,00000000), ref: 00F8A576

Strings

System, xrefs: 00F8A521, 00F8A58B

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Object$Stock$CapsDeviceRelease
String ID: System
API String ID: 46613423-3470857405
Opcode ID: e40c58a15bc883528f08e1bf53a1a33255e1c4f59cddd0e89d5262ab2358139c
Instruction ID: af06bb5d1e6a3f93b0b7be1ec9f4458d06ef8597abff0dc2941151b117d21c25
Opcode Fuzzy Hash: e40c58a15bc883528f08e1bf53a1a33255e1c4f59cddd0e89d5262ab2358139c
Instruction Fuzzy Hash: C611C171A40218EBEB20AFA0DC45FEE7BB8EB54751F140026F681AA1C4DB759D42DBB1

Function 0100229A Relevance: 13.7, APIs: 9, Instructions: 207COMMON

Download Yara Rule

APIs

PtInRect.USER32(?,?,00000000), ref: 010022D2
RedrawWindow.USER32(?,?,00000000,00000105,?,?,?,?,00000000), ref: 010022FE
ClientToScreen.USER32(?,?), ref: 01002333
WindowFromPoint.USER32(?,?,?,?,?,?,00000000), ref: 0100233F
ReleaseCapture.USER32 ref: 01002357
SetCapture.USER32(?,?,?,?,?,00000000), ref: 010023C9
ReleaseCapture.USER32 ref: 010023FB
ClientToScreen.USER32(?,?), ref: 010024E9
SetCursorPos.USER32(?,?,?,?,?,?,00000000), ref: 010024F5

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Capture$ClientReleaseScreenWindow$CursorFromPointRectRedraw
String ID:
API String ID: 2024412728-0
Opcode ID: f93dee93fa9aa31388ba8aeb3625bc59346934d2c8a946033420b0ddb66d8c61
Instruction ID: 5673d710565ecc96d884b6be189e40861c2c4fa109be6e42f51ba62e3679db6c
Opcode Fuzzy Hash: f93dee93fa9aa31388ba8aeb3625bc59346934d2c8a946033420b0ddb66d8c61
Instruction Fuzzy Hash: 70814D70600606DFDB22DF68C8989EEBBF5FF48301F20456AE9EA87294DB319541DF51

Function 00FBA08D Relevance: 13.7, APIs: 9, Instructions: 189COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 00FBA100
InvalidateRect.USER32(?,?,00000001), ref: 00FBA163
InvalidateRect.USER32(?,?,00000001), ref: 00FBA16E

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Rect$Invalidate$Empty
String ID:
API String ID: 1126320529-0
Opcode ID: 0bae26fc08099cc88aab10a6c53f0fe24bf035f6b190319621a2aa77f44436f8
Instruction ID: e90c0c753be1b06e200352ed8cc4aab1f9211b14587c021603b49174c3fa340e
Opcode Fuzzy Hash: 0bae26fc08099cc88aab10a6c53f0fe24bf035f6b190319621a2aa77f44436f8
Instruction Fuzzy Hash: C7612771A002099FCF11DF69C884AEEB7F9FF48710F2540A9E805AB255DB71AE40DF61

Function 00F6A560 Relevance: 13.6, APIs: 9, Instructions: 100windowtimeCOMMON

Download Yara Rule

APIs

LoadBitmapW.USER32(?,000000AB), ref: 00F6A5A0
LoadBitmapW.USER32(?,000000A8), ref: 00F6A5BC
LoadBitmapW.USER32(?,000000A9), ref: 00F6A5D8
LoadBitmapW.USER32(?,000000AA), ref: 00F6A5F4
LoadBitmapW.USER32(?,000000A7), ref: 00F6A610
LoadBitmapW.USER32(?,00000098), ref: 00F6A62C
LoadBitmapW.USER32(?,000000AD), ref: 00F6A648
SendMessageA.USER32(?,00000172,00000000,?), ref: 00F6A688
SetTimer.USER32(?,0000002B,000001F4,00000000), ref: 00F6A69B

Part of subcall function 00F6A480: SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 00F6A4B6
Part of subcall function 00F6A480: SendMessageA.USER32(?,00000158,00000000,?), ref: 00F6A4E2
Part of subcall function 00F6A480: SendMessageA.USER32(?,0000014E,00000001,00000000), ref: 00F6A4FC
Part of subcall function 00F6A480: SendMessageA.USER32(?,00000405,00000001,?), ref: 00F6A518
Part of subcall function 00F6A480: SendMessageA.USER32(?,00000409,00000000,00000000), ref: 00F6A52A
Part of subcall function 00F6A480: SendMessageA.USER32(?,00000414,00000001,00000000), ref: 00F6A53C

Part of subcall function 00F69B10: SendMessageA.USER32(?,0000014B,00000000,00000000), ref: 00F69B4D
Part of subcall function 00F69B10: SendMessageA.USER32(?,00000143,00000000,00000010), ref: 00F69BBA
Part of subcall function 00F69B10: SendMessageA.USER32(?,0000014E,?,00000000), ref: 00F69C04

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: MessageSend$BitmapLoad$Timer
String ID:
API String ID: 3544907218-0
Opcode ID: ccb67fc24c9fd3e7be552b97b12c01beeeaa9db7276b9f9259ee09489549fc5e
Instruction ID: 2a5eb166efd196a630784d0f7f1221c2a840be33d5264604ed32b7eefe465f59
Opcode Fuzzy Hash: ccb67fc24c9fd3e7be552b97b12c01beeeaa9db7276b9f9259ee09489549fc5e
Instruction Fuzzy Hash: E9318DB53806006BE625F770CC5AEAB739CAF54710F15C45EF18A9B182DE7CA800DBA2

Function 00F8030D Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 115threadwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F8025B: GetParent.USER32(?), ref: 00F802AF
Part of subcall function 00F8025B: GetLastActivePopup.USER32(?), ref: 00F802C0
Part of subcall function 00F8025B: IsWindowEnabled.USER32(?), ref: 00F802D4
Part of subcall function 00F8025B: EnableWindow.USER32(?,00000000), ref: 00F802E7

EnableWindow.USER32(?,00000001), ref: 00F8035A
GetWindowThreadProcessId.USER32(?,?), ref: 00F8036E
GetCurrentProcessId.KERNEL32(?,00000000), ref: 00F80378
SendMessageA.USER32(?,00000376,00000000,00000000), ref: 00F80390
GetModuleFileNameA.KERNEL32(00000000,00000000,00000104,?,00000000), ref: 00F8040A
EnableWindow.USER32(00000000,00000001), ref: 00F8044F

Strings

0, xrefs: 00F803E5

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$Enable$Process$ActiveCurrentEnabledFileLastMessageModuleNameParentPopupSendThread
String ID: 0
API String ID: 1877664794-4108050209
Opcode ID: 7039c3c9e238cc132b96edbc4bc703cf00e3767fcfe6bb24026a9e7d7941b4c5
Instruction ID: b5687a7e29ebaf1f9037a946fcb804ee371ae0a153bd2532c4f7bd7338a1eb7b
Opcode Fuzzy Hash: 7039c3c9e238cc132b96edbc4bc703cf00e3767fcfe6bb24026a9e7d7941b4c5
Instruction Fuzzy Hash: BE41D132A0021C9BDB71AF64CC86BDEB7B8EF05720F500195F695E6284DBB09E849F90

Function 00FB8526 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100windowmemoryCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FB852D
SHGetSpecialFolderLocation.SHELL32(00000000,00000000,?,00000078), ref: 00FB8550

Part of subcall function 00F72127: __CxxThrowException@8.LIBCMT ref: 00F7213D
Part of subcall function 00F72127: __EH_prolog3.LIBCMT ref: 00F7214A

SHGetDesktopFolder.SHELL32(?), ref: 00FB8565
GlobalAlloc.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000040), ref: 00FB857A
SendMessageA.USER32 ref: 00FB8623
SendMessageA.USER32(?,00001102,00000002,00000000), ref: 00FB8630

Strings

g, xrefs: 00FB8573

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: FolderH_prolog3MessageSend$AllocDesktopException@8GlobalLocationSpecialThrow
String ID: g
API String ID: 2027722222-30677878
Opcode ID: d10efaa5145df7a74d8fb36f486028fb251d8d66b719ef67842c30e415c1d082
Instruction ID: 267bac60adecdd142bcfde00165cd151461ba002df65407fe7dbacd5c8b25094
Opcode Fuzzy Hash: d10efaa5145df7a74d8fb36f486028fb251d8d66b719ef67842c30e415c1d082
Instruction Fuzzy Hash: B7316D71A00216DFCB21DFA9CC89AEEBBF9FF88310F144569E545EB284DB759841DB10

Function 00FDC3A6 Relevance: 12.3, APIs: 8, Instructions: 331windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FDC3AD
IsWindowVisible.USER32(00000000), ref: 00FDC469
__EH_prolog3_GS.LIBCMT ref: 00FDC4C3
GetFocus.USER32 ref: 00FDC515
IsChild.USER32(?,?), ref: 00FDC53D
GetParent.USER32(?), ref: 00FDC73B
IsRectEmpty.USER32(?), ref: 00FDC7AB
RedrawWindow.USER32(?,00000000,00000000,00000105), ref: 00FDC81D

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$ChildEmptyFocusH_prolog3H_prolog3_ParentRectRedrawVisible
String ID:
API String ID: 937326129-0
Opcode ID: 262d473fd5d75f975978d70cd2f0476b2e7190f39a8db0ad2a6e368e85096090
Instruction ID: c41555593c091b8b4940f71401e6cb4338066948344ed7ebd5fc1a5a8ff01520
Opcode Fuzzy Hash: 262d473fd5d75f975978d70cd2f0476b2e7190f39a8db0ad2a6e368e85096090
Instruction Fuzzy Hash: 8AD1A431E006169FCB11DF64C884BEDB7E6BF08710F18416AE859AB395DB34AD41EF91

Function 00F6C310 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 66windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00F6C33A
PostMessageA.USER32(0000FFFF,0000C1D0,0000000D,00000000), ref: 00F6C34F

Part of subcall function 00F75613: _memset.LIBCMT ref: 00F756AC
Part of subcall function 00F75613: SendMessageA.USER32(00000000,00000405,00000000,?), ref: 00F756D5
Part of subcall function 00F75613: GetWindowLongA.USER32(00F6C35C,000000FC), ref: 00F756E7
Part of subcall function 00F75613: GetWindowLongA.USER32(00F6C35C,000000FC), ref: 00F756F8
Part of subcall function 00F75613: SetWindowLongA.USER32(00F6C35C,000000FC,?), ref: 00F75714

?EnableHotKey@@YGXH@Z.STRETCHHOOK(00000000), ref: 00F6C3B6

Strings

LastPrefsX, xrefs: 00F6C370
HotKey Enable, xrefs: 00F6C39F
Preferences, xrefs: 00F6C375, 00F6C38F, 00F6C3A4
LastPrefsY, xrefs: 00F6C38A

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$Long$Message$EnableKey@@PostRectSend_memset
String ID: HotKey Enable$LastPrefsX$LastPrefsY$Preferences
API String ID: 1062911976-3955191876
Opcode ID: cbb6cfa5932744f373594f8ecdad04c6f0c0834cb7c3a3004a335da394ae1c46
Instruction ID: b859fe1aa9779c075307339aa2ebf697e7fbb4d9d0f833018faf66d1fb93c58c
Opcode Fuzzy Hash: cbb6cfa5932744f373594f8ecdad04c6f0c0834cb7c3a3004a335da394ae1c46
Instruction Fuzzy Hash: 61119D70704205ABDB24EF99C845E7EB7F4BF98700F60815EF4C597344CAB559028BA1

Function 00FA400F Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FA4016
GetSysColorBrush.USER32(00000018), ref: 00FA402F
FillRect.USER32(00000000,?,00000000), ref: 00FA403B
GetSysColor.USER32(00000017), ref: 00FA4063
GetSysColor.USER32(00000017), ref: 00FA408D
GetSysColor.USER32(00000017), ref: 00FA4092

Strings

mmm, xrefs: 00FA405A

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Color$BrushFillH_prolog3Rect
String ID: mmm
API String ID: 24942539-1545505134
Opcode ID: f6215824aae116fee9048bcdaeacab95512dbe4f07e10b6bfaed98654d307204
Instruction ID: 50e2c92ff4cdd4c9ed4fc5b6d21f4e727ad3d035eb999fb45bd49e714ea582c5
Opcode Fuzzy Hash: f6215824aae116fee9048bcdaeacab95512dbe4f07e10b6bfaed98654d307204
Instruction Fuzzy Hash: 9D1121712002499FCB10EFA4CC88EAE77A9FF88710F154518FA96CB395CB74AD40DBA1

Function 00F8A6A4 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00F8A6C6
_strlen.LIBCMT ref: 00F8A6CC
_strcpy_s.LIBCMT ref: 00F8A6E5
GetDC.USER32(00000000), ref: 00F8A6FB
EnumFontFamiliesExA.GDI32(00000000,00F8A7C0,00F8A662,?,00000000), ref: 00F8A716
ReleaseDC.USER32(00000000,00000000), ref: 00F8A71E

Part of subcall function 00F72127: __CxxThrowException@8.LIBCMT ref: 00F7213D
Part of subcall function 00F72127: __EH_prolog3.LIBCMT ref: 00F7214A

Strings

MS UI Gothic, xrefs: 00F8A6CB, 00F8A6DE

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: EnumException@8FamiliesFontH_prolog3ReleaseThrow_memset_strcpy_s_strlen
String ID: MS UI Gothic
API String ID: 820125098-1905310704
Opcode ID: 52412cf714ab82f750e776bbeda255b26696e6abaf482912c1a042c71449ca0d
Instruction ID: 79a495863ce74248a182651a04ded9df205133b1ca79ee11e247ab0fa02ddfff
Opcode Fuzzy Hash: 52412cf714ab82f750e776bbeda255b26696e6abaf482912c1a042c71449ca0d
Instruction Fuzzy Hash: 6101C472900218EBD721EBA49C49DEF7BBCEB49750F140055F445E3244DB69AA02D7B6

Function 00FF61D2 Relevance: 12.1, APIs: 8, Instructions: 149windowCOMMON

Download Yara Rule

APIs

ReleaseCapture.USER32 ref: 00FF6202
IsWindow.USER32(?), ref: 00FF6223
DestroyWindow.USER32(?), ref: 00FF6233
GetParent.USER32(?), ref: 00FF624F
IsRectEmpty.USER32(?), ref: 00FF62FB
IsWindowVisible.USER32(?), ref: 00FF633D
MapWindowPoints.USER32(?,?,?,00000001), ref: 00FF6354
SendMessageA.USER32(?,00000202,?,?), ref: 00FF6373

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$CaptureDestroyEmptyMessageParentPointsRectReleaseSendVisible
String ID:
API String ID: 3509494761-0
Opcode ID: dbee9ba0966cb098b148c8d9f8b6c4dbdf200ca5f9c84b2e1810f3bf4816fa4e
Instruction ID: 272a4f866e7b54392f0b61ec17d7e3b50a743df1d9d5e537919a3918cd520c1e
Opcode Fuzzy Hash: dbee9ba0966cb098b148c8d9f8b6c4dbdf200ca5f9c84b2e1810f3bf4816fa4e
Instruction Fuzzy Hash: 4C519F316042059BDF119F64C899BBE37B6AF45311F0800B8FA4ADF2AADF75D844DB61

Function 00FA6515 Relevance: 12.1, APIs: 8, Instructions: 138windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FA651C
IsWindowVisible.USER32(?), ref: 00FA6575
CreateRectRgn.GDI32(00000000,00000000,?,?), ref: 00FA65AB
CreateRectRgn.GDI32(00000000,00000000,00000005,00000005), ref: 00FA65C6
CreateEllipticRgn.GDI32(00000000,00000000,0000000B,0000000B,00000000), ref: 00FA65F1
CreateRectRgn.GDI32(?,00000000,?,00000005), ref: 00FA6625
CreateEllipticRgn.GDI32(?,00000000,?,0000000B,00000000), ref: 00FA6658

Part of subcall function 00F83B45: CombineRgn.GDI32(?,?,?,?), ref: 00F83B6A

SetWindowRgn.USER32(?,00000000,00000001), ref: 00FA668A

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Create$Rect$EllipticWindow$CombineH_prolog3Visible
String ID:
API String ID: 2498130849-0
Opcode ID: 1bb3e2643095fa8fde907d08e1bf003e4c321416da52ac35c6fcaa3824729290
Instruction ID: 2394c9f8a1b3b27c027b8a354a9ae8135bebd0d75293438a4c01a73d62509b81
Opcode Fuzzy Hash: 1bb3e2643095fa8fde907d08e1bf003e4c321416da52ac35c6fcaa3824729290
Instruction Fuzzy Hash: 5E517FB194020AABDB11EBA0CD95EEFB778BF14700F10416AB156A71D1EB385A04DBA1

Function 00F900FD Relevance: 12.1, APIs: 8, Instructions: 124windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F90104
SendMessageA.USER32(?,00000010,00000000,00000000), ref: 00F9013A
GetParent.USER32(?), ref: 00F9015F
GetTopWindow.USER32(?), ref: 00F90219
GetWindow.USER32(?,00000002), ref: 00F90237
IsWindow.USER32(?), ref: 00F90257
GetParent.USER32(?), ref: 00F90264
DestroyWindow.USER32(?,?,00000020), ref: 00F90272

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$Parent$DestroyH_prolog3MessageSend
String ID:
API String ID: 3234442123-0
Opcode ID: a2ea43cf334fc06b80ee9b3a928c79a0d5c7ca2e05142b6d10e8e3dac8c5aa08
Instruction ID: f93d79bf32555416ecebce32c385757eee8bf5290a66d6c4aa3129b8a1171b68
Opcode Fuzzy Hash: a2ea43cf334fc06b80ee9b3a928c79a0d5c7ca2e05142b6d10e8e3dac8c5aa08
Instruction Fuzzy Hash: F3417171A00601DFDF25AFA4CC85AAEB7B5FF48310F54442DE29AA7251DF34AD80EB50

Function 00FC6341 Relevance: 12.1, APIs: 8, Instructions: 104windowstringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,00000001,?,00000000), ref: 00FC6357
_memset.LIBCMT ref: 00FC6373
GetFocus.USER32 ref: 00FC637B

Part of subcall function 00F7557A: UnhookWindowsHookEx.USER32(?), ref: 00F755AA

IsWindowEnabled.USER32(00000005), ref: 00FC63B0
EnableWindow.USER32(00000005,00000000), ref: 00FC63CC
EnableWindow.USER32(00000000,00000001), ref: 00FC645F
IsWindow.USER32(?), ref: 00FC6464
SetFocus.USER32(?), ref: 00FC6471

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$EnableFocus$EnabledHookUnhookWindows_memsetlstrlen
String ID:
API String ID: 3424750955-0
Opcode ID: e23e50de584a0973edff76d8182e4a2833316842b46f8c3ffdf8e8dfcb783fe7
Instruction ID: 2d0700ea63f63a38771a73d36702fdf7b1c74ce79c02dffaa2ef7dd653f2bbbd
Opcode Fuzzy Hash: e23e50de584a0973edff76d8182e4a2833316842b46f8c3ffdf8e8dfcb783fe7
Instruction Fuzzy Hash: 3641BF31604601DFDB24DF74CA46F5ABBA5EF44314F24846DE58A8B256CB35E806EB81

Function 00FC450D Relevance: 12.1, APIs: 8, Instructions: 102windowtimeCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00FC45A7
SendMessageA.USER32(?,00000111,?,?), ref: 00FC45D5
IsWindow.USER32(?), ref: 00FC45E4
RedrawWindow.USER32(?,00000000,00000000,00000105,?,?,?,?,?,00FBE234,?,?,?), ref: 00FC45F4
IsWindow.USER32(?), ref: 00FC4604
ReleaseCapture.USER32 ref: 00FC4612
KillTimer.USER32(?,00000001,?,?,?,?,?,00FBE234,?,?,?), ref: 00FC462B
SendMessageA.USER32(?,0000041C,00000000,00000000), ref: 00FC464A

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$MessageSend$CaptureKillParentRedrawReleaseTimer
String ID:
API String ID: 3014619129-0
Opcode ID: c1ae3badc824e640d709b6e831a64aa8a17258fc0552765d78f8f31d880b8064
Instruction ID: 9875d79941feb39532846ea859faf1d6808447d335610b447ab95c7fcc9e2ca6
Opcode Fuzzy Hash: c1ae3badc824e640d709b6e831a64aa8a17258fc0552765d78f8f31d880b8064
Instruction Fuzzy Hash: 16317E70910B01DBCB319B34C956FABFAE5FB85711F28492EE1DA81108E771A840EB11

Function 00FC633C Relevance: 12.1, APIs: 8, Instructions: 93windowstringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,00000001,?,00000000), ref: 00FC6357
_memset.LIBCMT ref: 00FC6373
GetFocus.USER32 ref: 00FC637B

Part of subcall function 00F7557A: UnhookWindowsHookEx.USER32(?), ref: 00F755AA

IsWindowEnabled.USER32(00000005), ref: 00FC63B0
EnableWindow.USER32(00000005,00000000), ref: 00FC63CC
EnableWindow.USER32(00000000,00000001), ref: 00FC645F
IsWindow.USER32(?), ref: 00FC6464
SetFocus.USER32(?), ref: 00FC6471

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$EnableFocus$EnabledHookUnhookWindows_memsetlstrlen
String ID:
API String ID: 3424750955-0
Opcode ID: cd6fe3a44515c64299f4a1e5446c2f10ed1d2cd0b3410b4d3b0ecfd3bddf7a9e
Instruction ID: 9955708932a241fd92d2ef40f01e79683a3bb74d38f37994e6bd116f22c65237
Opcode Fuzzy Hash: cd6fe3a44515c64299f4a1e5446c2f10ed1d2cd0b3410b4d3b0ecfd3bddf7a9e
Instruction Fuzzy Hash: 9F319E30A04601DFDB249F74CA85F5ABBB5FF44304F24846DE58A9B256CB75E806EB80

Function 00FE0274 Relevance: 10.7, APIs: 7, Instructions: 246COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FE027E
GetParent.USER32(?), ref: 00FE0331
SetWindowRgn.USER32(?,00000000,00000001), ref: 00FE0421
GetWindowRect.USER32(?,?), ref: 00FE0473
OffsetRect.USER32(?,?,?), ref: 00FE04AB
CreateRectRgn.GDI32(?,?,?,?), ref: 00FE04C8
SetWindowRgn.USER32(?,00000000,00000001), ref: 00FE04DF

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: RectWindow$CreateH_prolog3_OffsetParent
String ID:
API String ID: 1438117353-0
Opcode ID: c0df1edd54a64f9fb0337ed6e61743ad2511cb7d091eb2ef6e9d92204a473b69
Instruction ID: a4784f40add14c36a2483e93094e2bcbbc2dec6e911fe0e5d398af5f83cca3fd
Opcode Fuzzy Hash: c0df1edd54a64f9fb0337ed6e61743ad2511cb7d091eb2ef6e9d92204a473b69
Instruction Fuzzy Hash: B5A11371D00219DFCB11DFA8C984AEDBBB2BF08310F24416AE945EB295DBB5AD81DF50

Function 0100C020 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 226windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0100C027
CreateCompatibleDC.GDI32(?), ref: 0100C105
CreateCompatibleBitmap.GDI32(00000001,?,?), ref: 0100C139
SelectObject.GDI32(?,00000000), ref: 0100C196
DeleteObject.GDI32(?), ref: 0100C29D

Strings

@Ls Fs, xrefs: 0100C105

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: CompatibleCreateObject$BitmapDeleteH_prolog3Select
String ID: @Ls Fs
API String ID: 3587968642-1589975592
Opcode ID: 0f3142bc23fba68033ae3977ddcb51e360026f1eb8e2ae89cbe62ab723569e4c
Instruction ID: c632efe7851ee832c2ff04f85b5ea4bda20068dfa5020aa99a708729e4c746de
Opcode Fuzzy Hash: 0f3142bc23fba68033ae3977ddcb51e360026f1eb8e2ae89cbe62ab723569e4c
Instruction Fuzzy Hash: D9A13C71D0021ADFEF15CFE8CA849EDBBB5BF48300F14826AE955A7295D7349A05CF90

Function 00F6A6B0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 166windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00F6A720
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00F6A731
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00F6A750
GetModuleHandleA.KERNEL32(StretchRes,00000001,?,?), ref: 00F6A7A5
SendMessageA.USER32(?,000000F0,00000000,00000000), ref: 00F6A830

Strings

StretchRes, xrefs: 00F6A7A0

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: MessageSend$HandleModule
String ID: StretchRes
API String ID: 1411696585-621865559
Opcode ID: 6b1ff038cf2accf7315c817f09c73fdfb3f5ecf256fad7365fbaf3fcf4d9a901
Instruction ID: c191a5dc460967feea47a4f746f66db6e51b995a6cad7fc7e592e91f987e3e14
Opcode Fuzzy Hash: 6b1ff038cf2accf7315c817f09c73fdfb3f5ecf256fad7365fbaf3fcf4d9a901
Instruction Fuzzy Hash: 8C51B271600606AFD714DB78CC52FAEB3A8EF85320F14836DF125EB2D1DB75A9019B91

Function 00FCE22F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

MonitorFromPoint.USER32(?,?,00000002), ref: 00FCE311
GetMonitorInfoA.USER32(00000000), ref: 00FCE318
CopyRect.USER32(?,?), ref: 00FCE32A
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00FCE33A
IntersectRect.USER32(?,?,?), ref: 00FCE36D

Strings

(, xrefs: 00FCE30A

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: InfoMonitorRect$CopyFromIntersectParametersPointSystem
String ID: (
API String ID: 2931574886-3887548279
Opcode ID: d1e595a99cfd4a7adc323a859d18126265de2f3b31c0e71eb2eeb7b9d1739e2f
Instruction ID: 7740dbb9cca5f28f59a089897ed582711bb7118b07358f4c699dbabc97bf7b2c
Opcode Fuzzy Hash: d1e595a99cfd4a7adc323a859d18126265de2f3b31c0e71eb2eeb7b9d1739e2f
Instruction Fuzzy Hash: 305104B5D0020A9FCB20CFA9C989AAEFBF9FF58310F10851EE455E7250D734AA04CB61

Function 00FF8177 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FF817E

Part of subcall function 00F85BF1: __EH_prolog3.LIBCMT ref: 00F85BF8
Part of subcall function 00F85BF1: LoadCursorA.USER32(00000000,00007F00), ref: 00F85C24
Part of subcall function 00F85BF1: GetClassInfoA.USER32(?,00000000,?), ref: 00F85C68

CopyRect.USER32(?,?), ref: 00FF8232

Part of subcall function 00F7E5D4: ClientToScreen.USER32(?,?), ref: 00F7E5E5
Part of subcall function 00F7E5D4: ClientToScreen.USER32(?,?), ref: 00F7E5F2

IsRectEmpty.USER32(?), ref: 00FF824B
IsRectEmpty.USER32(?), ref: 00FF8263
IsRectEmpty.USER32(?), ref: 00FF8278

Strings

Afx:ControlBar, xrefs: 00FF81AD

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Rect$Empty$ClientScreen$ClassCopyCursorH_prolog3H_prolog3_InfoLoad
String ID: Afx:ControlBar
API String ID: 2202805320-4244778371
Opcode ID: 0900cc7b64b11a53096a306eae15678c1f6caa16d991d7beb6c5417e61a61098
Instruction ID: f9f6f7f800ef09e54bb87592d827595950a5af80dc946e69a7ad9d2b7e26d892
Opcode Fuzzy Hash: 0900cc7b64b11a53096a306eae15678c1f6caa16d991d7beb6c5417e61a61098
Instruction Fuzzy Hash: A7418D329006189BCF01DFA4CC84BEE77B9BF49350F080168FD45BB255DB79A906EB60

Function 00FBE294 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 89COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FBE29B

Part of subcall function 00F89998: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 00F899BB

Part of subcall function 00FB5EED: __EH_prolog3.LIBCMT ref: 00FB5EF4

Part of subcall function 00F89927: __EH_prolog3.LIBCMT ref: 00F8992E

Strings

MFCMenuButton_StayPressed, xrefs: 00FBE31B
MFCMenuButton_Autosize, xrefs: 00FBE35F
MFCMenuButton_DefaultClick, xrefs: 00FBE33D
MFCMenuButton_RightArrow, xrefs: 00FBE2F9
MFCMenuButton_OSMenu, xrefs: 00FBE2D3

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: H_prolog3$ByteCharMultiWide
String ID: MFCMenuButton_Autosize$MFCMenuButton_DefaultClick$MFCMenuButton_OSMenu$MFCMenuButton_RightArrow$MFCMenuButton_StayPressed
API String ID: 2949695960-2044485435
Opcode ID: 1614fb2c6147339918d5d56a7185027de24e2eba4360e1ad2dbc763e7f87f2b4
Instruction ID: c2bcaa95d48a7b48b27dac0387beacfb166b76f958ecc4b6e83246f39642120a
Opcode Fuzzy Hash: 1614fb2c6147339918d5d56a7185027de24e2eba4360e1ad2dbc763e7f87f2b4
Instruction Fuzzy Hash: AB31D671D0420A9EDF00EFE5CD81AEEB7F8AF08310F44452AE565F7241DB78EA059B60

Function 010064C5 Relevance: 10.6, APIs: 7, Instructions: 78COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 010064CC

Part of subcall function 01006413: __EH_prolog3.LIBCMT ref: 0100641A
Part of subcall function 01006413: GetProfileIntA.KERNEL32(windows,DragMinDist,00000002), ref: 01006472
Part of subcall function 01006413: GetProfileIntA.KERNEL32(windows,DragDelay,000000C8), ref: 01006484

CopyRect.USER32(?,?), ref: 010064FA
GetCursorPos.USER32(?), ref: 0100650C
SetRect.USER32(?,?,?,?,?), ref: 01006522
IsRectEmpty.USER32(?), ref: 0100653D
InflateRect.USER32(?,00000002,00000002), ref: 0100654F
DoDragDrop.OLE32(00000000,00000000,?,00000000), ref: 010065A6

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Rect$Profile$CopyCursorDragDropEmptyH_prolog3H_prolog3_Inflate
String ID:
API String ID: 1837043813-0
Opcode ID: deb95d73bf1f3c99186604b040eec3cd86d5f68bf7713be6eaeb2defd9f82bff
Instruction ID: 29e14a0b14871ec69dcce1c51668f56a2897ec7fc3fce6e83f9d0497ad20bc62
Opcode Fuzzy Hash: deb95d73bf1f3c99186604b040eec3cd86d5f68bf7713be6eaeb2defd9f82bff
Instruction Fuzzy Hash: 06217131904214DBDF12EFE4CC889EEB7BABF44701F100018E592EB288EB76A915DB50

Function 00F8440D Relevance: 10.6, APIs: 7, Instructions: 73COMMON

Download Yara Rule

APIs

RealChildWindowFromPoint.USER32(?,?,?), ref: 00F84432
ClientToScreen.USER32(?,?), ref: 00F84451
GetWindow.USER32(?,00000005), ref: 00F844B4

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$ChildClientFromPointRealScreen
String ID:
API String ID: 2518355518-0
Opcode ID: e229f9d8294f8788bf2b5c6e902c53a585b0b4565819ce124ec6fea510a76339
Instruction ID: 59442fa8d464255f2f21e9bee206d4d82b6f0cf22ab41549a6cca3003ac320d4
Opcode Fuzzy Hash: e229f9d8294f8788bf2b5c6e902c53a585b0b4565819ce124ec6fea510a76339
Instruction Fuzzy Hash: BE214172D1151AAFDB10EFA4DC44BFE77B8FF18321F104119E951E2148D778AA05DBA1

Function 00FEE3C7 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

SelectObject.GDI32(?,00000000), ref: 00FEE3ED

Part of subcall function 00F84212: DeleteObject.GDI32(00000000), ref: 00F8422B

SelectObject.GDI32(?,00000000), ref: 00FEE403
DeleteObject.GDI32(00000000), ref: 00FEE46E
DeleteDC.GDI32(00000000), ref: 00FEE47D
LeaveCriticalSection.KERNEL32(010D52DC), ref: 00FEE496

Strings

, xrefs: 00FEE41E

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Object$Delete$Select$CriticalLeaveSection
String ID:
API String ID: 3849354926-3916222277
Opcode ID: e4a90330b65d499b4c5192d27624cffa0f5b24ae3e598fe800cd47f04e5ba0cc
Instruction ID: e0121c0d3b6fe9062d56cb95e96bed01dc65ca69a4005ad259377a01b85bf1cf
Opcode Fuzzy Hash: e4a90330b65d499b4c5192d27624cffa0f5b24ae3e598fe800cd47f04e5ba0cc
Instruction Fuzzy Hash: E021BD35900204DFCF21EF69EC808AE7BB5FF85320B1481A6FD589B16AC7759845EF90

Function 00F746D3 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 53libraryloaderCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F746DA
GetProcAddress.KERNEL32(00000000,RegisterTouchWindow), ref: 00F74737
GetProcAddress.KERNEL32(UnregisterTouchWindow), ref: 00F74759

Part of subcall function 00F7428C: ActivateActCtx.KERNEL32(?,?,010BAEA0,00000010,00F74703,user32.dll,?,?,?,00000000,00F7560A,00000000,00000000,?,?,00F692FE), ref: 00F742AC

Strings

user32.dll, xrefs: 00F746F9
RegisterTouchWindow, xrefs: 00F74731
UnregisterTouchWindow, xrefs: 00F7474E

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: AddressProc$ActivateH_prolog3
String ID: RegisterTouchWindow$UnregisterTouchWindow$user32.dll
API String ID: 1001276555-2470269259
Opcode ID: d9d20c01840b2fb5f28106cdf50399ab9d49dde096551a1fb5b9bf2a5d99db56
Instruction ID: fb6e8deccd2999a3642aebe188b188a7417f6ec784d929792cc0129b1e99efa9
Opcode Fuzzy Hash: d9d20c01840b2fb5f28106cdf50399ab9d49dde096551a1fb5b9bf2a5d99db56
Instruction Fuzzy Hash: AD11B230A013019FDB28EB24F94571D3BE8BB15324F10896EE8CCC2198C77AA951DF51

Function 00FAE0C7 Relevance: 9.2, APIs: 6, Instructions: 221COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00FAE0F9

Part of subcall function 00F79606: GetWindowLongA.USER32(00000407,000000EC), ref: 00F79611

GetWindowRect.USER32(?,?), ref: 00FAE1F4
GetParent.USER32(?), ref: 00FAE201
GetParent.USER32(?), ref: 00FAE21B
OffsetRect.USER32(?,?,?), ref: 00FAE2E8
OffsetRect.USER32(?,?,?), ref: 00FAE2F4

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Rect$Window$OffsetParent$Long
String ID:
API String ID: 2171155602-0
Opcode ID: 285e55035d4d51fb9094ec368964515535c89a766a5f25627f743f00e6e0ea0a
Instruction ID: 2e6cefdd09ef6e3dec809b9762a58fb8861d18f4be9b471c927114df0f9dfed3
Opcode Fuzzy Hash: 285e55035d4d51fb9094ec368964515535c89a766a5f25627f743f00e6e0ea0a
Instruction Fuzzy Hash: 5C91CFB5D00209EFCF15DFA8C988AEEBBF5FF49300F24456AE945A7250D7346A41DB60

Function 00FDE37A Relevance: 9.2, APIs: 6, Instructions: 208windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FDE381

Part of subcall function 00F72127: __CxxThrowException@8.LIBCMT ref: 00F7213D
Part of subcall function 00F72127: __EH_prolog3.LIBCMT ref: 00F7214A

Part of subcall function 00F76CFA: GetParent.USER32(?), ref: 00F76D04

SendMessageA.USER32(?,?,00000000,00000000), ref: 00FDE4B0

Part of subcall function 00FA79A0: __EH_prolog3_catch.LIBCMT ref: 00FA79AA
Part of subcall function 00FA79A0: CloseHandle.KERNEL32(?,?,?,00000080), ref: 00FA79E3
Part of subcall function 00FA79A0: GetTempPathA.KERNEL32(00000104,00000000,00000104,00000000,?,?,00000080), ref: 00FA7A0A
Part of subcall function 00FA79A0: GetTempFileNameA.KERNEL32(?,AFX,00000000,00000000,00000104,00000000,000000FF), ref: 00FA7A41
Part of subcall function 00FA79A0: CreateFileA.KERNEL32(?,C0000000,00000000,00000000,00000002,04000100,00000000,000000FF), ref: 00FA7A63

SendMessageA.USER32(?,00000366,00000000,00000000), ref: 00FDE563
SendMessageA.USER32(?,0000C13F,?,00000000), ref: 00FDE581
InvalidateRect.USER32(?,00000000,00000001), ref: 00FDE5F6
UpdateWindow.USER32(?), ref: 00FDE5FF

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: MessageSend$FileH_prolog3Temp$CloseCreateException@8H_prolog3_catchHandleInvalidateNameParentPathRectThrowUpdateWindow
String ID:
API String ID: 88766659-0
Opcode ID: 3a9d3b2cecc7a7aa263e88d9c0499db0517c914e2e980fcdfa285385a09f6203
Instruction ID: 00f47ce43bf9b59750c61eedead6521ebd9e3f6429c6c64d9e390ddcba6a5170
Opcode Fuzzy Hash: 3a9d3b2cecc7a7aa263e88d9c0499db0517c914e2e980fcdfa285385a09f6203
Instruction Fuzzy Hash: 5E7192746006009FCF25AF64CC44EAE7BB6FF88750F18452AF98A8B355DF359940EB51

Function 00FB6594 Relevance: 9.2, APIs: 6, Instructions: 202windowCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FB659B
GetClientRect.USER32(?,?), ref: 00FB65E1

Part of subcall function 00F7E7F8: __EH_prolog3.LIBCMT ref: 00F7E7FF
Part of subcall function 00F7E7F8: GetDC.USER32(00000000), ref: 00F7E82B

Part of subcall function 00F7EB1F: SelectObject.GDI32(?,00000000), ref: 00F7EB45
Part of subcall function 00F7EB1F: SelectObject.GDI32(?,?), ref: 00F7EB5B

SendMessageA.USER32(?,00000030,?,00000000), ref: 00FB6632
GetTextMetricsA.GDI32(?,?), ref: 00FB663F
GetParent.USER32(?), ref: 00FB6724
SendMessageA.USER32(?,00000030,?,00000000), ref: 00FB674F

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: MessageObjectSelectSend$ClientH_prolog3H_prolog3_MetricsParentRectText
String ID:
API String ID: 1207058154-0
Opcode ID: d5c1fb663a23f67a3c88a7956edbbe93019115415404e8e022d9c5214e1a06a6
Instruction ID: 6e89a67d59ce7aad126b1e2f2e894d246f91d3c159ca94b2acc1fe32e1bfa114
Opcode Fuzzy Hash: d5c1fb663a23f67a3c88a7956edbbe93019115415404e8e022d9c5214e1a06a6
Instruction Fuzzy Hash: 4871B032A001159BCF15DFA9CC95EEE77B6BF48710F258169E91AEB245CB34AC01DF50

Function 00F98088 Relevance: 9.2, APIs: 6, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7b90f69574188ed4ccd910cbac7f4a21fdb42999d951508a7f806b8138c2593
Instruction ID: b00815110056b00ac3e43604e5c0a7d75a301f4291050ed6fe0a4463cf0c4bc4
Opcode Fuzzy Hash: c7b90f69574188ed4ccd910cbac7f4a21fdb42999d951508a7f806b8138c2593
Instruction Fuzzy Hash: E951AD31700A00AFEF259F64CC88B6A77E5AF49750F144569F946CB2A1DF74ED42EB10

Function 00FC648E Relevance: 9.1, APIs: 6, Instructions: 144windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC6495
CoTaskMemFree.OLE32(?,000000FF), ref: 00FC653B
GetParent.USER32(?), ref: 00FC65B4
SendMessageA.USER32(?,00000464,00000104,?), ref: 00FC65C8
GetParent.USER32(?), ref: 00FC65FB
SendMessageA.USER32(?,00000465,00000104,?), ref: 00FC660F

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: MessageParentSend$FreeH_prolog3Task
String ID:
API String ID: 526180827-0
Opcode ID: f7d30f0a9ad631d1affafdef87dc1c5b4a2ee1b95b192761d3c31979cf53f7c2
Instruction ID: 3125f627118828b27291cb1791c5068c6b4289a9c8edb74cb708dcc477bd5452
Opcode Fuzzy Hash: f7d30f0a9ad631d1affafdef87dc1c5b4a2ee1b95b192761d3c31979cf53f7c2
Instruction Fuzzy Hash: 2E517CB1A0411AAFCF04EFA0CD56EAEB774FF44320F244619F565E7291DB38A941EB90

Function 00FBA53A Relevance: 9.1, APIs: 6, Instructions: 137windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00FBA599
SendMessageA.USER32(?,00001204,00000000,00000001), ref: 00FBA5DB
SendMessageA.USER32(?,00001204,00000001,00000001), ref: 00FBA5FD
SendMessageA.USER32(?,00000201,00000000,00000000), ref: 00FBA677
SendMessageA.USER32(?,00000202,00000000,00000000), ref: 00FBA68F
PtInRect.USER32(?,?,?), ref: 00FBA6AB

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: MessageSend$Rect$Client
String ID:
API String ID: 4194289498-0
Opcode ID: e740ab85761e2bfd54a9917ab34659966bff077fbdd266a67b0a5d490547bb12
Instruction ID: 7cc683b1a25cb8f85b57bed58fdf3986b83b1799ad6604d8364e1af46a824d34
Opcode Fuzzy Hash: e740ab85761e2bfd54a9917ab34659966bff077fbdd266a67b0a5d490547bb12
Instruction Fuzzy Hash: 4D516CB1900219DFCF11DF65C988EDE7BBAFF48710F1840A9E8089B265CB71A941DFA1

Function 00F6A480 Relevance: 9.1, APIs: 6, Instructions: 73windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F6A240: GetModuleHandleA.KERNEL32(StretchRes), ref: 00F6A2CD
Part of subcall function 00F6A240: FindResourceA.KERNEL32(00000000,soundlist,0000000A), ref: 00F6A2DD
Part of subcall function 00F6A240: SizeofResource.KERNEL32(00000000,00000000), ref: 00F6A2F0
Part of subcall function 00F6A240: LoadResource.KERNEL32(00000000,?), ref: 00F6A2FE
Part of subcall function 00F6A240: LockResource.KERNEL32(00000000), ref: 00F6A30D

Part of subcall function 00F677C0: waveOutGetDevCapsA.WINMM(000000FF,?,00000034,?,?,?,?,?,?,?,?,?,?,16B3F121,?), ref: 00F677EB

SendMessageA.USER32(?,000000F1,00000000,00000000), ref: 00F6A4B6

Part of subcall function 00F79785: EnableWindow.USER32(?,?), ref: 00F79796

SendMessageA.USER32(?,00000158,00000000,?), ref: 00F6A4E2
SendMessageA.USER32(?,0000014E,00000001,00000000), ref: 00F6A4FC
SendMessageA.USER32(?,00000405,00000001,?), ref: 00F6A518
SendMessageA.USER32(?,00000409,00000000,00000000), ref: 00F6A52A
SendMessageA.USER32(?,00000414,00000001,00000000), ref: 00F6A53C

Part of subcall function 00F79511: GetDlgItem.USER32(?,?), ref: 00F79522

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: MessageSend$Resource$CapsEnableFindHandleItemLoadLockModuleSizeofWindowwave
String ID:
API String ID: 1152401390-0
Opcode ID: b34757f05abda99e63fc34f47bb980eb66607dfe6b07e33c3f753fb3ca859308
Instruction ID: bce85ccde018ee57fd7bd44148b93d6648544cd13685ea6fa1a95696fc831135
Opcode Fuzzy Hash: b34757f05abda99e63fc34f47bb980eb66607dfe6b07e33c3f753fb3ca859308
Instruction Fuzzy Hash: C41160713907007AF635A634DC47FEE729A9FC4B00F018519B746AF1C5D9E9B9408A55

Function 00F8025B Relevance: 9.1, APIs: 6, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 00F8028E
GetParent.USER32(?), ref: 00F8029C
GetParent.USER32(?), ref: 00F802AF
GetLastActivePopup.USER32(?), ref: 00F802C0
IsWindowEnabled.USER32(?), ref: 00F802D4
EnableWindow.USER32(?,00000000), ref: 00F802E7

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$Parent$ActiveEnableEnabledLastLongPopup
String ID:
API String ID: 670545878-0
Opcode ID: 94000e49f080cb04b7ae8b2db6c7e8a48616174aa13cb050c3b898b60cd78bd2
Instruction ID: 2b5a4ce3965fca8798ad6cb29a0921a5684d6160923bc315c82bc5c9990ffbae
Opcode Fuzzy Hash: 94000e49f080cb04b7ae8b2db6c7e8a48616174aa13cb050c3b898b60cd78bd2
Instruction Fuzzy Hash: F511BF32A452319BCBF236699C8CBAE7698AF55B70F950124EC40E7208DFB4CC08A3D4

Function 00F84375 Relevance: 9.1, APIs: 6, Instructions: 56COMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00F84391
GetDlgCtrlID.USER32(00000000), ref: 00F843A2
GetWindowLongA.USER32(00000000,000000F0), ref: 00F843B2
GetWindowRect.USER32(00000000,00000000), ref: 00F843D4
PtInRect.USER32(00000000,00000000,00000000), ref: 00F843E4
GetWindow.USER32(?,00000005), ref: 00F843F1

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$Rect$ClientCtrlLongScreen
String ID:
API String ID: 1315500227-0
Opcode ID: b2369cc6227145e80bf06a7069db9f4fc1d0404663c7324446e7d9589b9c079d
Instruction ID: 00e53f5f35a7b751370255de431f6a94c175a7bc3b3fb0839c71a24fd6e34004
Opcode Fuzzy Hash: b2369cc6227145e80bf06a7069db9f4fc1d0404663c7324446e7d9589b9c079d
Instruction Fuzzy Hash: CC11863290151AABDB21EF54DC48BEE77B8FF54326F214055F851E2084DB78AA05EBA1

Function 00F844CF Relevance: 9.1, APIs: 6, Instructions: 52windowCOMMON

Download Yara Rule

APIs

GetFocus.USER32 ref: 00F844D5
GetParent.USER32(00000000), ref: 00F844FD

Part of subcall function 00F842C2: GetWindowLongA.USER32(?,000000F0), ref: 00F842E3
Part of subcall function 00F842C2: GetClassNameA.USER32(?,?,0000000A), ref: 00F842F8
Part of subcall function 00F842C2: CompareStringA.KERNEL32(00000409,00000001,?,000000FF,combobox,000000FF), ref: 00F84312

GetWindowLongA.USER32(?,000000F0), ref: 00F84518
GetParent.USER32(?), ref: 00F84526
GetDesktopWindow.USER32 ref: 00F8452A
SendMessageA.USER32(00000000,0000014F,00000000,00000000), ref: 00F8453E

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$LongParent$ClassCompareDesktopFocusMessageNameSendString
String ID:
API String ID: 1233893325-0
Opcode ID: 5604237e17f5b984c9f5918a90345783cd4eb48487a24cbffec1176992ec78da
Instruction ID: 04c62a4e83b5de9a2bc48d827c11139673112cc4f43c4ac76003488701a2c296
Opcode Fuzzy Hash: 5604237e17f5b984c9f5918a90345783cd4eb48487a24cbffec1176992ec78da
Instruction Fuzzy Hash: 9301D632A4421227D73136399CC8FBE759C9B86B70F2C0124FA41AF189DF39ED01A760

Function 00FCC415 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 294keyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00F79606: GetWindowLongA.USER32(00000407,000000EC), ref: 00F79611

GetClientRect.USER32(?,?), ref: 00FCC540
GetAsyncKeyState.USER32(00000011), ref: 00FCC5E6

Strings

', xrefs: 00FCC491

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: AsyncClientLongRectStateWindow
String ID: '
API String ID: 304971295-1997036262
Opcode ID: 0c7b854f5dba6d281b9b0de695ba3b0a1dafc4e66c26ba1c6948aa09f5f8462e
Instruction ID: 63e6b020f024bcd0f8c5ae3c06cb771b7b461e64ec46544a5677d302b5d23d67
Opcode Fuzzy Hash: 0c7b854f5dba6d281b9b0de695ba3b0a1dafc4e66c26ba1c6948aa09f5f8462e
Instruction Fuzzy Hash: A6B15B30B006079BCB29DF64CAA6FBD77E1AF44310F14416EE54A9B290DB749D81EBC1

Function 00FBA370 Relevance: 9.0, APIs: 6, Instructions: 43COMMON

Download Yara Rule

APIs

GetCapture.USER32 ref: 00FBA397
ReleaseCapture.USER32 ref: 00FBA39D
GetCapture.USER32 ref: 00FBA3C2
ReleaseCapture.USER32 ref: 00FBA3C8
GetCapture.USER32 ref: 00FBA3D1
ReleaseCapture.USER32 ref: 00FBA3D7

Part of subcall function 00FB9D95: __EH_prolog3_GS.LIBCMT ref: 00FB9D9C
Part of subcall function 00FB9D95: IsRectEmpty.USER32(?), ref: 00FB9DB7
Part of subcall function 00FB9D95: InvertRect.USER32(?,?), ref: 00FB9DCD
Part of subcall function 00FB9D95: SetRectEmpty.USER32(?), ref: 00FB9DDB

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Capture$RectRelease$Empty$H_prolog3_Invert
String ID:
API String ID: 4148550730-0
Opcode ID: 5959ad1ed7fe12fd8922d9862b4d5c6a25cb600ca1e2ed39b639167c5f241131
Instruction ID: f1726547c0d368fcf641768de960cd826b8bd98ef1373fbb05c3a14e036f4e37
Opcode Fuzzy Hash: 5959ad1ed7fe12fd8922d9862b4d5c6a25cb600ca1e2ed39b639167c5f241131
Instruction Fuzzy Hash: 1F015632210710CBD731BB22DC98BAEB3E4FB54326F240539E1DA86190DAB66845EF52

Function 00FCE16C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00FCE1AE
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00FCE1E9
OffsetRect.USER32(?,?,?), ref: 00FCE1F9
CopyRect.USER32(?,?), ref: 00FCE207

Strings

,, xrefs: 00FCE1C2

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Rect$CopyInfoOffsetParametersSystemWindow
String ID: ,
API String ID: 401166719-3772416878
Opcode ID: 91e0eae3617b10636a649f1965c75ac98068bf48b26bb3107fc9a6d47f3ec678
Instruction ID: 2e8524e2a1e45341d5cd9a0da04a930464dfc114b79560dedd2d01ac036f31bb
Opcode Fuzzy Hash: 91e0eae3617b10636a649f1965c75ac98068bf48b26bb3107fc9a6d47f3ec678
Instruction Fuzzy Hash: 97213832A0020AABDB21EFE4DD89FEEBBB9FF48320F140059F545A7154DB75A900DB21

Function 00F7C141 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 61COMMON

Download Yara Rule

Strings

Edit, xrefs: 00F7C19B

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID:
String ID: Edit
API String ID: 0-554135844
Opcode ID: 145b23012b0f1ebb6e12c37dbae80b8e5b64c432d16b6e37f7bb282b43798794
Instruction ID: 1774aa87c65e9af091c3a21dce5cde740f70d2540f2dd834ffaccee8343f3ccf
Opcode Fuzzy Hash: 145b23012b0f1ebb6e12c37dbae80b8e5b64c432d16b6e37f7bb282b43798794
Instruction Fuzzy Hash: F61182317442017ADA342A358C09B6ABBA8AB41761FA4C43BF58DD14A7DBE5D810F7D2

Function 00F906FF Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 54libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(DWMAPI), ref: 00F90729
GetProcAddress.KERNEL32(00000000,DwmSetIconicThumbnail), ref: 00F90739
DeleteObject.GDI32(00000000), ref: 00F90773

Strings

DWMAPI, xrefs: 00F9071E
DwmSetIconicThumbnail, xrefs: 00F90733

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: AddressDeleteHandleModuleObjectProc
String ID: DWMAPI$DwmSetIconicThumbnail
API String ID: 3128169092-3761315311
Opcode ID: 0aa2772f2d54050d27ac61091d2b6988b0f3f34354f7f69a350b9b9a11618139
Instruction ID: 785943888ebabf52462eabda73fc5f65ce2d197cfa28db4997b8a105af8a48c1
Opcode Fuzzy Hash: 0aa2772f2d54050d27ac61091d2b6988b0f3f34354f7f69a350b9b9a11618139
Instruction Fuzzy Hash: DB01A136600205BFEF106FB58C88E6E77ACAB44725B008129F94597241DEB8ED00DB61

Function 00FFC2FC Relevance: 7.9, APIs: 5, Instructions: 362COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00FFC363
GetWindowRect.USER32(?,?), ref: 00FFC43B
InflateRect.USER32(?,00000000,?), ref: 00FFC461
GetWindowRect.USER32(?,?), ref: 00FFC516
GetWindowRect.USER32(?,?), ref: 00FFC621

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Rect$Window$Inflate
String ID:
API String ID: 1123775244-0
Opcode ID: a10062ea05347fdb60cfb0e6afe7e98eb0d38effd27eaa4fb39afb8ce4e0fd78
Instruction ID: ad286579f1f6568d1671aa5813a1e40951aeb7d42e6edf92dcb8f80bd93ed804
Opcode Fuzzy Hash: a10062ea05347fdb60cfb0e6afe7e98eb0d38effd27eaa4fb39afb8ce4e0fd78
Instruction Fuzzy Hash: B8E12C72E0021DDFCB14DFA8CA84ABEBBB5BF48310F144569E655E7264D770AD40EB90

Function 00F983AA Relevance: 7.8, APIs: 5, Instructions: 338COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 00F983D2
SetRectEmpty.USER32(?), ref: 00F9844A
GetClientRect.USER32(?,?), ref: 00F9864A
GetClientRect.USER32(?,?), ref: 00F98672
SetRectEmpty.USER32(?), ref: 00F98701

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Rect$Empty$Client
String ID:
API String ID: 1457177775-0
Opcode ID: ec4d3cc15c44b0f7609da38ad94bb970da3167af46ed65bcb7596875e5219378
Instruction ID: 5d2a4987714852144dd1b8f90672f39d951fd4c47f18078d4cb8b9c4de5f21e7
Opcode Fuzzy Hash: ec4d3cc15c44b0f7609da38ad94bb970da3167af46ed65bcb7596875e5219378
Instruction Fuzzy Hash: 30D15A31D0060ACFDF15CF68C9806AEBBB2BF4A360F244559E915BB240DB75AD42DF90

Function 00FE8232 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

LockWindowUpdate.USER32(?), ref: 00FE8258
IsWindow.USER32(?), ref: 00FE827E
GetWindowRect.USER32(?,?), ref: 00FE82D9
CopyRect.USER32(?,?), ref: 00FE8408
LockWindowUpdate.USER32(00000000,?,00000000,00000000,?,00000000,00000000,00000000,?), ref: 00FE842D

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$LockRectUpdate$Copy
String ID:
API String ID: 2992910783-0
Opcode ID: b9f8a11a6a21c1c79c45d94e12424dfbca99e0c9bf1b0051d4f33a414bca30e2
Instruction ID: d5c584ce5cd26d0eea57edca1f67ca07de6f2f4625652ce2a69d353df97c15d6
Opcode Fuzzy Hash: b9f8a11a6a21c1c79c45d94e12424dfbca99e0c9bf1b0051d4f33a414bca30e2
Instruction Fuzzy Hash: 21711974A00648AFCB15EFA9C898DAEBBF9EF89700F10446DF846E3250CB755941CF60

Function 00FC0696 Relevance: 7.7, APIs: 5, Instructions: 169COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FC069D
GetClientRect.USER32(?,?), ref: 00FC0743
InflateRect.USER32(?,00000003,00000003), ref: 00FC0775

Part of subcall function 00FC4D01: __EH_prolog3_GS.LIBCMT ref: 00FC4D08

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: H_prolog3_Rect$ClientInflate
String ID:
API String ID: 2789979914-0
Opcode ID: 1d702613f1effdf87b1bee574f00c3964f6bccae63b3e6da2ee1de890e46bb50
Instruction ID: d3c02304783a507ae0b7f91a4c5ec4dd07824a2092430ec623ccfbb46c7d3004
Opcode Fuzzy Hash: 1d702613f1effdf87b1bee574f00c3964f6bccae63b3e6da2ee1de890e46bb50
Instruction Fuzzy Hash: F0515A71A0011AEFCF04DFA8CD86EEEB7B9BF48710F144119F556BB285DA74A901DB60

Function 00FFC12E Relevance: 7.7, APIs: 5, Instructions: 168COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00FFC1A8
EqualRect.USER32(?,?), ref: 00FFC1D3
BeginDeferWindowPos.USER32(?), ref: 00FFC1E0
EndDeferWindowPos.USER32(?), ref: 00FFC205

Part of subcall function 00FF6E80: GetWindowRect.USER32(?,?), ref: 00FF6E96
Part of subcall function 00FF6E80: GetParent.USER32(?), ref: 00FF6ED8
Part of subcall function 00FF6E80: GetParent.USER32(?), ref: 00FF6EE8

Part of subcall function 00F72127: __CxxThrowException@8.LIBCMT ref: 00F7213D
Part of subcall function 00F72127: __EH_prolog3.LIBCMT ref: 00F7214A

GetWindowRect.USER32(?,?), ref: 00FFC2BA

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$Rect$DeferParent$BeginEqualException@8H_prolog3Throw
String ID:
API String ID: 601628497-0
Opcode ID: c104d668cbac5349377efc599cca0cb71cb5c1cdb999b55ad532d0bc5189d8c0
Instruction ID: 8fd0442a866c578aa23e97bdd91444043f1453b7ac00b83314b574af31316922
Opcode Fuzzy Hash: c104d668cbac5349377efc599cca0cb71cb5c1cdb999b55ad532d0bc5189d8c0
Instruction Fuzzy Hash: 45512A71E0021D9FCB10DFE9C9849EEBBF5FF48710B24406AE645E7225DB34A941EBA0

Function 00F661B0 Relevance: 7.7, APIs: 5, Instructions: 166windowCOMMON

Download Yara Rule

APIs

AppendMenuA.USER32(?,00000000,000005DC,16B3F121), ref: 00F66248
AppendMenuA.USER32(?,00000000,000005DD,16B3F121), ref: 00F66289
AppendMenuA.USER32(?,00000000,000005DE,16B3F121), ref: 00F662C7
AppendMenuA.USER32(?,00000000,000005DF,16B3F121), ref: 00F662ED
AppendMenuA.USER32(?,00000000,000005E0,16B3F121), ref: 00F66313

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: AppendMenu
String ID:
API String ID: 3048259833-0
Opcode ID: 7137bcdee8016cc514e81fe900fcc0c76b91428a8cc66913d07144105295de88
Instruction ID: 05302d95ea7f089617ffc88225660f5d622d1b1f5acf9bad1aa54cfed4b6d846
Opcode Fuzzy Hash: 7137bcdee8016cc514e81fe900fcc0c76b91428a8cc66913d07144105295de88
Instruction Fuzzy Hash: 245180717006069BEB14DB64CC52FAFB3A8FF45760F148629A925E73D1EB74E801DB60

Function 00F8A3AB Relevance: 7.6, APIs: 5, Instructions: 127stringCOMMON

Download Yara Rule

APIs

GlobalLock.KERNEL32(?,16B3F121,00000000,00000000), ref: 00F8A3D7
lstrlenA.KERNEL32(?), ref: 00F8A421
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000020), ref: 00F8A43B
_wcslen.LIBCMT ref: 00F8A45F

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: ByteCharGlobalLockMultiWide_wcslenlstrlen
String ID:
API String ID: 4253822919-0
Opcode ID: 646ba61631b304b0e87b99785a6794dd8fbbd4cd43f0abf932b8e6de1a5de8f1
Instruction ID: 08c8a5fab6a1d8bdc3ed1f2d048bf01e70ebc9511b5bc9ded685894a8881d123
Opcode Fuzzy Hash: 646ba61631b304b0e87b99785a6794dd8fbbd4cd43f0abf932b8e6de1a5de8f1
Instruction Fuzzy Hash: C641C371900219DFDF14EFA4C889AEDBBB8FF04310F24812AE412EB199DB74A945DB51

Function 00FB06AA Relevance: 7.6, APIs: 5, Instructions: 113windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00FB06E9
ShowWindow.USER32(00000000,00000004), ref: 00FB071B
IsWindow.USER32(?), ref: 00FB0760
IsWindowVisible.USER32(?), ref: 00FB076B
ShowWindow.USER32(?,00000000), ref: 00FB07A6

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$Show$Visible
String ID:
API String ID: 2757229004-0
Opcode ID: ee69bc3fd55b636483c14232ec3af496551e671b87ac1157f88374e88dd7bbb3
Instruction ID: 69faeca32de2f8f0456becca6841170fdde2d0d42b1514c59b1ae08853037e83
Opcode Fuzzy Hash: ee69bc3fd55b636483c14232ec3af496551e671b87ac1157f88374e88dd7bbb3
Instruction Fuzzy Hash: F731D2326002019BDB20AF62DC95BEBB7A8FF41760F344168E9869B141EF34F840EF60

Function 00FB2515 Relevance: 7.6, APIs: 5, Instructions: 111keyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00F795EC: GetWindowLongA.USER32(?,000000F0), ref: 00F795F7

GetWindowRect.USER32(?,?), ref: 00FB2549
GetSystemMetrics.USER32(00000021), ref: 00FB2557
GetSystemMetrics.USER32(00000020), ref: 00FB255D
GetKeyState.USER32(00000002), ref: 00FB257D
InflateRect.USER32(?,00000000,00000000), ref: 00FB25B3

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: MetricsRectSystemWindow$InflateLongState
String ID:
API String ID: 2406722796-0
Opcode ID: 10a6d80a41b24d2de0f1d9218e7354bbe62746852dcc6fbcb2f3b0edd84783c7
Instruction ID: e0f7068d1c20783de87f521292aec39eac454902b904f139597b39d3a0876575
Opcode Fuzzy Hash: 10a6d80a41b24d2de0f1d9218e7354bbe62746852dcc6fbcb2f3b0edd84783c7
Instruction Fuzzy Hash: CC31A172F001199BDB60DFB9C8A9AFE77A5FB483A0F184419D402DB190DE74DA40EF50

Function 00FF854F Relevance: 7.6, APIs: 5, Instructions: 109windowstringCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FF8556
SendMessageA.USER32(?,00000420,00000001,?), ref: 00FF85EA
SendMessageA.USER32(?,00000420,00000001,?), ref: 00FF8601
_calloc.LIBCMT ref: 00FF861C
lstrcpyA.KERNEL32(00000000,00000010,?,00000004,00F9F507,?,?,00000002,?,?,00000000), ref: 00FF862F

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: MessageSend$H_prolog3_calloclstrcpy
String ID:
API String ID: 3273239350-0
Opcode ID: b07080d2feb9e33896d44ecd325f55cbe43567d6a7a3e2e80cd83f7d57bdabbe
Instruction ID: e6d00c5c280890a8c2bc93978695eade16f499465b9460b99a9ce0a5d466e981
Opcode Fuzzy Hash: b07080d2feb9e33896d44ecd325f55cbe43567d6a7a3e2e80cd83f7d57bdabbe
Instruction Fuzzy Hash: 6841BDB2A00249AFDB14DF68CC45AAE77A8BF143A0F188219F965DB2A1CF34DD11DB54

Function 00FE85A3 Relevance: 7.6, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

Part of subcall function 00FDF79D: SetRectEmpty.USER32(?), ref: 00FDF7B8

IsRectEmpty.USER32(?), ref: 00FE85C8

Part of subcall function 00F7E593: ScreenToClient.USER32(00000407,?), ref: 00F7E5A4
Part of subcall function 00F7E593: ScreenToClient.USER32(00000407,?), ref: 00F7E5B1

GetWindowRect.USER32(?,?), ref: 00FE8609
UnionRect.USER32(?,?,?), ref: 00FE8632
EqualRect.USER32(?,?), ref: 00FE8640
OffsetRect.USER32(?,?,?), ref: 00FE865C

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Rect$ClientEmptyScreen$EqualOffsetUnionWindow
String ID:
API String ID: 2676815302-0
Opcode ID: 741c00e135ad834cf72e1a728a89635b61e840852cf9546439b64a34b9ad4607
Instruction ID: 9dbcb17cec1d3ceaf1c601fa23871f2275adde5e78ddbecc13e0b761a892da7d
Opcode Fuzzy Hash: 741c00e135ad834cf72e1a728a89635b61e840852cf9546439b64a34b9ad4607
Instruction Fuzzy Hash: 95419671A00209AFCB10DFE9C9848EEBBF9FF48300B10456AE555E3204DB75AE05DB61

Function 00FA00EE Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

InflateRect.USER32(?,000000FF,000000FF), ref: 00FA0127
InflateRect.USER32(?,000000FF,000000FF), ref: 00FA0156
InflateRect.USER32(?,?,?), ref: 00FA01B8
InflateRect.USER32(?,00000001,00000001), ref: 00FA01D4

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: InflateRect
String ID:
API String ID: 2073123975-0
Opcode ID: 7287af8661f34c60f551dfd4e93b3f8d43e4946411edf06ec24c2ce866fecb39
Instruction ID: ade3086b446be6588deca8d3e758a3189b3e1b538497ecdd9fc26e6b724fd1d5
Opcode Fuzzy Hash: 7287af8661f34c60f551dfd4e93b3f8d43e4946411edf06ec24c2ce866fecb39
Instruction Fuzzy Hash: 5D314DB290421DABCF10EE94DC85DFA376DFB89360B140A16FA64D71D4DA39E910DB60

Function 00FAC34A Relevance: 7.6, APIs: 5, Instructions: 96windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FAC351
SendMessageA.USER32(?,0000007F,00000000,00000000), ref: 00FAC3CA
SendMessageA.USER32(?,00000080,00000000,00000000), ref: 00FAC3D7
SendMessageA.USER32(?,0000007F,00000001,00000000), ref: 00FAC3E2
SendMessageA.USER32(?,00000080,00000001,00000000), ref: 00FAC3EF

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: MessageSend$H_prolog3
String ID:
API String ID: 1885053084-0
Opcode ID: 26ffb18577df1638e2bd4b02931b4423c80cd3c8a8330a92ad8ce73dbf0eee45
Instruction ID: 3a8abf6c791665c08a17c0ff867181911f949ea38da38093d49ee9c84b922d6a
Opcode Fuzzy Hash: 26ffb18577df1638e2bd4b02931b4423c80cd3c8a8330a92ad8ce73dbf0eee45
Instruction Fuzzy Hash: 06316971740201ABDF24AB30CCA6BBD3A65BF49750F044179F94A9B2D2CB74A840EB95

Function 00FC426C Relevance: 7.6, APIs: 5, Instructions: 94windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00FC4291
SendMessageA.USER32(?,000000F1,00000001,00000000), ref: 00FC4324
GetParent.USER32(?), ref: 00FC4330
GetWindowLongA.USER32(?,000000F4), ref: 00FC434A
SendMessageA.USER32(?,00000111,?), ref: 00FC435A

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: MessageParentSend$LongWindow
String ID:
API String ID: 2933145521-0
Opcode ID: 4e18fbea97ac601745cdc4c046b84c04b16fe28116f851db3365a021529503be
Instruction ID: d9ffbdfa01f46fec4b7f7fb84822dc961ba1c3c734e5a6f267dffabbad043114
Opcode Fuzzy Hash: 4e18fbea97ac601745cdc4c046b84c04b16fe28116f851db3365a021529503be
Instruction Fuzzy Hash: 92213632A04612BFEF21AB71CD52FAEBAE9FB84760F10442EF54AC7140D675AC40B750

Function 00F86488 Relevance: 7.6, APIs: 5, Instructions: 92windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F8648F
CreateRectRgnIndirect.GDI32(?), ref: 00F864B1

Part of subcall function 00F7E508: SelectClipRgn.GDI32(?,00000000), ref: 00F7E52E
Part of subcall function 00F7E508: SelectClipRgn.GDI32(?,?), ref: 00F7E544

GetParent.USER32(?), ref: 00F864D1
MapWindowPoints.USER32(?,00000000,?,00000001), ref: 00F86529
SendMessageA.USER32(?,00000014,?,00000000), ref: 00F86556

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: ClipSelect$CreateH_prolog3IndirectMessageParentPointsRectSendWindow
String ID:
API String ID: 3362736716-0
Opcode ID: eb180ac79c9e7fa5cce8635c01ffeeb83377333f3372e53ded17ecf3097e491f
Instruction ID: 4d33bc70c36357ba6da8a732ad6b423021f8fd539124f294791f942a5adda658
Opcode Fuzzy Hash: eb180ac79c9e7fa5cce8635c01ffeeb83377333f3372e53ded17ecf3097e491f
Instruction Fuzzy Hash: 1C314C71A0020ADFCF14EFA4CC549AEBBB5FF08310F108529F959EB254E7359A01EB90

Function 00F765C2 Relevance: 7.6, APIs: 5, Instructions: 80windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00F765CC
GetTopWindow.USER32(?), ref: 00F765F1
GetDlgCtrlID.USER32(00000000), ref: 00F76603
SendMessageA.USER32(?,00000087,00000000,00000000), ref: 00F7665F
GetWindow.USER32(00000000,00000002), ref: 00F7669F

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$CtrlH_prolog3MessageSend
String ID:
API String ID: 849854284-0
Opcode ID: f217288ac2a772ba6b9892103ba6339a2e7b3a5e831f8fb842274c5c3093b23b
Instruction ID: 57c2dc954a10d1bb5982fe0f251c46908095bf0751a9cd362571adb723c499c1
Opcode Fuzzy Hash: f217288ac2a772ba6b9892103ba6339a2e7b3a5e831f8fb842274c5c3093b23b
Instruction Fuzzy Hash: 7B21A071D00615AADF25EBA0CC44EADB778BF65310F60825BF889E6194DB744E40EF52

Function 00FA23BC Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

FillRect.USER32(?,?), ref: 00FA23F3
GetParent.USER32(?), ref: 00FA2410
GetClientRect.USER32(?,?), ref: 00FA241F
GetParent.USER32(?), ref: 00FA2428
MapWindowPoints.USER32(?,?,?,00000002), ref: 00FA243D

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: ParentRect$ClientFillPointsWindow
String ID:
API String ID: 3058756167-0
Opcode ID: bc84f8dba3e4080ac43ee2bd34892a02f317fbbe8bbd5ff26f9fc0fee5fb40f7
Instruction ID: 77418cb2d273cf48d5862fdf170566cebd43fc00cb357234624f3822dd643e19
Opcode Fuzzy Hash: bc84f8dba3e4080ac43ee2bd34892a02f317fbbe8bbd5ff26f9fc0fee5fb40f7
Instruction Fuzzy Hash: E2218E71900209EFCB10EFA4C8458AFBFB5FF49310B1044A9E985A7211DB75AE01DFA1

Function 00F8417A Relevance: 7.6, APIs: 5, Instructions: 54stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00F81E21,?,?,?), ref: 00F841A6
_memset.LIBCMT ref: 00F841C3
GetWindowTextA.USER32(?,00000000,00000100), ref: 00F841DD
lstrcmpA.KERNEL32(00000000,00F81E21), ref: 00F841EF
SetWindowTextA.USER32(?,00F81E21), ref: 00F841FB

Part of subcall function 00F72127: __CxxThrowException@8.LIBCMT ref: 00F7213D
Part of subcall function 00F72127: __EH_prolog3.LIBCMT ref: 00F7214A

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: TextWindow$Exception@8H_prolog3Throw_memsetlstrcmplstrlen
String ID:
API String ID: 4273134663-0
Opcode ID: 9d471a772307bcac5e30a61d9beea976c67733aec00d1a533d1234feb2a17041
Instruction ID: 12c9577c83fec78c684995bcb79c8bf46a3f66db49f2ff73d303b3206f06f8b5
Opcode Fuzzy Hash: 9d471a772307bcac5e30a61d9beea976c67733aec00d1a533d1234feb2a17041
Instruction Fuzzy Hash: 6F01D6B6A00216ABCB21BF649C88FDF77ACEB64314F1000A1F985D3145DA75AA8487A1

Function 00F6E470 Relevance: 7.5, APIs: 5, Instructions: 48windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,?,00000367,00000367,00000003), ref: 00F6E496
PostMessageA.USER32(?,00000367,00000000,00000000), ref: 00F6E4AE
GetCapture.USER32 ref: 00F6E4B0
ReleaseCapture.USER32 ref: 00F6E4BB
PostMessageA.USER32(?,0000036A,00000000,00000000), ref: 00F6E4E9

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Message$CapturePost$PeekRelease
String ID:
API String ID: 1125932295-0
Opcode ID: 8fa4fc9bc61abef757cd019291f843c7ecf237a4d0d1727d272fcfa1e0fabd48
Instruction ID: 8a9b9c10b2a77725b6d7f27a18c8901c5c6f41f055069e4cf012f9b282f384fd
Opcode Fuzzy Hash: 8fa4fc9bc61abef757cd019291f843c7ecf237a4d0d1727d272fcfa1e0fabd48
Instruction Fuzzy Hash: E4018F35604600ABE7356B30DC4DF1B7AB8FB84B14F20852DF4CA92185EAB5A801D765

Function 00FD82A9 Relevance: 7.5, APIs: 5, Instructions: 45windowCOMMON

Download Yara Rule

APIs

ScreenToClient.USER32(?,?), ref: 00FD82B8
SendMessageA.USER32(?,00000366,00000000,?), ref: 00FD82D4
ClientToScreen.USER32(?,?), ref: 00FD82E1
GetWindowLongA.USER32(?,000000F0), ref: 00FD82EA
GetParent.USER32(?), ref: 00FD82F8

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: ClientScreen$LongMessageParentSendWindow
String ID:
API String ID: 4240056119-0
Opcode ID: 98c518d4cb0a32b1d234cfa999affbd840c29b9fec47d30301332af34e746054
Instruction ID: 1c890e87f8d83c24236dcd1768f30802219d09dc3188e3f3732c38e0a49a3dbb
Opcode Fuzzy Hash: 98c518d4cb0a32b1d234cfa999affbd840c29b9fec47d30301332af34e746054
Instruction Fuzzy Hash: 7AF0F937504924B7D3220E149C08BAF379DEF81BB1F244212FDA5C2288DF75DA01D7A4

Function 0106A31C Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0106A328

Part of subcall function 010688F2: __getptd_noexit.LIBCMT ref: 010688F5
Part of subcall function 010688F2: __amsg_exit.LIBCMT ref: 01068902

__getptd.LIBCMT ref: 0106A33F
__amsg_exit.LIBCMT ref: 0106A34D
__lock.LIBCMT ref: 0106A35D
__updatetlocinfoEx_nolock.LIBCMT ref: 0106A371

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: 9a02e6cd392ce60cb1faa9754de8f2a8bc3deb2ed02adbba62af3d3a500f7460
Instruction ID: 1ab7fdc5efc6d4244dc61dd8c3331aee7b51d64566c0ae4d6d9641733d908399
Opcode Fuzzy Hash: 9a02e6cd392ce60cb1faa9754de8f2a8bc3deb2ed02adbba62af3d3a500f7460
Instruction Fuzzy Hash: 0AF09032F44322DBEB61BB6C980178D37D8AF14720F158159F5C4BB2C1DBA955408A5A

Function 00F66470 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 186windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F67BB0: GetModuleHandleA.KERNEL32(StretchRes,?,?,?,00F6597D,?,Trig,16B3F121,?,?,00000000,?), ref: 00F67BC2
Part of subcall function 00F67BB0: FindResourceA.KERNEL32(00000000,16B3F121,?), ref: 00F67BD9
Part of subcall function 00F67BB0: SizeofResource.KERNEL32(00000000,00000000,?,00F6597D,?,Trig,16B3F121,?,?,00000000,?), ref: 00F67BE7
Part of subcall function 00F67BB0: LoadResource.KERNEL32(00000000,00000000,?,00F6597D,?,Trig,16B3F121,?,?,00000000,?), ref: 00F67BF2

_memcpy_s.LIBCMT ref: 00F665A6
AppendMenuA.USER32(?,00000000,-000003E8,?), ref: 00F665D6

Strings

STR#, xrefs: 00F664A2

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Resource$AppendFindHandleLoadMenuModuleSizeof_memcpy_s
String ID: STR#
API String ID: 3993332125-3114514328
Opcode ID: 4576765f8e8b4c400d4b32c9b8a690b3186b3f1c6e250edfe7ec765c59d818aa
Instruction ID: c08cc5821d6d5f70623d37b0807ab6f75a881505e5e82e2f1ae07ac09d49a839
Opcode Fuzzy Hash: 4576765f8e8b4c400d4b32c9b8a690b3186b3f1c6e250edfe7ec765c59d818aa
Instruction Fuzzy Hash: E3510672A046159FCB14EBA8CD51BAEF7F8FF54320F14426AE816E7281DB359D00DBA0

Function 00F646A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,?,00000104), ref: 00F646C5
GetModuleFileNameA.KERNEL32(00000000), ref: 00F646CC
__wsplitpath.LIBCMT ref: 00F646EB

Part of subcall function 01061234: __splitpath_helper.LIBCMT ref: 01061276

Strings

Stretch.exe, xrefs: 00F64759

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Module$FileHandleName__splitpath_helper__wsplitpath
String ID: Stretch.exe
API String ID: 1359774396-3639437320
Opcode ID: ee3b3de9a874dfacea4b9a7169a220c39523b0824040651d01ad421b29dd0a61
Instruction ID: 1b01d0205624b223eb98aaf487d96d896268b569689105a3d3739cf90a01150c
Opcode Fuzzy Hash: ee3b3de9a874dfacea4b9a7169a220c39523b0824040651d01ad421b29dd0a61
Instruction Fuzzy Hash: D63109719042099BCB24DF68D8A8BEA7BF9EB55300F1081E5E9C5CB244DF71AD88CB90

Function 00FA2307 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

FillRect.USER32(?,?), ref: 00FA232C
InflateRect.USER32(?,000000FF,000000FF), ref: 00FA2363
DrawEdge.USER32(?,?,00000000,0000000F), ref: 00FA2383

Strings

iii, xrefs: 00FA2349

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Rect$DrawEdgeFillInflate
String ID: iii
API String ID: 785442924-940974255
Opcode ID: b3337c069d5fa2fcb6b6ac8758de9d359a0735fe59d6dd42af35bf15662493bc
Instruction ID: 47e58ea2964c6d411db51018c9aea5bfbc3e596ddb1db4e63511f8c95fc550fa
Opcode Fuzzy Hash: b3337c069d5fa2fcb6b6ac8758de9d359a0735fe59d6dd42af35bf15662493bc
Instruction Fuzzy Hash: 67114CB250020DAFCF10DFA4DD849EF77B9FB08324B104565B955EB195D735EA05CB60

Function 00F842C2 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 00F842E3
GetClassNameA.USER32(?,?,0000000A), ref: 00F842F8
CompareStringA.KERNEL32(00000409,00000001,?,000000FF,combobox,000000FF), ref: 00F84312

Strings

combobox, xrefs: 00F84300

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: ClassCompareLongNameStringWindow
String ID: combobox
API String ID: 1414938635-2240613097
Opcode ID: 5d454ac3e5e1b890658c6f15157f4a32dac28591eecb2573f01e8a6763dc7718
Instruction ID: 89a57e59a86f2e32966e62aad5df8ac4b50211870dda53c6ff58e9919dde468c
Opcode Fuzzy Hash: 5d454ac3e5e1b890658c6f15157f4a32dac28591eecb2573f01e8a6763dc7718
Instruction Fuzzy Hash: 54F0F432658229AFCB20EF68CC01EBE77A8EB15330B600744F5B1E60C4DA34A9019795

Function 00F805C1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Advapi32.dll), ref: 00F805D3
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedA), ref: 00F805E3

Strings

RegCreateKeyTransactedA, xrefs: 00F805DD
Advapi32.dll, xrefs: 00F805CE

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedA
API String ID: 1646373207-1184998024
Opcode ID: 2e79c59ab9140be2331eec6577cd29de02bda4aca836abb198b629566618487b
Instruction ID: 266404578337787f4679739bf8af2d3f183b567dec9953bf3d78e22d7a85068d
Opcode Fuzzy Hash: 2e79c59ab9140be2331eec6577cd29de02bda4aca836abb198b629566618487b
Instruction Fuzzy Hash: 1DF03C32504109FBCF222E959C04FDA3BA6EB48761F144419FA9495061EF76D8B0EB54

Function 00F80568 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(Advapi32.dll), ref: 00F8057A
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedA), ref: 00F8058A

Strings

RegOpenKeyTransactedA, xrefs: 00F80584
Advapi32.dll, xrefs: 00F80575

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegOpenKeyTransactedA
API String ID: 1646373207-496252237
Opcode ID: 4f5268366b0d7ddcf95e2dedaf8201850795f732d277ba8209088995a1fdc1aa
Instruction ID: 0acf55e534fc61db4f0c6184011f663f72f5860626ad576e2f4021df1db35a9d
Opcode Fuzzy Hash: 4f5268366b0d7ddcf95e2dedaf8201850795f732d277ba8209088995a1fdc1aa
Instruction Fuzzy Hash: BEF09A32504204AFCB212EA59C08BDA3BA9AB08761F184429FA9099050CF72E460EFA0

Function 00FD43C0 Relevance: 6.5, APIs: 4, Instructions: 476COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FD43C7
GetWindowRect.USER32(?,?), ref: 00FD45BF
GetParent.USER32(?), ref: 00FD4643
GetParent.USER32(?), ref: 00FD4937

Part of subcall function 00FD9DE3: GetParent.USER32(?), ref: 00FD9E14

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Parent$H_prolog3_RectWindow
String ID:
API String ID: 3969657074-0
Opcode ID: 6e3f42987e514187aed08a80b3a09b3dbbe12cb27761007c4ec26aa00e8a6c42
Instruction ID: 1f43d2cf0d15d71bd49c95a8ef1f392ec5533b5881afeb884c18416a86d4526f
Opcode Fuzzy Hash: 6e3f42987e514187aed08a80b3a09b3dbbe12cb27761007c4ec26aa00e8a6c42
Instruction Fuzzy Hash: 74122B70A01208AFCF15EFA4C899BEDBBF6BF48310F18412AF556E7291DB385945EB11

Function 00FAE358 Relevance: 6.3, APIs: 4, Instructions: 258keyboardCOMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 00FAE384
GetKeyState.USER32(00000011), ref: 00FAE38C
IsRectEmpty.USER32(?), ref: 00FAE3E9
GetWindowRect.USER32(?,?), ref: 00FAE566

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Rect$Empty$StateWindow
String ID:
API String ID: 2684165152-0
Opcode ID: dce14d91831534841277374a8add03092f44d89d43d8ea8e331f15f12869701c
Instruction ID: 73a7eb3bac753e94474e176e91abb76d3ce53e7e9d1b9b7a64023ccb305857e5
Opcode Fuzzy Hash: dce14d91831534841277374a8add03092f44d89d43d8ea8e331f15f12869701c
Instruction Fuzzy Hash: 63917D71A002059FDF15DFA4D885AEEBBB6EF49310F148169F905EB251DB35A840EFA0

Function 010625D9 Relevance: 6.2, APIs: 4, Instructions: 173COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 010625E7

Part of subcall function 01060E98: __getptd.LIBCMT ref: 01060EAB

Part of subcall function 010634C9: __getptd_noexit.LIBCMT ref: 010634C9

__stricmp_l.LIBCMT ref: 01062654

Part of subcall function 0106CDA7: _LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0106CDB6

___crtLCMapStringA.LIBCMT ref: 010626AA
___crtLCMapStringA.LIBCMT ref: 0106272B

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Locale$StringUpdateUpdate::____crt$__getptd__getptd_noexit__stricmp_l
String ID:
API String ID: 2544346105-0
Opcode ID: f37dd99c08fea3814a6839d76684f167350d2c50d7a1fa2c2ed522c61107d35c
Instruction ID: 26fc53ebb56f4caacbf10ac9315bc95c315d830d307d94d2cae08d304bf6587d
Opcode Fuzzy Hash: f37dd99c08fea3814a6839d76684f167350d2c50d7a1fa2c2ed522c61107d35c
Instruction Fuzzy Hash: DC51F570904299ABDF269B68C484FBD7BF8BB05328F1881D9E1E15B1D2C7388E41CB50

Function 00FC8131 Relevance: 6.2, APIs: 4, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000000B,00000000,00000000), ref: 00FC81CD
SendMessageA.USER32(?,0000000B,00000001,00000000), ref: 00FC8213
RedrawWindow.USER32(?,00000000,00000000,00000185,?,?,00FCF844,?), ref: 00FC8223
IsWindowVisible.USER32(?), ref: 00FC82C8

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: MessageSendWindow$RedrawVisible
String ID:
API String ID: 2376333906-0
Opcode ID: fff9659935c960690c07d2d41fe0c2b9e6320a81e3263acd54987a25c262f29d
Instruction ID: 7b92748abf435c48bc8b3e9149ff731fef2ea32a1ef295790b79d77940a9591d
Opcode Fuzzy Hash: fff9659935c960690c07d2d41fe0c2b9e6320a81e3263acd54987a25c262f29d
Instruction Fuzzy Hash: FA51B230A00A01AFD7219F64CE8EEAA77F6FF85750B24456DF1468B195DB31EC41EB10

Function 0103E26F Relevance: 6.2, APIs: 4, Instructions: 155windowCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0103E276
SendMessageA.USER32(?,00000146,00000000,00000000), ref: 0103E3DD
SendMessageA.USER32(?,00000150,?,00000000), ref: 0103E429
SendMessageA.USER32(?,00000146,00000000,00000000), ref: 0103E45B

Part of subcall function 00F7B69B: __EH_prolog3_GS.LIBCMT ref: 00F7B6A5

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: MessageSend$H_prolog3H_prolog3_
String ID:
API String ID: 1270747201-0
Opcode ID: 21c5f8f0919b595b7bd341e2ccb9ce3244c58340c5cd76f5ca146e3a4b1499ae
Instruction ID: 30fd2016aa2a651cd86099a2e4b876feff28a252367911c602840dcd7d09ee6a
Opcode Fuzzy Hash: 21c5f8f0919b595b7bd341e2ccb9ce3244c58340c5cd76f5ca146e3a4b1499ae
Instruction Fuzzy Hash: 1E512B312007049BDB25EF74CC85BEAB7E5BF48300F10892DA69B972A2CB38A944DB51

Function 00FA636E Relevance: 6.1, APIs: 4, Instructions: 148COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FA6375
InflateRect.USER32(?,000000FF,00000000), ref: 00FA639C
InflateRect.USER32(?,000000FF,000000FE), ref: 00FA63BA
FillRect.USER32(?,?,000000FF), ref: 00FA63D7

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Rect$Inflate$FillH_prolog3_
String ID:
API String ID: 3515757206-0
Opcode ID: 17cdad272751abe7215f038103e1445d78c1d45bbb7e089a30f5df0f789972f3
Instruction ID: 6b137675a757d6c28fdc6884acf55c67695828eccfef1314b3a55045282e3420
Opcode Fuzzy Hash: 17cdad272751abe7215f038103e1445d78c1d45bbb7e089a30f5df0f789972f3
Instruction Fuzzy Hash: 4D514B71A0010DAFCF11EF94CC81CEE7BBAFF49324B18422AF855A2191DA39DD55EB61

Function 00FD05D4 Relevance: 6.1, APIs: 4, Instructions: 129COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FD05DB

Part of subcall function 00F72127: __CxxThrowException@8.LIBCMT ref: 00F7213D
Part of subcall function 00F72127: __EH_prolog3.LIBCMT ref: 00F7214A

Part of subcall function 00F84099: __EH_prolog3_catch.LIBCMT ref: 00F840A0

GetWindowRect.USER32(?,?), ref: 00FD06CF
GetSystemMetrics.USER32(00000010), ref: 00FD06DD
GetSystemMetrics.USER32(00000011), ref: 00FD06E8

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: MetricsSystem$Exception@8H_prolog3H_prolog3_H_prolog3_catchRectThrowWindow
String ID:
API String ID: 3575448974-0
Opcode ID: f199ad929b929db507422722166e51bf2444ac81d05d427ce90df459c9020826
Instruction ID: c85504c69730cd0d76b7152dd62e1c2d8c6da8eaabcfff518d89d0f7052a95b2
Opcode Fuzzy Hash: f199ad929b929db507422722166e51bf2444ac81d05d427ce90df459c9020826
Instruction Fuzzy Hash: D9415871A006099FCB14EFA8CC85AEEBBF6BF48300F15457AF546AB291CB74A904DB50

Function 00F6C6F0 Relevance: 6.1, APIs: 4, Instructions: 123windowCOMMON

Download Yara Rule

APIs

GetCurrentObject.GDI32(?,00000007), ref: 00F6C721
GetObjectA.GDI32(?,00000018,?), ref: 00F6C737
CreateBitmap.GDI32(?,00000000,00000001,00000001,00000000), ref: 00F6C76D
BitBlt.GDI32(00000002,00000000,00000000,?,00000000,00000002,00000000,00000000,00330008), ref: 00F6C7DF

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Object$BitmapCreateCurrent
String ID:
API String ID: 1536583575-0
Opcode ID: 8108768dc794c55c201864dff1dc5862979d1ccaa8a9da9cad62c914b8609cc3
Instruction ID: 5f5a9677234507dacb353cb922de37fb448a5d4cfb1373be0d0656571cdf483b
Opcode Fuzzy Hash: 8108768dc794c55c201864dff1dc5862979d1ccaa8a9da9cad62c914b8609cc3
Instruction Fuzzy Hash: E3416C75B00204AFDB10DFA8CC81F6AB3A9EF4C710F208159FA4997381DA78E9018BA0

Function 00FC8487 Relevance: 6.1, APIs: 4, Instructions: 120COMMON

Download Yara Rule

APIs

SetRectEmpty.USER32(?), ref: 00FC8547
SetRectEmpty.USER32(?), ref: 00FC8554
SetRectEmpty.USER32(?), ref: 00FC8602
SetRectEmpty.USER32 ref: 00FC865F

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: EmptyRect
String ID:
API String ID: 2270935405-0
Opcode ID: 2c0763ef2e6a5ea8da90bcf45d3b0cd056d5539970ed52c968e0b8419000588d
Instruction ID: 42caf14caf33cd042ae9ff2ee84be31b91ad7333dd526f12161949230ec3bb88
Opcode Fuzzy Hash: 2c0763ef2e6a5ea8da90bcf45d3b0cd056d5539970ed52c968e0b8419000588d
Instruction Fuzzy Hash: D9519EB1805B858EC360DF3AC681AE6FAE8FF94350F14492FD0EAD2265DBB46441DF51

Function 00F7022D Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F70237
GetDlgCtrlID.USER32(?), ref: 00F702A0

Part of subcall function 00F72127: __CxxThrowException@8.LIBCMT ref: 00F7213D
Part of subcall function 00F72127: __EH_prolog3.LIBCMT ref: 00F7214A

MultiByteToWideChar.KERNEL32(00000003,00000000,?,000000FF,?,00000050,00000000,0000010C), ref: 00F70320
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000213), ref: 00F7035C

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: ByteCharCtrlException@8H_prolog3H_prolog3_MultiThrowWideWindow
String ID:
API String ID: 1933732581-0
Opcode ID: 6a1ac7f6f65f6bd87d1bc0dd07d8ead5484aec485b5b377d747cb7474dbb9727
Instruction ID: e229639069ad2d4abf12ea93a55d38e93b7e5487f02d5074bcf032b0032ce499
Opcode Fuzzy Hash: 6a1ac7f6f65f6bd87d1bc0dd07d8ead5484aec485b5b377d747cb7474dbb9727
Instruction Fuzzy Hash: E431EA32D00249DBCF74AF74CC96BEE7268AF14320F14866EF65AE61C1CE749D80DA12

Function 00FE256D Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,?,?,?,?,00000014), ref: 00FE2623
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000014), ref: 00FE2659
InvalidateRect.USER32(?,00000000,00000001), ref: 00FE2663
UpdateWindow.USER32(?), ref: 00FE266A

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$InvalidateRectUpdate
String ID:
API String ID: 1651931182-0
Opcode ID: a227a3802a2b9a2f6e36ad212d611ae696bdbb5885c6c9fd50eaf52280eb8910
Instruction ID: 1f877c7d58ae23e4a08cccf772ee4be1a2dad9cd889ad2f30c75015ec8645831
Opcode Fuzzy Hash: a227a3802a2b9a2f6e36ad212d611ae696bdbb5885c6c9fd50eaf52280eb8910
Instruction Fuzzy Hash: CA318231940744EFCFB2CF66C9889AAB7BDFB84321F244A5EE59682115F7709980EF10

Function 00FA8321 Relevance: 6.1, APIs: 4, Instructions: 73keyboardCOMMON

Download Yara Rule

APIs

GetKeyState.USER32(00000011), ref: 00FA8338
GetCursorPos.USER32(?), ref: 00FA837E
SetRectEmpty.USER32(?), ref: 00FA8394
IsRectEmpty.USER32(?), ref: 00FA83BE

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: EmptyRect$CursorState
String ID:
API String ID: 2369637639-0
Opcode ID: a0b2f28e3ab24977ed48bffbcc024ddedfe338b7787d987610ae4c56caed3301
Instruction ID: 4508b298832989f4b5721957bb3280690637601d5333a55c9a2d966226814ee5
Opcode Fuzzy Hash: a0b2f28e3ab24977ed48bffbcc024ddedfe338b7787d987610ae4c56caed3301
Instruction Fuzzy Hash: CB2100B1E0021DAFCF11DFE5C9849EFBBBDFB49B51B10042AE141E2104DBB59A46DBA1

Function 00FB23F1 Relevance: 6.1, APIs: 4, Instructions: 66windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F795EC: GetWindowLongA.USER32(?,000000F0), ref: 00F795F7

GetForegroundWindow.USER32 ref: 00FB242E
GetLastActivePopup.USER32(?), ref: 00FB2452
SendMessageA.USER32(?,0000036D,00000040,00000000), ref: 00FB246A
SendMessageA.USER32(?,0000036D,00000000,00000000), ref: 00FB248F

Part of subcall function 00F72127: __CxxThrowException@8.LIBCMT ref: 00F7213D
Part of subcall function 00F72127: __EH_prolog3.LIBCMT ref: 00F7214A

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: MessageSendWindow$ActiveException@8ForegroundH_prolog3LastLongPopupThrow
String ID:
API String ID: 2019557511-0
Opcode ID: 4bdea9f596a0465dca344b1fd343d6a57ec1e5f567bc17231ace6b882838bed0
Instruction ID: 6890bb224791860861647999d5a23e29cb45ebd8ae30ecaf9556dd1ffbb6bc0f
Opcode Fuzzy Hash: 4bdea9f596a0465dca344b1fd343d6a57ec1e5f567bc17231ace6b882838bed0
Instruction Fuzzy Hash: 81110672B10101EBDB11EBB6DC05FAE3AACEB44750F10403AF645D3062EAB8DD00EB51

Function 00F820F9 Relevance: 6.1, APIs: 4, Instructions: 59windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00F7953B: GetDlgItem.USER32(00000000,?), ref: 00F7954C

GetWindowLongA.USER32(?,000000F0), ref: 00F82116
GetWindowTextLengthA.USER32(?), ref: 00F82143
GetWindowTextA.USER32(?,00000000,00000100), ref: 00F82172
SendMessageA.USER32(?,0000014D,000000FF,?), ref: 00F82193

Part of subcall function 00F8417A: lstrlenA.KERNEL32(00F81E21,?,?,?), ref: 00F841A6
Part of subcall function 00F8417A: _memset.LIBCMT ref: 00F841C3
Part of subcall function 00F8417A: GetWindowTextA.USER32(?,00000000,00000100), ref: 00F841DD
Part of subcall function 00F8417A: lstrcmpA.KERNEL32(00000000,00F81E21), ref: 00F841EF
Part of subcall function 00F8417A: SetWindowTextA.USER32(?,00F81E21), ref: 00F841FB

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$Text$ItemLengthLongMessageSend_memsetlstrcmplstrlen
String ID:
API String ID: 205973220-0
Opcode ID: ae68fbfe1482e9e2ccb3744ba804276157ac920d41ebf484a00c874a0bcb7cc9
Instruction ID: 0052f2396ffd9fd3e95ac7c09f03a5cce90c09a17b5ab00bad1e7d99c44f14aa
Opcode Fuzzy Hash: ae68fbfe1482e9e2ccb3744ba804276157ac920d41ebf484a00c874a0bcb7cc9
Instruction Fuzzy Hash: A7119031104209BBCF21AF54DC49EED7B66BF44370F244219FAA55A1E4CB35A991FB40

Function 00F7C53A Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(?,00000000,00000005), ref: 00F7C565
LoadResource.KERNEL32(?,00000000), ref: 00F7C56D
LockResource.KERNEL32(00000000), ref: 00F7C57F
FreeResource.KERNEL32(00000000), ref: 00F7C5CD

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Resource$FindFreeLoadLock
String ID:
API String ID: 1078018258-0
Opcode ID: 29a2ea24e8d65f253a2da567acecb2c6375896b10b26d987c3aa387c70c3cd3b
Instruction ID: e5c41f4a70e3feb92962be8af15409fa8a6dad29c19dbe80226fc2961248fc36
Opcode Fuzzy Hash: 29a2ea24e8d65f253a2da567acecb2c6375896b10b26d987c3aa387c70c3cd3b
Instruction Fuzzy Hash: 0B11D036900611EBD7308F65C848A7AB7B4FF44321F18C06EE99653650E776ED44E7D1

Function 00FE61A2 Relevance: 6.1, APIs: 4, Instructions: 57COMMON

Download Yara Rule

APIs

GetCursorPos.USER32(00000000), ref: 00FF7357

Part of subcall function 00FF6E80: GetWindowRect.USER32(?,?), ref: 00FF6E96
Part of subcall function 00FF6E80: GetParent.USER32(?), ref: 00FF6ED8
Part of subcall function 00FF6E80: GetParent.USER32(?), ref: 00FF6EE8

ScreenToClient.USER32(?,?), ref: 00FF737F
SetCapture.USER32(?), ref: 00FF739F
GetWindowRect.USER32(?,?), ref: 00FF73DA

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: ParentRectWindow$CaptureClientCursorScreen
String ID:
API String ID: 3234571238-0
Opcode ID: 985b61c336f34eba5666db183d80b5c4907f5911dce63a4f20858b32fe72a8e0
Instruction ID: 1622003f6a4d52e1b1391d6399feabeeb0cc6cce39dde49ca4d4f1a85228f1d8
Opcode Fuzzy Hash: 985b61c336f34eba5666db183d80b5c4907f5911dce63a4f20858b32fe72a8e0
Instruction Fuzzy Hash: F921A971504708EFDB21EF64C848BEEBBF8FF48315F100468E98A87251CB7AAA40DB50

Function 00FA811C Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 00FA8157
DestroyWindow.USER32(?), ref: 00FA8173
IsWindow.USER32(?), ref: 00FA8192
DestroyWindow.USER32(?), ref: 00FA81A2

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$Destroy
String ID:
API String ID: 3707531092-0
Opcode ID: aef26c20fa660394acb3f0609c88453a111fdefd3e70908f6294ed47bb0a004b
Instruction ID: b4ed143e3fe66ef50af4839183164321724d640340290d60611dc78a8a9ba3d9
Opcode Fuzzy Hash: aef26c20fa660394acb3f0609c88453a111fdefd3e70908f6294ed47bb0a004b
Instruction Fuzzy Hash: E9018471604600AFEB215B24DC84BAAFBB5FF413A5F14421AE55983114DF75AC52EB60

Function 00F76447 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

GetTopWindow.USER32(?), ref: 00F76457
GetTopWindow.USER32(00000000), ref: 00F76496
GetWindow.USER32(00000000,00000002), ref: 00F764B4

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window
String ID:
API String ID: 2353593579-0
Opcode ID: 0bd8694a8b6480b7322405ce00e9db437cca6382e4dc5e04e849dfe05d4a33ea
Instruction ID: 7933ffe97fba358ab8be67d0990397ca8a849d82cec600b44bb7484509fac906
Opcode Fuzzy Hash: 0bd8694a8b6480b7322405ce00e9db437cca6382e4dc5e04e849dfe05d4a33ea
Instruction Fuzzy Hash: 2D01ED3240091ABBCF239F95DC05E9E3A66AF49760F14C012FA5891065C73AC971FBA2

Function 00F8051E Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F80529

Part of subcall function 0106259F: HeapFree.KERNEL32(00000000,00000000,?,010688E3,00000000,?,00000000,010634CE,01062D42,00000000,?,00F6DBF4,00F7B459,00000000,?,00F71496), ref: 010625B5
Part of subcall function 0106259F: GetLastError.KERNEL32(00000000,?,010688E3,00000000,?,00000000,010634CE,01062D42,00000000,?,00F6DBF4,00F7B459,00000000,?,00F71496,0000000C), ref: 010625C7

__strdup.LIBCMT ref: 00F80531
_free.LIBCMT ref: 00F8053C
__strdup.LIBCMT ref: 00F80544

Part of subcall function 0106511A: _strlen.LIBCMT ref: 01065130
Part of subcall function 0106511A: _malloc.LIBCMT ref: 01065139
Part of subcall function 0106511A: _strcpy_s.LIBCMT ref: 0106514B

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: __strdup_free$ErrorFreeHeapLast_malloc_strcpy_s_strlen
String ID:
API String ID: 2371051941-0
Opcode ID: f99d5ce489f6bdc17b7150484c8fec20e443602bf90e5db001834617e8a69c53
Instruction ID: 55256d29d69fda6904a6894ac892e99f9836952c32d9d4aa975d19f7809990f1
Opcode Fuzzy Hash: f99d5ce489f6bdc17b7150484c8fec20e443602bf90e5db001834617e8a69c53
Instruction Fuzzy Hash: FBE01272810B45EFC7317F75CC01887BF9DEF64250B004C6AF9C657624DAB2A9609BC0

Function 00FA40B3 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00FA40BA
InflateRect.USER32(?,000000FD,000000FD), ref: 00FA4110

Strings

%d%%, xrefs: 00FA4173

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: H_prolog3_InflateRect
String ID: %d%%
API String ID: 3173815319-1518462796
Opcode ID: 949de80fbf5e752a121638fb19de2d00d937fdd5e2b752d0619d0d066e42096f
Instruction ID: 9a9a756c851b08c1373c0e2320f2c1f9924c986753dca30a1c97f817d741edf1
Opcode Fuzzy Hash: 949de80fbf5e752a121638fb19de2d00d937fdd5e2b752d0619d0d066e42096f
Instruction Fuzzy Hash: 94318A72A002289FCF15DFA4CC84DEEB7B9FF9A710B154559F901AB255CA70ED40DBA0

Function 00F8C3A6 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 103COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00F8C3AD
CoCreateGuid.OLE32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000028), ref: 00F8C3FA

Part of subcall function 00F639B0: _memcpy_s.LIBCMT ref: 00F63A49

Part of subcall function 00F639B0: _strnlen.LIBCMT ref: 00F639E8

Strings

%08lX%04X%04x%02X%02X%02X%02X%02X%02X%02X%02X, xrefs: 00F8C446

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: CreateGuidH_prolog3__memcpy_s_strnlen
String ID: %08lX%04X%04x%02X%02X%02X%02X%02X%02X%02X%02X
API String ID: 2536680395-1017209998
Opcode ID: 13e8da5adabfe0263b51aafbd9d235d41e7ca37a312d716f7122d095c6a7f14e
Instruction ID: e07c39c048416d32de6cbbb5809573ccdc3c55b12813400f09265f1ebbd6a2de
Opcode Fuzzy Hash: 13e8da5adabfe0263b51aafbd9d235d41e7ca37a312d716f7122d095c6a7f14e
Instruction Fuzzy Hash: 86318B72D04159AFCB01EBE4CC51AFEBBB9AF49300F084059F581B7282CA7C9A05AB70

Function 00FC20D8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 73COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FC20DF

Part of subcall function 00F89998: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000), ref: 00F899BB

Part of subcall function 00FB5EED: __EH_prolog3.LIBCMT ref: 00FB5EF4

Part of subcall function 00FB5F2A: __EH_prolog3.LIBCMT ref: 00FB5F31
Part of subcall function 00FB5F2A: __fassign.LIBCMT ref: 00FB6014

Strings

MFCEditBrowse_Mode, xrefs: 00FC212A
..., xrefs: 00FC215B, 00FC2178

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: H_prolog3$ByteCharMultiWide__fassign
String ID: ...$MFCEditBrowse_Mode
API String ID: 1708987901-1707052652
Opcode ID: 258b89ef9eec3ff80f1c0b8130f08e7281b19fec3383b263a7d0ba4c0358df19
Instruction ID: 31c47816d2d2cc38e21049c5ce726d19e22c637a59fa61afb994dfbe18586e1d
Opcode Fuzzy Hash: 258b89ef9eec3ff80f1c0b8130f08e7281b19fec3383b263a7d0ba4c0358df19
Instruction Fuzzy Hash: E4218E7190050BBACF44FBA18E96FFEB268FF10314F58461DB151A6182DE784A05B622

Function 00FB8133 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00FB817B
SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 00FB818D

Part of subcall function 00F72127: __CxxThrowException@8.LIBCMT ref: 00F7213D
Part of subcall function 00F72127: __EH_prolog3.LIBCMT ref: 00F7214A

Strings

N, xrefs: 00FB8138

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: MessageSend$Exception@8H_prolog3Throw
String ID: N
API String ID: 2952110909-1130791706
Opcode ID: 6d8109a740f89478bd7ed829ad3584a2b333f1cb078a094abd306a39b0c43beb
Instruction ID: b9b27d48a759e22ac19d5181f1f65249999f9840ffdfcb836a7002f7e21cf038
Opcode Fuzzy Hash: 6d8109a740f89478bd7ed829ad3584a2b333f1cb078a094abd306a39b0c43beb
Instruction Fuzzy Hash: 4E11E535700705AFDB219E6ACC40BDAB7ADBF943A1F104129F6595A2A1DF70DC12EB90

Function 00F620E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00F620F0
GetClassNameA.USER32(00000000,?,00000032), ref: 00F620FD

Strings

WindowsScreenSaverClass, xrefs: 00F62103

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: ClassForegroundNameWindow
String ID: WindowsScreenSaverClass
API String ID: 2583640211-352026012
Opcode ID: ee2475c5ae1cbb473b8379799170dc799bc31161736769c6e4aac40e1a3a7003
Instruction ID: 10d99147ec7074e21611cf830c370da5cdfc4bc217555d473df833b243f1dc87
Opcode Fuzzy Hash: ee2475c5ae1cbb473b8379799170dc799bc31161736769c6e4aac40e1a3a7003
Instruction Fuzzy Hash: 00F04C31E1C2485BCB149F749DD66B97BAB9B17210B844598EAC1CB281EF33D80CD700

Function 00FF40EE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34registryclipboardCOMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00FF40F5
RegisterClipboardFormatA.USER32(00000010), ref: 00FF413E

Strings

ToolbarButton%p, xrefs: 00FF412C

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: ClipboardFormatH_prolog3Register
String ID: ToolbarButton%p
API String ID: 1070914459-899657487
Opcode ID: 472c4bf30c6567fcafb937420aa0166fee8753f1cf5080318fe0bfa55e06a5ff
Instruction ID: 8375eea1af4a9b2bafc5abc3b93b6b2805388a0a261257de6e47141f4dfadf90
Opcode Fuzzy Hash: 472c4bf30c6567fcafb937420aa0166fee8753f1cf5080318fe0bfa55e06a5ff
Instruction Fuzzy Hash: C4F0C231C012098ACF20FBA4DC017EE7374BF20324F084419F9A4A7295DBBC6584DB95

Function 00F62070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

FindWindowA.USER32(StretchWareAppClass,00000000), ref: 00F62078
GetForegroundWindow.USER32(00000000,?,?,?,00F6173C), ref: 00F6208A

Strings

StretchWareAppClass, xrefs: 00F62073

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: Window$FindForeground
String ID: StretchWareAppClass
API String ID: 3863363130-3943464107
Opcode ID: 9404e5c1ca9ccec25542ca09cccd18e531edb4b20a91d9b1448960ad4e0964ef
Instruction ID: 4d2b15eb131b5a75556e2949fd57094929f0c34cf13e7b7cd34ea757cde51d3f
Opcode Fuzzy Hash: 9404e5c1ca9ccec25542ca09cccd18e531edb4b20a91d9b1448960ad4e0964ef
Instruction Fuzzy Hash: CAD05E3395A93176DA7037F47C09B8E76884B00B61F554016F989DA10AD85D8CC192D1

Function 00F8E114 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(010D78D4,00000000), ref: 00F8E11F
CreateCompatibleDC.GDI32(00000000), ref: 00F8E133

Strings

@Ls Fs, xrefs: 00F8E133

Memory Dump Source

Source File: 0000000B.00000002.3342305660.0000000000F61000.00000020.00000001.01000000.00000008.sdmp, Offset: 00F60000, based on PE: true

Associated: 0000000B.00000002.3342267832.0000000000F60000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342482580.0000000001087000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342554920.00000000010CB000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000B.00000002.3342588557.00000000010D9000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f60000_StchCtrl.jbxd

Similarity

API ID: CompatibleCreateExchangeInterlocked
String ID: @Ls Fs
API String ID: 1770991917-1589975592
Opcode ID: c51a721fd6d555dddb42a0d2d1c80427a880e6e6fea0b5ab16e6ee178ce17f36
Instruction ID: f257f41348a3e799174b8952ed591ef6b8250ea975efa8e53fb5236fa2b368f9
Opcode Fuzzy Hash: c51a721fd6d555dddb42a0d2d1c80427a880e6e6fea0b5ab16e6ee178ce17f36
Instruction Fuzzy Hash: 36D0A732B001106AE730251AAC0CBCF3908DBD1230B261035F48AD2008C6799C424261

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report StretchInstall.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\3ad364.rbs

C:\Program Files (x86)\Shelter Publications\StretchWare\StchCtrl.exe

C:\Program Files (x86)\Shelter Publications\StretchWare\Stretch.exe

C:\Program Files (x86)\Shelter Publications\StretchWare\StretchHook.dll

C:\Program Files (x86)\Shelter Publications\StretchWare\StretchRes.dll

C:\Program Files (x86)\Shelter Publications\StretchWare\StretchWare.ico

C:\Users\user\AppData\Local\Temp\IXP000.TMP\StretchWare.msi

C:\Users\user\AppData\Local\Temp\IXP000.TMP\setup.exe

C:\Users\user\AppData\Local\Temp\VSDAAAD.tmp\install.log

C:\Users\user\AppData\Roaming\Microsoft\Installer\{1D2F2573-A76A-47DA-BB96-6860D17CC45B}\_24275761ADC5B212D44AB6.exe

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StretchWare\Stretch.lnk

C:\Windows\Installer\3ad363.msi

C:\Windows\Installer\3ad365.msi

C:\Windows\Installer\MSID586.tmp

C:\Windows\Installer\SourceHash{1D2F2573-A76A-47DA-BB96-6860D17CC45B}

C:\Windows\Installer\inprogressinstallinfo.ipi

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

C:\Windows\Temp\~DF2ABCACBD02624351.TMP

C:\Windows\Temp\~DF46909EA4B1ED9E92.TMP

C:\Windows\Temp\~DF4E7E7153EF1D3B16.TMP

C:\Windows\Temp\~DF4F66FA6C75604436.TMP

Windows Analysis Report
StretchInstall.exe

Function 010026E2 Relevance: 51.0, APIs: 17, Strings: 12, Instructions: 268
stringmemoryCOMMON

Function 0100456A Relevance: 19.4, APIs: 10, Strings: 1, Instructions: 188
COMMON

Function 010052D4 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 96
stringCOMMON

Function 01006205 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 115
libraryfileloaderCOMMON

Function 01004819 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49
COMMON

Function 01001AA7 Relevance: 47.4, APIs: 19, Strings: 8, Instructions: 178
registrystringlibraryCOMMON

Function 01005ABC Relevance: 40.5, APIs: 11, Strings: 12, Instructions: 274
stringlibraryloaderCOMMON

Function 01005F21 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 239
stringmemoryCOMMON

Function 0100589B Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 127
threadwindowCOMMON

Function 010053FA Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 180
synchronizationCOMMON

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre